Comprehensive Privacy Notice

I. Definitions

For the purposes of this Privacy Notice, the following terms shall mean:

I.1. ARCO:

Spanish acronym for “Access, Rectification, Cancellation and Opposition”.

I.2. Privacy Notice:

This document, made available to the Data Subject.

I.3. Database:

The set of personal data held by the Controller.

I.4. Blocking:

The identification and retention of personal data once the purpose for which they were collected has been fulfilled, in order to determine potential liabilities related to their processing, until the applicable legal or contractual statute of limitations expires. During that period, the personal data may not be processed and, once it ends, they shall be deleted from the database.

I.5. Consent:

A free, specific and informed expression of the Data Subject’s will by which the processing of their data is carried out.

I.6. Personal data:

Any information concerning an identified or identifiable individual. A person is considered identifiable when their identity can be determined, directly or indirectly, through any information.

I.7. Sensitive data:

Personal data that affect the most intimate sphere of the Data Subject, or whose misuse may give rise to discrimination or entail a serious risk to them. By way of example and without limitation, personal data that may reveal aspects such as racial or ethnic origin, health status, genetic information, religious, philosophical and moral beliefs, political opinions and sexual preferences are considered sensitive.

I.8. Affiliates and subsidiaries of the Controller:

Companies that are affiliates, subsidiaries or members of the Controller’s corporate group, in accordance with Article 36, section III, of the Law.

I.9. Processor:

An individual or legal entity that, alone or jointly with others, processes personal data on behalf of the Controller and in accordance with its instructions.

I.10. Controller:

Fundación Oasis, as the legal entity that decides on the processing of personal data.

I.11. Law:

Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares).

I.12. Organization:

The Controller identified at the beginning of this Privacy Notice.

I.13. Regulations:

Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties.

I.14. Ministry:

Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the competent authority for the purposes of the Law.

I.15. Activities:

The set of acts, procedures, formalities, services, programs, events, communications and legal, employment, administrative, cultural, social or any other relationships that the Controller carries out in fulfillment of its corporate purpose and its own aims, including those related to human resources, service to the general public, foundations and cultural centers, where applicable.

I.16. Digital media:

Websites, forms, platforms, applications and other electronic channels used by the Controller.

I.17. Third parties:

Any Mexican or foreign individual or legal entity other than the Data Subject or the data controller.

I.18. Data Subject:

The person to whom the personal data belong.

I.19. Processing:

Any operation or set of operations performed through manual or automated procedures on personal data, related to their collection, use, recording, organization, retention, preparation, utilization, communication, dissemination, storage, possession, access, handling, exploitation, disclosure, transfer or disposal.

I.20. Transfer:

Any communication of personal data, within or outside Mexican territory, made to persons other than the Data Subject, the controller or the processor.

II. Processing and purposes of the data collected

The Controller shall process the Data Subject’s personal data in compliance with the principles of lawfulness, consent, notice, quality, purpose, loyalty, proportionality and accountability in the processing of personal data, as well as the duties of security and confidentiality set forth in the Law.

A. Primary or necessary purposes

Personal data may be processed, as relevant to the existing relationship with the Data Subject, for the following primary or necessary purposes:

• 1.- To identify the Data Subject, verify their identity and keep up to date the information needed to serve them;
• 2.- To establish, manage, document and follow up on legal, employment, administrative, institutional or collaborative relationships;
• 3.- To receive, process and respond to requests, inquiries, registrations, enrollments, procedures and communications;
• 4.- To comply with applicable legal, tax, employment, social security, accounting and administrative obligations;
• 5.- To manage, where applicable, payments, receipts, refunds and tax documentation; and
• 6.- To maintain the safety of people, facilities, property and systems, as well as to handle incidents and to exercise or defend rights.

B. Secondary purposes

Additionally and where applicable, the Controller may process personal data for secondary purposes that are not essential to maintaining the relationship with the Data Subject:

• 1.- To send invitations, news, publications and informational communications about the organization’s activities and initiatives;
• 2.- To conduct opinion, satisfaction or activity-evaluation surveys;
• 3.- To publicize calls, events and activities of general interest;
• 4.- To send non-essential promotional or institutional communications;
• 5.- To gather comments and suggestions to improve activities and processes;
• 6.- To prepare non-essential statistical analyses and internal studies, using dissociated data whenever possible;
• 7.- To learn about general interests in order to improve institutional communication; and
• 8.- To prepare continuous-improvement indicators and reports that are not required by a legal obligation.

The Data Subject may refuse the processing for secondary purposes or revoke the corresponding consent by sending a request to protecciondatos@oasishoteles.com, without affecting any activities or relationships that do not depend on those purposes.

C. Transfers of personal data

The Controller may transfer personal data to competent authorities when there is a legal obligation or when an exception provided for by the Law applies; personal data may also be transferred to entities of the same corporate group or to other recipients when there is a valid legal basis, such transfers are necessary to fulfill the purposes described herein, and they are permitted by applicable law.

When transfers fall under any of the exceptions provided for in Article 36 of the Law, the Data Subject’s consent will not be required.

