GESTOR DE ACTIVOS PRISMA, S.A.P.I. DE C.V.

In order to comply with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties and the international conventions to which Mexico is a party (the “Law”), its Regulations, and applicable Guidelines, GESTOR DE ACTIVOS PRISMA, S.A.P.I. DE C.V. (the “Company”), residing at Av. Lázaro Cárdenas 2305, Piso Mezanine, Colonia Residencial San Agustín, San Pedro Garza García, Nuevo León (the “Address”), Website www.hotelesprisma.com and contact email address protecciondedatos@hotelesprisma.com makes available this PRIVACY NOTICE, with the purpose of providing legitimate, controlled, and informed treatment to your personal data, as well as guaranteeing your privacy and your right to informational self-determination when providing us with such data, observing at all times the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility provided for in the Law.

The Company has a portfolio of hotels which it operates, promotes, manages, and administers, in accordance with the corporate purpose of the company and the service provision agreement generated with the franchisors of the hotel businesses (the “Hotel Portfolio”).

The Company does not request sensitive personal data such as those that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical, and moral beliefs, union affiliation, political opinions, or sexual preference.

PERSONAL DATA REQUESTED AND MECHANISMS FOR ITS COLLECTION

The Company, through its Hotel Portfolio, requests and obtains personal data in general under the Law (hereinafter “General Personal Data”, respectively; and jointly referred to as “Personal Data”) from the following individuals:

A) EMPLOYEES

The Personal Data collected from employees is necessary to document the employment relationship that exists with each of them. The Personal Data that you voluntarily and freely provide to the Company consists of personal information that is or may be included in contracts, letters, formats, lists, databases, or other physical and/or electronic media, as applicable, so that the Company can maintain an adequate record of the employment relationship with its employees and comply with internal policies, procedures, and other legal obligations applicable to the Company.

The General Personal Data that will be requested from you is the following: full name (paternal surname, maternal surname, and given name(s)), complete home address, date and place of birth, marital status, current profession or occupation, telephone number(s) related to your location, if any, Unique Population Registry Code (CURP), Federal Taxpayer Registry (RFC), academic and technical education information, training information, income information, employment history information, gender, social security number, photographs, data of immediate family members, and personal references.

B) CANDIDATES

The Personal Data collected from candidates interested in becoming employees of the Company is necessary to document their relationship with the company, as well as for the selection and recruitment process of each one of them. The Personal Data that you voluntarily and freely provide to the Company consists of personal information that is or may be included in contracts, letters, formats, lists, databases, or other physical and/or electronic media, as applicable, so that the Company can maintain an adequate record of your job application and comply with internal policies, procedures, and other legal obligations applicable to the Company.

C) SUPPLIERS

The Personal Data collected from suppliers of the Company is necessary to document the legal relationship that exists with each of them. The Personal Data that you voluntarily and freely provide to the Company consists of personal information that is or may be included in contracts, as applicable, so that the Company can maintain an adequate record of its relationship with its suppliers and comply with internal policies, procedures, and other legal obligations applicable to the Company.

The General Personal Data that will be requested from you is the following: full name, nationality, age, place and date of birth, address, home and/or mobile phone number, email address, marital status, profession, Federal Taxpayer Registry (RFC) code, and Unique Population Registry Code (CURP).

D) CUSTOMERS/GUESTS

The Personal Data collected from customers and/or guests of the company is necessary to document the legal relationship that exists with each of them, and it will also be used to provide the lodging services entered into between you in your capacity as a guest and any of the lodging establishments operated by our group. The Personal Data that you voluntarily and freely provide to the Company consists of personal information that is or may be included in contracts, as applicable, so that the Company can maintain an adequate record of its relationship with its customers and/or guests and comply with internal policies, procedures, and other legal obligations applicable to the Company.

The General Personal Data that will be requested from you is the following: your full name; date of birth; address, whether home, work, or tax address; email address, personal or work; telephone number, home or work; vehicle license plate number; photocopy of an official identification issued by an authority; credit card number, security code, and expiration date; Federal Taxpayer Registry (RFC); Unique Population Registry Code (CURP); professional information; or others of an analogous nature that allow the Hotel Portfolio to operate and comply with its commercial, administrative, and labor obligations.

