Privacy Notice

For the effects of this Privacy Notice, the following definitions shall apply:

• I.1. ARCO. Abbreviation of “Access, Rectification, Cancellation, and Objection”.
• I.2. Privacy Notice. The document herein, put disposition of the Titleholder.
• I.3. Data Base. Information gathered by OTLC.
• I.4. Blocking. The ID and personal data storage once the objective for which they where gathered is accomplished, in order to determine possible responsibilities related to your treatment, through their legal or contractual period. During said period, the personal information shall not be objected to treatment, and once such period is due, they will be deleted from the data base.
• I.5. Data. Any information regarding a natural identifiable individual that has been registered in the Data Base.
• I.6. Hotel. Any hotel accessed or booked through the Website and/or the Vacation Club.
• I.7. Law. Federal Law Of Protection Of Personal Data In The Possession Of Private Individuals.
• I.8. OTLC. Legal entity responsible for the treatment of the Titleholder’s personal information.
• I.9. Regulations. Regulations of the Federal Law Of Protection Of Personal Data In The Possession Of Private Individuals.
• I.10. Services. Services to be lent by OTLC, in a joint or individual manner, as requested by the Titleholder, with or without a current promotion, which are consistently displayed on the image gallery, for providing reservation information, carrying out online room reservations inside the hotel, preferably by the Titleholder, pre-reservation, hotel browser, rates browser.
• I.11. Website. OTLC official website found in the web through the Uniform Resource Locator (URL): https://oasis-tlc.com/en.
• I.12. Titleholder. Natural or legal entity, owner of the personal information.
• I.13. Treatment. The obtention, use, disclosure, or storage of personal information, through the OTLC official websites.

OTLC will process the personal data of the Titleholder, always ensuring the principles of legality, consent, information, quality, purpose, fairness, proportionality, and loyalty, as well as the duties of security and confidentiality provided by the Law.
As for the purposes of the processing of the Titleholder's personal data, they as mentioned below:

• 1.- The optimum rendering of the Services contracted in favor of or by the Titleholder.
• 2.- To contract, modify, or cancel the reservation and/or Services;
• 3.- The follow-up corresponding to the Service(s) hired through the Website or those that may be hired within the Hotel's facilities.
• 4.- To make the payment(s).
• 5.- To request an invoice or digital tax voucher.
• 6.- Customer Service.
• 7.- Sending promotional material, the personalization of the Titleholder's visits to the Website and official social media of OTLC, the use of content tailored to the interests of the Titleholder, and the participation in advertising based on the Titleholder's interests.
• 8.- Sending material for satisfaction surveys, marketing and/or quality assurance surveys.
• 9.- Sending instructions and/or answers regarding the participation of the Titleholder in sweepstakes, contests, and/or promotions, which shall be sent together with the terms and conditions that govern each one of them.
• 10.- Receiving advertising through electronic media, for online marketing purposes, or telemarketing about our services.
• 11.- Sharing your comments or suggestions about our services.
• 12.- Your personal information will be used for the purpose of carrying out assessments about demographics, interests, and behavior of our customers.
• 13.- Market research to offer you personalized services tailored to your needs.
• 14.- Internal statistics that indicate the services most appreciated by you.
• 15.- Affiliated companies and subsidiaries of OTLC, for internal administrative purposes only.
• 16.- OTLC may share, and you in turn authorize OTLC to share your personal information with third parties hired to assist OTLC in providing services to you or to carry out one or more of the purposes described above. These third parties are prohibited from using your personal information for any purpose other than to provide this service, and we obligate these third parties to protect your personal information, with appropriate security measures. These third parties are not able to process or use your personal information, except as stated in this OTLC Privacy Notice and in accordance with the applicable law.
• 17.- OTLC complies with the obligations set forth in the Federal Law on Protection of Personal Data Held by Private Parties (LFPDP), its related regulations, and other federal and local laws or administrative provisions.
  
  The data collected will have the purposes outlined in this Privacy Notice; we can collect your personal data in different ways:
  
  
  1. a) When you stay at any of the OTLC hotels and fill out the registration forms.
  2. b) When you visit our Website.
  3. c) When you request a quote from any area of the hotel.
  4. d) When you use any of the services provided by and/or dependent on any of the OTLC hotels, and in general when personal data is obtained through the means permitted by the Law.

