Privacy Notice

For the purposes of this Privacy Notice, the following terms shall mean:

• I.1. ARCO. Abbreviation of “Access, Rectification, Cancellation and Opposition”.
• I.2. Privacy Notice. This document made available to the Data Subject.
• I.3. Database. The record of personal data held by OTLC.
• I.4. Blocking. The identification and retention of personal data once the purpose for which they were collected has been fulfilled, in order to determine possible liabilities in connection with their processing, until the legal or contractual statute of limitations for such liabilities expires. During that period, the personal data may not be processed and, once it has elapsed, they will be deleted from the database.
• I.5. Personal data. Any information concerning an identified or identifiable person. A person is considered identifiable when their identity can be determined, directly or indirectly, through any information.
• I.6. Hotel. Any hotel accessed or booked through the Website and/or the Vacation Club.
• I.7. Law. Federal Law on the Protection of Personal Data Held by Private Parties.
• I.8. OTLC. The legal entity responsible for processing the Data Subject’s personal data.
• I.9. Regulations. Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties.
• I.10. Ministry. Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the competent authority for the purposes of the Law.
• I.11. Services. Services to be provided by OTLC, individually or jointly, at the request of the Data Subject, with or without a current promotion, consisting of viewing the image bank, providing booking information, making online room reservations at the Data Subject’s preferred hotel, pre-bookings, hotel locator and rate locator.
• I.12. Website. Official OTLC website located on the internet at the Uniform Resource Locator (URL): https://oasis-tlc.com/en.
• I.13. Data Subject. The person to whom the personal data belong.
• I.14. Processing. Any operation or set of operations performed through manual or automated procedures on personal data, related to the collection, use, recording, organization, retention, preparation, utilization, communication, dissemination, storage, possession, access, handling, exploitation, disclosure, transfer or disposal of personal data.

OTLC will process the Data Subject’s personal data in observance of the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality and accountability in the processing of personal data, as well as the duties of security and confidentiality set forth in the Law.

The purposes for which the Data Subject’s personal data are processed are the following:

• 1.- The optimal provision of the Service(s) contracted for or by the Data Subject;
• 2.- Booking, modifying or cancelling the reservation and/or Services;
• 3.- Follow-up on the Service(s) contracted through the Website or those that may be contracted at the Hotel’s facilities.
• 4.- Processing payment(s);
• 5.- Requesting an invoice or digital tax receipt;
• 6.- Customer Service;
• 7.- Sending promotional material, personalizing the Data Subject’s visits to the Website and to OTLC’s official social media, delivering content tailored to the Data Subject’s interests, and participating in interest-based advertising.
• 8.- Sending satisfaction surveys, market research surveys and/or quality assurance surveys.
• 9.- Sending instructions and/or responses regarding the Data Subject’s participation in sweepstakes, contests and/or promotions, which must be sent together with the terms and conditions governing each of them.
• 10.- Receiving advertising through electronic means, for online marketing or telemarketing purposes, about our services;
• 11.- Sharing your comments or suggestions about our services.
• 12.- Your personal data will be used to conduct studies on the demographics, interests and behavior of our customers;
• 13.- Market research in order to offer you personalized services suited to your needs;
• 14.- Internal statistics indicating the services you value most;
• 15.- Affiliates and subsidiaries of OTLC, solely for internal administrative purposes.

Please be advised that your personal data may be shared with companies related to OTLC, as well as with government agencies, local or federal prosecutors’ offices, local or federal courts, or public institutes or entities before which legal proceedings are brought according to the nature of the services you contract, in order to comply with identification or similar requirements.

Affiliates and/or third parties are prohibited from using your personal information for purposes other than those indicated, and we will not use sensitive personal data (such as ideological data; data on political opinions; data on union membership; health data; data on sex life; or data on ethnic or racial origin). For any purpose other than providing the services, we require our affiliates, as well as third parties, to protect your personal data with appropriate security measures. These affiliates and/or third parties may not process or use your personal information except in accordance with this OTLC Privacy Notice and applicable law.

OTLC complies with the various obligations set forth in the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPP), its Regulations, the Privacy Notice Guidelines and other federal and local administrative provisions.

The data collected will be used for the purposes set out in this Privacy Notice. We may collect your personal data in different ways:

1. a) When you stay at any OTLC hotel and fill out the registration forms,
2. b) When you visit our Website,
3. c) When you request a quote from any area of the hotel,
4. d) When you use any service provided by and/or dependent on any OTLC hotel and, in general, whenever personal data are obtained through the means permitted by the Law.