In all other cases where consent is legally required, the Controller will inform the Data Subject in advance of the recipients or categories of recipients and the purposes of the transfers, and will obtain their consent in accordance with applicable provisions.

D. Processing of personal data by processors

Any processor handling data on behalf of the Controller must abide by its instructions, the authorized purposes and the applicable confidentiality and security obligations.

E. Means of collecting personal data

Personal data may be obtained directly from the Data Subject, from their representative or, where legally permitted, from third parties, through the following means:

• a) Physical or electronic forms and documentation provided by the Data Subject;
• b) In-person, telephone, written or digital communications;
• c) Records, requests, procedures and formalities arising from the relationship with the Data Subject;
• d) Access systems, duly disclosed video surveillance and other legally permitted sources, where applicable.

III. Personal data collected

Depending on the nature of the relationship and in accordance with the principle of proportionality, the following categories of personal data may be collected:

• Identification data: name, signature, date of birth and identity documents, when necessary.
• Contact data: telephone number, mobile phone number and other means of communication.
• Address.
• Sex.
• Nationality.
• Academic and professional data: information related to studies, academic background, professional experience and training activities, where applicable.
• Digital contact data: email address and other information provided through electronic forms, newsletter subscriptions and other digital media.
• Tax, employment and social security data, where applicable.
• Documents and certificates required to prove identity, representation or applicable requirements.
• Financial and asset data, only when necessary for payments, refunds, compliance with obligations or a specific legal relationship.

The personal data collected may be recorded, used, stored and retained in the Controller’s databases solely for the purposes set out in this Privacy Notice.

The Controller may verify the authenticity, accuracy and validity of the personal data provided by the Data Subject by consulting documents, public records, legally accessible sources of information or, when necessary, specialized third parties, solely for the purposes described in this Privacy Notice.

When such verification involves processing personal data that require the Data Subject’s specific consent or express authorization, the Controller shall obtain it beforehand, in accordance with applicable law.

In all cases, the information obtained will be processed in accordance with the principles of lawfulness, purpose, proportionality, security and confidentiality established in the Law.

If the Data Subject provides data relating to third parties, they declare that they have those persons’ consent and undertake to pass on to them, as the owners of such data, the information contained in this Privacy Notice, releasing the Controller from any liability in this regard. Nevertheless, the Controller may carry out the checks necessary to confirm this, adopting the appropriate due-diligence measures in accordance with data protection regulations.

Sensitive personal data

The Controller does not routinely collect sensitive personal data. However, when strictly necessary for carrying out its activities and fulfilling specific, legitimate purposes previously disclosed to the Data Subject, it may collect sensitive personal data and will first request the Data Subject’s express written consent, in cases where such consent is required under applicable law.

Such data may include, as applicable, information relating to present or future health status, disabilities, genetic information, racial or ethnic origin, religious, philosophical or moral beliefs, political opinions and sexual preferences.

These data will be processed in accordance with applicable legal provisions and, where required, with the Data Subject’s prior express written consent.

IV. Limiting the use or disclosure of personal data

The Data Subject may at any time request that the use or disclosure of their personal data be limited for purposes that are not necessary to comply with legal obligations or to maintain the existing legal relationship with the Controller.

To do so, the Data Subject may submit a request by email to protecciondatos@oasishoteles.com, stating their full name, the personal data for which the limitation is requested and the purposes to which it should apply.

The Controller will handle the request in accordance with applicable legal provisions and will inform the Data Subject of the measures adopted or, where applicable, of the legal reasons that prevent it from being granted.

V. Exercise of the rights of Access, Rectification, Cancellation and Opposition

The Data Subject has the right to know what personal data the Controller holds, what it uses them for and the conditions of their processing (Access). They also have the right to request the correction of their personal information if it is outdated, inaccurate or incomplete (Rectification); to have it removed from our records or databases when they consider that it is not being used in accordance with the principles, duties and obligations set forth in the regulations (Cancellation); and to object to the use of their personal data for specific purposes (Opposition). These rights are known as ARCO rights.

I. Request

The Data Subject must submit their ARCO Rights Request either in person or digitally (exclusively by email to protecciondatos@oasishoteles.com). The request must include the following information:

• A. Name of the Data Subject.
• B. Documents proving the Data Subject’s identity (voter ID card, passport, military service card, professional license, driver’s license and/or immigration document).
• C. Where applicable, the name of the Data Subject’s representative and documents proving their identity and authority.

To prove the identity of a representative who is an individual, any of the following three options may be chosen: 1) a simple power of attorney signed before two witnesses, attaching simple copies of their official IDs; 2) a public instrument (a document executed before a Notary Public); or 3) the appearance of the Data Subject and their representative before the Controller.

• D. Address or any other means for receiving notifications.
• E. A clear and precise description of the personal data to be rectified or cancelled, or whose processing is objected to.
• F. A description of the right to be exercised or of what the Data Subject is requesting.
• G. Where applicable, documents or information that help locate the personal data, including the area responsible for processing them.

