PRIVACY NOTICE

A. Identity of the Controller

This Privacy Notice corresponds to the following websites belonging to Posadas:

• Posadas
• Funeeq
• Live aqua residence club
• Fiesta Rewards
• Live aqua
• The Explorean
• Fiesta Americana Travelty
• Globo Go
• Grand Fiesta Americana
• Fiesta Inn
• Favc
• Viajaplus
• Curamoria
• Gamma
• Kivac
• Travelsuite
• Fiesta Americana
• one
• Access Fiesta Rewards
• Enjoymexico
• Roundtrip2x1

B. Personal Data

For the purposes indicated in this Privacy Notice, Posadas may collect your personal data in various ways: when the information is provided directly by you; when you visit Posadas' websites; when you use the services offered by Posadas online through the data that you authorize Posadas to take from your social networks (Facebook, Twitter, LinkedIn, Google) or when connecting to the Wi-Fi that Posadas may offer you; and when we obtain information through other means other than those mentioned above and that are permitted by applicable laws.

The personal data obtained by the means indicated above are:

1. Identification: full name(s), telephone number(s), marital status, email address, age, date of birth, nationality, gender, RFC number, occupation, and preferences related to the lodging service and/or travel needs.
2. Physical Location: private address, tax address; reservation and/or stay dates and codes, flight number, date and time, destination and hotel name, hotel arrival and departure date.
3. Authentication: username and password, holographic and electronic signature, official IDs, and member/traveler number.
4. Patrimonial: bank card number, income level, and tax situation certificate.
5. Sensitive: credit and/or debit bank card number, expiration date and/or CVV, family environment, current and future health status, and medical reports.
6. Biometrics: voice recording

C. Sensitive Personal Data

Sensitive personal data are considered to be those personal data that affect the most intimate sphere of their owner, or whose improper use may give rise to discrimination or entail a serious risk for them. In particular, sensitive are considered those that may reveal aspects such as racial or ethnic origin, current and future health status, genetic information, religious, philosophical and moral beliefs, union affiliation, political opinions, and sexual preferences. In case you require a certain service or product for which you provide this data, Posadas will use it only to provide said service, manage reservation cancellations, identify travel needs, and satisfy your specific needs.

In case of sanitary emergency(s), Posadas, in terms of applicable regulations, will collect data related to your health status with the sole purpose of achieving sanitary protection for you and other people in the hotel or on any property administered by Posadas, information that will only be kept for the time necessary for its conservation. Posadas will keep blocked those data that may be necessary during the legally established periods to attend to any matter related to its treatment or the legal relationship originated with you. After the legal periods have elapsed, the personal data will be deleted by adopting adequate security measures that guarantee their total destruction.

D. Purpose and Processing of Personal Information

Purposes that give rise to the legal relationship and are necessary for the provision of the service:

1. The personal information you provide us will be used by Posadas to provide the services and/or products that you request or that are part of a program you have enrolled in or a purchase you have made: reservations, purchase of vacation packages, vacation club membership, affiliation and redemption in our loyalty programs, affiliation to our referral programs, organization of events and social gatherings, purchase of tourist products and/or services, customer service, and collection management; providing your data to the respective provider if applicable.
2. Posadas may use the personal information you provide us to offer you better service and, where appropriate, identify your preferences during your stay and make it more pleasant.

Purposes that require the consent of the owner since they do not give rise to the legal relationship or are necessary for the provision of the service and that you consent to be carried out:

1. Likewise, it can use the information to offer you tourist and commercial promotions and products, sending promotions, special services, newsletters, surveys, prize drawings, and other online contests, transferring your personal data to affiliated companies if applicable.
2. Data analysis can be performed using technologies to create profiles related to your stays and travel preferences that allow us to evaluate our service and personalize communication and promotions designed for you.

E. Limitation of the Use or Disclosure of Personal Information Regarding Purposes that do not Give Rise to the Legal Relationship.

So that you can limit the use and disclosure of your Personal Information regarding purposes that do not give rise to the legal relationship, we offer you the following means:

1. In the event that you are a resident of the United Mexican States, your registration in the Public Registry to Avoid Advertising, which is in charge of the Federal Consumer Protection Agency, with the purpose that your personal data not be used to receive advertising or promotions from companies of goods or services. For more information, you can consult the PROFECO internet portal, or contact them directly.
2. Send a request to the email datos.personales@posadas.com, indicating the email(s) and/or telephone number(s) that require limitation.

F. Exercise of the Rights of Access, Rectification, Cancellation and Opposition.

The access, rectification, cancellation or opposition regarding the information you provide to Posadas indicated in the Federal Law on Protection of Personal Data Held by Private Parties, or in any applicable standard, can be done by submitting the request in writing to the Personal Data Compliance Area at the following address: Av. Prolongación Paseo de la Reforma 1015, Torre A Piso 9, Col. Santa Fe de Cuajimalpa, Alcaldía Cuajimalpa, C.P.05348, Mexico City, from 9 a.m. to 2 p.m. Monday to Friday, or to the email datos.personales@posadas.com.

Said request must contain at least the following: (i) Name of the Owner of the Personal Data; (ii) Email to receive notifications; (iii) Documents that prove your identity or, where appropriate, the legal representation of the owner; (iv) Clear and precise description of the personal data with respect to which the right is sought to be exercised and the right that is intended to be exercised. (v) Any other element or document that facilitates the location of personal data. In the event that the request does not meet any of the requirements indicated above, the Personal Data Compliance Area may require you within 5 days of receiving the request to provide the necessary elements or documents to process it. You will have 10 days to respond to the request. If you do not respond within that period, the corresponding request will be considered not submitted.