The Data Subject shall at all times have the right to cancel their personal data by means of a written request sent to memberexperience@oasis-tlc.com. Such cancellation will give rise to a blocking period, after which the data will be deleted. OTLC may retain the data strictly necessary for the purposes of liabilities arising from the processing. The blocking period will be equivalent to the statute of limitations for actions arising from the legal relationship on which the processing is based, under the terms of the Law. Once the data have been cancelled, OTLC will notify the Data Subject.

In order to provide the Services, OTLC, through the Website or the Vacation Club, requests the following personal data from the Data Subject:

1. 1. First name(s) and last name(s)
2. 2. Mobile phone number
3. 3. Address
4. 4. Sex
5. 5. Nationality
6. 6. Email address
7. 7. Federal Taxpayer Registry (RFC)
8. 8. Official ID.
9. 9. Data owned by the Data Subject regarding their bank, bank account number(s) and credit and/or debit card details are collected exclusively in cases where such data are necessary to establish a contractual relationship between OTLC and the Data Subject, given their financial and patrimonial nature.

They are collected and stored in the Database.

OTLC may verify the personal data provided by consulting public entities, specialized companies or credit bureaus; this verification is expressly authorized by the Data Subject upon acceptance of this Privacy Notice. All information obtained through such verification will be treated by OTLC confidentially, in accordance with applicable legislation and this Privacy Notice.

If the Data Subject provides data of third parties, they represent that they have the consent of such third parties and undertake to convey to them, as owners of said data, the information contained in this Privacy Notice, releasing OTLC from any liability in this regard. Notwithstanding the foregoing, OTLC may carry out the necessary verifications to confirm this, adopting the corresponding due diligence measures in accordance with data protection regulations.

The Data Subject has the right to know what personal data we hold, what we use them for and the conditions of their use (Access). Likewise, they have the right to request the correction of their personal information if it is outdated, inaccurate or incomplete (Rectification); to have it deleted from our records or databases when they consider that it is not being used in accordance with the principles, duties and obligations set forth in the regulations (Cancellation); and to object to the use of their personal data for specific purposes (Opposition). These rights are known as ARCO rights.

1. I. Request. The Data Subject must submit their ARCO Rights Request either in person or digitally (exclusively via email at memberexperience@oasis-tlc.com). The request must include the following information:
   
   
   1. A. Name of the Data Subject.
   2. B. Documents proving the identity of the Data Subject (voter ID card, passport, military service card, professional license, driver’s license or immigration document).
   3. C. If applicable, the name of the Data Subject’s representative and documents proving their identity and authority.
      
      To prove the identity of the representative, when they are a natural person, any of the following three options may be chosen: 1) a simple power of attorney signed before two witnesses, attaching simple copies of their official IDs; 2) a public instrument (a document executed before a Notary Public); or 3) the Data Subject and their representative appearing in person before OTLC to make a declaration.
   4. D. Address or any other means to receive notifications.
   5. E. A clear and precise description of the personal data to be rectified, cancelled or whose processing is objected to.
   6. F. A description of the right to be exercised or of what the Data Subject is requesting.
   7. G. If applicable, documents or information that facilitate locating the personal data, including the area responsible for the processing.
   
   For more information on cases where the Data Subject is a minor or representation is required, OTLC will proceed in accordance with the Procedure for the Exercise of ARCO Rights in the Private Sector. To consult the support guide originally published by the former National Institute for Transparency, Access to Information and Personal Data Protection (INAI), please visit the following link: https://home.inai.org.mx/?page_id=3374. If you need further guidance, you may contact, through its official channels, the Personal Data Protection Unit of the Ministry of Anti-Corruption and Good Governance, the guarantor authority for personal data protection at the federal level.
   
   OTLC undertakes to receive ARCO rights requests at the following location: Blvd. Kukulcán KM 6.5 Lote 1, Zona Hotelera, Cancún, Quintana Roo, CP 77500.
   
   Please note that if the request does not include the information described above, the data controller may request the missing information by means of a REQUIREMENT, which must be issued within a maximum of 5 (five) business days from the day following the submission of the request. The Data Subject will have 10 (ten) business days after receiving such notice to provide the required information; otherwise, the request will be deemed not submitted.
   
   When you submit your request, OTLC must provide an ACKNOWLEDGMENT OF RECEIPT stating the date on which it was received.
   