For more information on cases in which the Data Subject is a minor or representation is required, the Controller will proceed in accordance with the Procedure for the Exercise of ARCO Rights in the Private Sector. To consult the support guide originally published by the former National Institute for Transparency, Access to Information and Personal Data Protection (INAI), please visit the following link (in Spanish): https://home.inai.org.mx/?page_id=3374. If further guidance is needed, you may contact, through its official channels, the Personal Data Protection Unit of the Ministry of Anti-Corruption and Good Governance, the federal authority responsible for personal data protection.

The Controller undertakes to receive ARCO rights requests at the following location: Blvd. Kuklkán Km 6.5, Lote 29, Mza 40, CP 77500, Cancún, Quintana Roo, Mexico.

Please note that if the request does not include the information described above, the Controller may ask for the missing information by means of a REQUEST FOR INFORMATION, which must be issued within a maximum of 5 (five) business days from the day after the request is submitted. The Data Subject will then have 10 (ten) business days after receiving it to provide the required information; otherwise, the request will be deemed not submitted.

When the request is submitted, the Controller shall issue an ACKNOWLEDGMENT OF RECEIPT stating the date on which it was received.

II. Response

The Controller will inform the Data Subject or their representative of the decision adopted regarding the request, by email or in person at the address designated by the Controller for such purposes, within 20 (twenty) business days from the date the ARCO rights request was received.

Once the required documents have been submitted, the Controller shall inform the Data Subject or their representative so that the business days within which the request will be carried out can be counted.

III. Resolution

When the request is admissible with respect to the standing and ownership of the ARCO Rights, and the Data Subject and/or their representative has been so informed, the time frames for carrying out the request will be as follows:

• A. Access to data: within 15 (fifteen) days from the Controller’s affirmative response, the electronic documents fulfilling the request will be sent through the same channel used to submit it.
• B. Rectification of data: within 15 (fifteen) days from the Controller’s affirmative response, the electronic documents evidencing the rectification will be sent through the same channel used to submit the request.
• C. Cancellation of or opposition to data: the data will first be blocked from the moment the required documentation is verified, restricting access to the personal data for everyone until the request receives an affirmative or negative response. In the first case, the request will be carried out within 15 (fifteen) days from the Controller’s affirmative response; in the second, the data will be unblocked so that processing may continue.

The time frames referred to above may be extended only once for an equal period, if necessary and upon prior notice from the Controller.

If the Data Subject disagrees with the Controller’s response, does not receive a response within the legal time frame, or considers that any of their rights have been violated, they may file a data protection request with the Ministry of Anti-Corruption and Good Governance.

Pursuant to Article 33 (thirty-three) of the Law, the exercise of ARCO rights will not be admissible, and the Controller may deny it, in the following cases:

• I. When the applicant is not the owner of the personal data, or the legal representative is not duly authorized to act on their behalf;
• II. When the personal data are not in the Controller’s possession;
• III. When the rights of a third party would be harmed;
• IV. When there is a legal impediment, or a ruling by a competent authority, that restricts access to the personal data or does not allow their rectification, cancellation or opposition; and
• V. When the rectification, cancellation or opposition has already been carried out.

The Law also provides that a denial may be partial, in which case the Controller will carry out the access, rectification, cancellation or opposition requested by the Data Subject to the extent admissible.

In all of the above cases, the Controller shall state the reason for its decision and communicate it to the Data Subject or, where applicable, to their legal representative, within the established time frames and through the same channel used to submit the request, attaching any relevant evidence.

The exercise of “ARCO Rights” is free of charge; however, if the provisions of Article 34 of the Law apply—that is, if the Data Subject repeats their request within a period of less than 12 (twelve) months—the cost will be 3 (three) times the Unit of Measure and Update (UMA) in force at the time of the request, unless there are substantial changes to the Privacy Notice that give rise to new ARCO Rights Requests.

All justified costs of shipping, copies or formats shall be borne by the Data Subject or their representative.

VI. Use of cookies and similar technologies

The digital media used by the Controller may use cookies or other similar technologies for technical, security, measurement and experience-improvement purposes, where applicable. Their use and the available configuration options will be disclosed on each medium.

The Data Subject may manage, limit or disable these technologies through the settings available in their browser or device or, where applicable, on the Controller’s own digital media.

Disabling certain technologies may affect the proper operation or availability of some features of the digital services.

For more information on the processing of personal data related to these technologies, the Data Subject may write to protecciondatos@oasishoteles.com.

VII. Changes to this Privacy Notice

The Controller reserves the right to modify or update this Privacy Notice at any time.

Any changes will be announced through institutional communication channels, notices posted at the relevant facilities or the electronic media used by the Controller, as applicable.

VIII. Legal basis

This Privacy Notice is governed by the Federal Law on the Protection of Personal Data Held by Private Parties currently in force, its Regulations, the Privacy Notice Guidelines and other legal provisions applicable for the purposes of the Law and the competent authority.

IX. Contact us

If you have any questions about this Privacy Notice or the processing of your personal data, any concern or complaint regarding the administration of this Privacy Notice, or if you wish to submit a written request regarding your personal data, you may contact us by email at protecciondatos@oasishoteles.com.

This English version is provided for convenience only. In the event of any discrepancy, the Spanish version shall prevail.