In all cases, the collection of Personal Data by the Company is carried out in good faith and for the purposes set forth herein; therefore, it is presumed that the data provided by its holders is truthful and complete, making it the responsibility of the holder who provides it.

PURPOSES OF THE PROCESSING OF PERSONAL DATA

The Personal Data provided to the Company will be used as explained below:

A) EMPLOYEES

Purposes that are necessary for the existence, maintenance, and fulfillment of your employment relationship with the Company: (i) to comply with the legal requirements applicable to the employment relationship in accordance with the Federal Labor Law, the Social Security Law, and other applicable regulations; (ii) to maintain an adequate record of personnel; and (iii) to coordinate services provided by and for the Company for the benefit of its employees.

B) CANDIDATES

Purposes that give rise to and are necessary for the company’s job selection and recruitment process: (i) to process job applications; (ii) to conduct socioeconomic investigations; (iii) to verify the truthfulness of the information provided; and (iv) to contact candidates, if necessary.

C) SUPPLIERS

Purposes that are necessary for the existence, maintenance, and fulfillment of your legal supplier relationship with the Company: (i) to manage the information of our agents and suppliers to keep our databases updated; (ii) to integrate files, generate your online profile, and manage the administration and security of your personal data; (iii) to manage the commercial relationship with our agents and suppliers, including the selection and contracting process, as well as the management of purchase order and/or contracting requests; (iv) to manage the payment of invoices and/or fee receipts, retain corresponding taxes, accredit your identity, and verify the information you provide us; (v) to maintain physical, electronic, and procedural safeguards of your personal data in terms of applicable legislation and regulation; and (vi) to comply with legal requirements in civil, commercial, administrative, and tax matters.

D) CUSTOMERS/GUESTS

Purposes that are necessary for the existence, maintenance, and fulfillment of your legal relationship for the provision of hotel services by the Company to the guest: (i) to manage the information of our customers and/or guests to keep our databases updated; (ii) to integrate files, generate your online profile, and manage the administration and security of your personal data; (iii) to manage the commercial relationship with our customers and/or guests, including the customer service process, as well as the management of lodging requests; (iv) to manage the payment of invoices and/or payment receipts, retain corresponding taxes, accredit your identity, and verify the information you provide us; (v) to maintain physical, electronic, and procedural safeguards of your personal data in terms of applicable legislation and regulation; and (vi) to comply with legal requirements in civil, commercial, administrative, and tax matters.

In all cases, once the purposes for processing your Personal Data have been fulfilled, and when there is no legal provision establishing otherwise, the Company will proceed with the cancellation, deletion, and/or destruction of the Personal Data received, under the terms established by Law.

TRANSFERS OF PERSONAL DATA

As part of its own business operations and in order to fulfill the described purposes, the Company may share some or all of your Personal Data with third parties, domestic or foreign, in accordance with the following:

A) EMPLOYEES

These third parties may be authorities, parent companies, subsidiaries, affiliates, and/or entities that provide services to the Company to (a) comply with existing legal obligations; (b) comply with a legal or judicial order; and (c) as long as it is necessary for the ordinary operation and functioning of the Company in accordance with its policies and procedures. Personal Data may also be transferred by the Company to third parties providing payroll administration services, health services, or personnel, medical, and/or asset insurance services to the Company, in order to manage and administer these services on behalf of and for the benefit of the data holder for purposes derived from their employment relationship.

B) CANDIDATES

These third parties may be authorities, parent companies, subsidiaries, affiliates, and/or entities that provide services to the Company to (a) comply with existing legal obligations; (b) comply with a legal or judicial order; and (c) as long as it is necessary for the ordinary operation and functioning of the Company in accordance with its policies and procedures. Personal Data may also be transferred by the Company to third parties providing medical examination services to the Company, in order to manage and administer these services on behalf of and for the benefit of the data holder for purposes derived from their relationship with the Company.

C) SUPPLIERS

These third parties may be authorities, parent companies, subsidiaries, affiliates, and/or companies that provide services to the Company, in order to comply with existing legal obligations, comply with a legal or judicial order, and as long as it is necessary for the ordinary operation and functioning of the Company in accordance with its internal policies and procedures with suppliers of the Company.