   
2. II. Response. OTLC will inform the Data Subject or their representative of the determination adopted regarding the request, by email or in person at the address designated by OTLC for such purposes, within 20 (twenty) business days from the date on which the ARCO rights request was received.
   
   Once the required documents have been submitted, OTLC is obliged to inform the Data Subject or their representative, in order to count the business days within which the request will be carried out.
   
   
3. III. Resolution. When the request is admissible with respect to the authority and ownership of the ARCO Rights, and the Data Subject and/or their representative have been informed of this, the terms for carrying out the request will be as follows:
   
   
   1. A. For access to the data: within 15 (fifteen) days from OTLC’s affirmative response, the electronic documents fulfilling the request will be sent through the same channel used to submit it.
   2. B. For rectification of the data: within 15 (fifteen) days from OTLC’s affirmative response, the electronic documents evidencing the rectification will be sent through the same channel used to submit the request.
   3. C. For cancellation of or opposition to the data: the data will first be blocked from the moment the required documentation is verified, during which access to the personal data will be restricted to everyone until there is a response to the request, whether affirmative or negative. In the first case, within 15 (fifteen) days from OTLC’s affirmative response, and in the second case, the data will be unblocked to continue processing.

The terms referred to in the preceding paragraphs may be extended only once for an equal period if necessary and upon prior notice from OTLC.

If the Data Subject disagrees with OTLC’s response, does not receive a response within the legal term, or considers that any of their rights have been violated, they may file a data protection request with the Ministry of Anti-Corruption and Good Governance.

In accordance with Article 33 (thirty-three) of the Law, the exercise of ARCO rights will not be admissible and OTLC may deny them in the following cases:

1. I. When the applicant is not the owner of the personal data, or the legal representative is not duly accredited to act as such;
2. II. When the personal data are not in the possession of the data controller;
3. III. When the rights of a third party are harmed;
4. IV. When there is a legal impediment, or a resolution of a competent authority, that restricts access to the personal data or does not allow their rectification, cancellation or opposition; and
5. V. When the rectification, cancellation or opposition has already been carried out.

It also provides that the denial may be partial, in which case OTLC will carry out the access, rectification, cancellation or opposition requested by the Data Subject.

In all of the above cases, OTLC must state the reason for its decision and communicate it to the Data Subject or, where applicable, to the legal representative, within the terms established for such purpose, through the same means by which the request was made, attaching the relevant evidence, if any.

The exercise of "ARCO Rights" will be free of charge; however, if the provisions of Article 35 of the Law apply, that is, if the Data Subject repeats their request within a period of less than 12 (twelve) months, the cost will be 3 (three) times the Unit of Measurement and Update (UMA) in force at the time of the request plus Value Added Tax, unless there are substantial changes to the Privacy Notice that give rise to new ARCO Rights Requests.

All justified expenses resulting from shipping, reproduction in copies or formats will be borne by the Data Subject or their representative.

OTLC reserves the right to make changes or updates to this Privacy Notice at any time.

These changes will be made available to the public through the following means: (I) visible notices at the Vacation Club offices; (II) leaflets or brochures available at the Vacation Club; (III) on our website https://oasis-tlc.com/en; or (IV) we will send them to the last email address you provided to us.

For the purposes of this Privacy Notice, the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties in force, the Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties, the Privacy Notice Guidelines and other legal provisions applicable for the purposes of the Law and the competent authority shall apply.

If you have any questions about this Privacy Notice, about the processing of your personal data, or any concerns or complaints regarding the administration of this Privacy Notice, or if you wish to submit a written request regarding your personal data, you may contact us by email at memberexperience@oasis-tlc.com.

The Data Subject confirms that they have read and accepted the terms of the OTLC Privacy Notice, granting their consent for OTLC to share their information with its affiliates, which will use it as stipulated herein. OTLC offers various services, such as online reservations and information about rooms and events, for which the Data Subject must provide personal data such as name, phone number, email address and payment details. This information is essential to process reservations and ensure a personalized experience. OTLC undertakes to handle the data confidentially and to comply with the data protection regulations in force.

In addition, the Data Subject may choose to grant their consent to receive services, promotions, as well as marketing and phone calls other than those related to the reservation.

The Data Subject YES ☐ NO ☐ grants their consent for OTLC to share their personal information with its affiliates and/or contracted third parties, who may use such information to provide them with services, promotions, marketing, as well as sales and phone calls other than those related to the reservation.