PRIVACY NOTICE

• Identity

Grupo Posadas, S.A.B. de CV and its affiliates and / or subsidiaries (hereinafter referred to collectively as Posadas), headquartered at 1015th Prolongación Paseo de la Reforma, Ninth Floor, Col. Santa Fe de Cuajimalpa, Cuajimalpa, CP 05348, Mexico City is committed to protecting your privacy. Posadas’ Department of Personal Data oversees all identity, privacy and data protection and is located at the same headquarters address. You may contact the department directly at datos.personales@posadas.com

The privacy policy outlined here applies to the following Posadas websites.

• Personal Data

For the purposes laid out in this Privacy Policy, Posadas may collect personal information in several different ways: when you provide the information to Posadas directly, when you visit Posadas websites, when you use online services offered by Posadas, and when collected by Posadas through other means allowed by the law.

Personal data obtained by Posadas through these means includes:

1. Identify Data: your names and family name, address, home phone number, mobile and / or work phone number, marital status, signature, email, gender, age, date of birth, username and password.
2. Financial Data: cardholder name, credit card number and expiration date (for online transactions).
3. Billing Data: name or business name, tax registration number and tax domicile.
4. Preference Data: details relating to your room, service and travel preferences.

• Sensitive Personal Data

Personal data is classified as sensitive when it involves an individual’s most closely held details or when its misuse may potentially lead to discrimination or pose a risk of discrimination. Specifically, Posadas considers information that might disclose potentially sensitive issues such racial or ethnic origin; present and future health status; genetic information; religious, philosophical and moral beliefs; union membership; political affiliations; and sexual preferences. When you stay in one of our hotels, and you provide any information concerning your health or any disabilities, this data will only be used to serve you better and to meet your specific needs.

• Use and Purpose of Personal Data

Events when personal data is legally required in order for Posadas to provide a service:

1. . Posadas uses the personal information provided by you in order to perform or deliver the services you requested, or they are part of a program for which you registered. These events include making reservations, buying vacation packages, becoming a vacation club member, becoming a member of Posadas loyalty programs, attending events or social gatherings, or purchasing goods and / or tour and travel-related services.
2. Posadas may use the personal data you provide to better serve you and, where appropriate, identify your preferences during your stay, in order to make it more enjoyable.

Events when personal data is not required for Posadas to provide a service:

1. Posadas may also use your information to offer you promotions, tourism and consumer products, special services, newsletters, surveys, giveaways and online contests.

• Limitations on the Use or Disclosure of Personal Data

At any time you may request that your personal information not be used for purposes other than those purposes that are legally required for Posadas to provide you with a service. You must submit this request in writing to Posadas’ Department of Personal Data at the following address: 1015th Prolongación Paseo de la Reforma, Ninth Floor, Col. Santa Fe, Alvaro Obregon, CP 01210, Mexico City or email it to datos.personales@posadas.com. Written requests will be processed between 9am and 2pm Monday through Friday.

Any such requests must include at least the following items: (i) Name of the owner of the personal data; (ii) An email address where a confirmation notice may be sent; (iii) Documents proving your identity or demonstrating your legal representation for the owner; (iv) A clear and concise description of the personal data in question and the requested action; (v) Any other item or document that will facilitate the request or the locating of your personal data. If the request is missing any of these requirements, the Department of Personal Data may respond within 5 days of your request and ask that you provide the required information or documents. In this event, you will have 10 days to submit the needed information or documents. If you do not respond with the missing items in that timeframe, no further action will be taken and no changes will be made to your personal data or their usage.

After Posadas receives a request with all required items included, it will make a determination and respond within 20 days. When Posadas confirms that a requested change will be made to the use of personal data, that change will become effective 15 days after Posadas emails a confirmation that the change will occur. In order to protect your privacy, Posadas will send its response to the email address you included in the request and will have all details available to you during the designated business hours and at the address listed above.

• Exercising Rights of Access, Rectification, Cancellation and Opposition

You are able to exercise your rights of access, rectification, cancellation or opposition to the information you provided to Posadas, as stated in Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties. You may do so by delivering the request to Posadas, following the steps outlined in subsection E above. Posadas will respond as outlined above.

• Control and Security of Personal Data

Posadas agrees to take necessary precautions to protect the data it has collected, utilizing security technologies and procedures to restrict access, use, or disclosure of personal data without consent. For example, the personal data you provide will be stored on computer servers in secure data centers with restricted access. For online transactions, Posadas also uses security technologies to protect data that is transmitted electronically, such as the use of a secure server on the Secure Socket Layer (SSL).

However, no security system or data transmission devices over which Posadas does not retain absolute control or is dependent on the Internet can be guaranteed to be totally secure.

• Electronic Media and Cookies

In the event that you visit any of our websites, cookies will be generated and stored on your computer in order to provide you with a better experience. Cookies are small pieces of information that are transferred to your browsers by websites.
They are stored on your computer’s hard drive and are used to determine your preferences when you connect to our websites and to track users’ behavior online and activities on our websites. Some sections of our websites require that visitors have cookies enabled in order for the sites to be fully functional. Cookies allow us to: a) Recognize when you enter our sites and offer a personalized experience, b) Know and activate the customized settings you specified for our websites, allowing our servers to transfer the correct information to you. For example, cookies allow us to detect the bandwidth you have selected when arrive on our site’s home page so that information is sent to your browser in the proper form. c) Estimate the size of our audience and measure certain traffic parameters. Each browser that accesses our sites acquires a cookie that measures the frequency of use and what sections of our website are visited. This reflects visitors’ habits and preferences. We use this information to improve our websites’ content, headlines and promotions. Cookies also help us track some online activities. For example, we use cookies in some online surveys to tell us if you have already answered a survey so we don’t ask you to answer it again. You can check your web browser’s “Help” section to learn how to avoid accepting new cookies, to have your browser tell you when you receive a new cookie, or to disable all cookies. Remember that cookies allow you to take advantage of some of our websites’ most useful features, so Posadas recommends that you leave them turned on.

• Changes to this Privacy Notice

Posadas may update this privacy notice at any time. In the event that substantial changes are made to our notice, we will notify you via the websites listed in subsection A of this Privacy Notice. We also recommend that you visit this statement periodically in order to be aware of any updates.

I agree and accept the terms of Privacy Notice, and otherwise I will get in contact with Posadas as indicated in the subsections E. and F. of this Privacy Notice.

In case of any grievance or complaint about the treatment of your personal data, you can contact the Federal Institute for Access to Information and Data Protection.

Last updated: July 18th, 2016.