D) CUSTOMERS/GUESTS

These third parties may be individuals or corporations that comply with the guidelines to be able to stay at any of the facilities operated by the Company as a hotel manager, in order to fulfill our objective of providing hotel services, as well as to comply with existing legal obligations, comply with a legal or judicial order, and as long as it is necessary for the ordinary operation and functioning of the Company in accordance with its internal policies and procedures with customers and/or guests of the Company.

In all cases, the Company will communicate this Privacy Notice to these third parties and will ensure, through the signing of agreements and/or the adoption of other binding documents, that such third parties maintain the necessary administrative, technical, and physical security measures to safeguard your Personal Data, and that such third parties only use your Personal Data for the purposes for which it was collected.

Likewise, both the Company, as the party responsible for collecting Personal Data, and any other person related to the Company who has access to the information contained in this Privacy Notice, will be textually obligated to safeguard it under the same security and confidentiality standards, and not to disclose it or make improper use of it, otherwise being held responsible in accordance with applicable laws.

Notwithstanding the foregoing, the Company will not transfer your Personal Data to third parties unrelated to the Company without your prior consent, except in the aforementioned cases and those provided for by the Law.

MEANS AND PROCEDURES FOR THE EXERCISE OF ARCO RIGHTS

You, as the holder of the Personal Data provided to the Company, may request at any time the exercise of your rights of access, rectification, cancellation, or opposition (“ARCO Rights”) regarding the processing of your Personal Data, consisting of: (i) accessing your Personal Data and the details of its treatment; (ii) rectifying your Personal Data if it is inaccurate or incomplete; (iii) canceling your Personal Data when you consider that it is not required for any of the purposes specified in this Privacy Notice, is being used for non-consented purposes, or your contractual, service, or other relationship with the Company has ended; and (iv) opposing the processing of your Personal Data for specific purposes.

To this end, you must submit your request in writing to the Company’s Human Resources Department located at the Address, or send your request to the Email Address directed to the person in charge of the Personal Data Department, as applicable, which must contain at least the following information: (a) your full name and address, or another suitable means to communicate the response to your request; (b) the documents that accredit your identity or, as the case may be, that of your legal representative; (c) a clear and precise description of the Personal Data with respect to which you seek to exercise any of the aforementioned rights; and (d) any other element or information that facilitates the location of the Personal Data, as well as any other document required by current regulations at the time of submitting the request. You may also request more information from the Human Resources Department or via the Email Address regarding the procedure for exercising your ARCO Rights, as well as the “ARCO Rights Request” form that we suggest using for these purposes.

The response to your request will be made known to you by the Company within the terms and timeframes established in the Law. However, you can obtain more information about the status of your request and its response timeframe by contacting the Human Resources Department or sending your request to the Email Address, where they can also address any clarification or doubt you may have regarding the treatment of your Personal Data and the exercise of your ARCO Rights.

REVOCATION OF CONSENT; LIMITATION OF USE AND DISCLOSURE OF PERSONAL DATA

You may also revoke, at any time, the consent you have granted to the Company for the processing of your Personal Data, as well as request that its use and disclosure be limited, provided that a legal provision does not prevent it. To this end, you must submit your request in writing to the Human Resources Department of the Company located at the Address, or send your request to the Email Address to the attention of the person in charge of the Personal Data Department, as applicable. Such request must comply with the same requirements mentioned in Section 4) above.

The response to your request will be made known to you by the Company within the terms and timeframes established in the Law. However, you can obtain more information about the status of your request and its response timeframe by contacting the Human Resources Department or sending your request to the Email Address, where they can also address any clarification or doubt you may have regarding the treatment and these rights that correspond to you regarding your Personal Data.

In the event that your Personal Data had been sent prior to the date of revocation of consent and continues to be processed by data processors, the Company will notify the latter of such revocation so that they may proceed accordingly.

CHANGES TO THE PRIVACY NOTICE

The Company reserves the right to modify and/or update this Privacy Notice in any or all of its parts at its sole discretion, in which case it will communicate it right here through its Website; and, depending on the particular case of each holder, through its internal networks, or by means of a notice that will be placed in the usual communication channels (physical or electronic) of the Company and in a visible place at the Address, or via a written notice sent to your email address, as legally required.

Date of last update: June 2021