The service times, unless the applicable regulations indicate otherwise, will be a maximum of 20 days from the date the request is received to inform you of the decision adopted, in order for it to be made effective within 15 days following the issuance of the response. The aforementioned periods may be extended once for an equal period, as long as the circumstances of the case justify it.

In order to protect your confidentiality, Posadas will send the response to your request to the email you have provided for this purpose and will keep it available to the applicant at the address indicated in the previous paragraph.

Likewise, you can request information related to the conditions and generalities of the processing of your personal data, by requesting it at the email indicated above.

G. Revocation of Consent for the Use of your Personal Data.

You can revoke the consent you have given us for the processing of your personal data. It is important that you take into account that in not all cases Posadas will be able to attend to your request or conclude immediately, since it is possible that due to a legal obligation it is necessary to continue processing your personal data. Likewise, you must consider that, for certain purposes, the revocation of your consent will imply that we will not be able to continue providing the service you requested, or the conclusion of your relationship with Posadas.

To revoke your consent, you must submit your request in writing to the Personal Data Compliance Area at the following address: Av. Prolongación Paseo de la Reforma 1015, Torre A Piso 9, Col. Santa Fe de Cuajimalpa, Alcaldía Cuajimalpa, C.P.05348, Mexico City, from 9 a.m. to 2 p.m. Monday to Friday, or to the email datos.personales@posadas.com.

The processing of said request and its attention will be carried out in accordance with what is indicated in the previous Section F.

H. Control and Security of Personal Information.

Posadas undertakes to take the necessary measures to protect the information collected, using security technologies and control procedures in the access, use or disclosure of your personal information without authorization, for example, by storing the personal information provided on servers located in Data Centers that have limited access controls. For online transactions, we also use security technologies that protect the personal information that is transmitted to us through various electronic means, such as the use of a secure server under the Secure Socket Layer (SSL) protocol.

However, no security or data transmission system over which the company does not have absolute control and/or has a dependency on the internet can guarantee that it is completely secure.

I. Use of Image

Posadas may make recordings or take photographs for security and service quality purposes.

The capture of your image will be used by Posadas as a control and security measure, prevention of illicit acts in general, and especially with respect to the property, its contents and the people who are in it.

J. Electronic Media and Cookies.

In the event that you use electronic means in relation to your personal data, cookies will be generated in order to provide you with a better service.

Cookies are small pieces of information that are sent by the website to your browser.

Cookies are stored on your computer's hard drive and are used to determine your preferences when you connect to our site's services, as well as to track certain behaviors or activities carried out by you within our sites. In some sections of our site we require the client to have cookies enabled since some of the functionalities require them to work. Cookies allow us to: a) recognize you when you enter our sites and offer you a personalized experience, b) know the personal configuration of the site specified by you, for example, cookies allow us to detect the bandwidth you have selected when you enter the home page of our sites, in such a way that we know what type of information it is advisable to download, c) calculate the size of our audience and measure some traffic parameters, since each browser that accesses our sites acquires a cookie that is used to determine the frequency of use and the sections of the sites visited, thus reflecting your habits and preferences, information that is useful to us to improve the content, headlines and promotions for users. Cookies also help us track some activities, for example, in some of the surveys we launch online, we can use cookies to detect if the user has already filled out the survey and avoid displaying it again, in case they have done so. The "help" button on the toolbar of most browsers will tell you how to avoid accepting new cookies, how to make the browser notify you when it receives a new cookie, or how to disable all cookies. However, cookies will allow you to take advantage of the most beneficial features we offer, so we recommend that you leave them activated.

K. Transfers

Posadas only transfers personal data in the following cases:

1. In those established in article 37 of the Federal Law on Protection of Personal Data Held by Private Parties.
2. In cases where another international standard is applied, it will only be transferred in the cases indicated therein.
3. In cases where it is necessary to provide them to third-party providers regarding the services or products you are hiring.

You are aware that Grupo Posadas, in addition to the transfers it makes and that do not require your consent, may carry out the transfer of your personal data, which is indicated below:

1. In the cases in which you authorize the transmission of your data by physical or electronic means such as "Google Signals".

L. Personal Data Retention Period.

Your personal data will be kept while the legal relationship with you is maintained, until it is satisfactorily concluded and you do not exercise your right of suppression or until you revoke your consent. In any case, the retention period for personal data will be restricted to the minimum necessary, so that they will only be kept as long as the purpose for which they were collected is maintained. When their conservation is no longer necessary, Posadas will keep blocked those data that may be necessary during the legally established periods to attend to any matter related to their treatment or the legal relationship originated with you. After the legal periods have elapsed, the personal data will be deleted by adopting adequate security measures that guarantee their total destruction.

M. Changes to this Privacy Notice.

Posadas may update this privacy notice at any time. In the event that there are substantial changes to this notice, we will communicate it through our websites indicated in section A of this Privacy Notice. Therefore, we suggest you periodically visit this privacy notice to be aware of any updates.

I acknowledge and accept the terms and conditions established in this Privacy Notice, and otherwise I will communicate it to Posadas in terms of what is indicated in sections E, F and G. of this Privacy Notice. In case of any disagreement or complaint about the processing of your personal data, in addition to contacting the person in charge in accordance with this notice, you can go to the National Institute of Transparency, Access to Information and Protection of Personal Data in Mexico, or to the competent authority in the event that a standard other than the Mexican one applies.

Last updated: May 27, 2025.