Al all times, the Titleholders shall have the right to cancel their personal information by written request sent to the e-mail address memberexperience@oasis-tlc.com, such cancellation will give rise to a blocking period after which the data will be deleted. OTLC may keep the data necessary exclusively for the purposes of the responsibilities arising from the processing. The blocking period will be equivalent to the limitations period for actions arising from the legal relationship on which the processing is based, in accordance with the terms of the Law. Once the data has been cancelled, OTLC will notify the Titleholder.

In order to provide the Services, through the Website or the Vacation Club, OTLC may request personal information from the Titleholder; this data can refer to:

1. 1. Name(s) and Surname
2. 2. Mobile telephone number
3. 3. Address
4. 4. Sex
5. 5. Nationality
6. 6. Geolocation
7. 7. Email address
8. 8. Federal taxpayer number
9. 9. Official ID

These are collected and stored in the Data Base. Data owned by the Titleholder about the banking institution, bank account number(s), and credit and/or debit card data are collected exclusively in cases where such information is necessary for a contractual consolidation between OTLC and the Titleholder, as they are of a financial and patrimonial nature.

OTLC may verify the personal information provided by consulting public entities, specialized companies, or credit bureaus; verification expressly authorized by the Titleholder with the acceptance of this Privacy Notice; all information obtained through such investigation will be treated by OTLC confidentially, respecting the applicable legislation and this Privacy Notice.

In the event that the Titleholder provides third parties' information, he/she declares to have the consent of the same and undertakes to transfer to the interested party owner of such data, the information contained in this Privacy Notice, exempting OTLC from any liability in this regard. However, OTLC may carry out the necessary verifications to verify this fact, adopting the corresponding due diligence measures, in accordance with the data protection regulations.

By his/her own and personal right or through his/her legal representative, the Titleholder may request OTLC, in the exercise of his/her rights, the Access to the personal information that we possess and to the details of their treatment, in addition to Rectify them in case they are inaccurate or incomplete; Cancel them when they turn out to be excessive or unnecessary for the purposes that justified their collection, or Oppose to the treatment of these for specific purposes.

1. I. Request. The Titleholder shall submit his/her ARCO Rights Exercise Request, either in person or digitally (exclusively by e-mail to memberexperience@oasis-tlc.com. Such request must be accompanied by the following information:
   
   
   1. A. Name of the Titleholder of the personal information.
   2. B.Documents proving the Titleholder's identity (voting card, passport, military ID card, professional license, driver's license, and immigration document).
   3. C. If applicable, name of the Titleholder's representative and documents to prove his/her identity and personality.
      To prove the identity of the representative, in the event of a natural person, any of the following three options may be chosen: 1) the presentation of a simple power of attorney signed before two witnesses, attaching a simple copy of their official IDs; 2) by means of a public instrument (document signed by a Notary Public); or, 3) by the Titleholder and his/her representative testifying in appearance before OTLC.
   4. D. An address or any other means to receive notifications.
   5. E. A clear and accurate description of the personal information that wants to be rectified, cancelled, or opposed to its process.
   6. F. Description of the right to be exercised or what the Titleholder requests.
   7. G. If applicable, the documents or information that facilitate the location of the personal information, including the area responsible for the processing.
   
   To obtain more information for cases in which the Titleholder is a minor or is in a state of interdiction, it will be addressed as set forth in the "PROCESS TO EXERCISE MY DPDP IN THE PRIVATE SECTOR". Learn how to submit it by visiting https://home.inai.org.mx/?page_id=3374
   
   OTLC is obligated to receive the request of the ARCO rights exercise, at the following address: Blvd. Kukulcan KM 6.5 Lote 1, Zona Hotelera, Cancún, Quintana Roo, CP 77500.
   
   It is important to consider that, should the request does not contain the information described above, the responsible party may request the missing information by means of a REQUIREMENT, which must be issued within a maximum period of 5 (five) business days as of the day when the request was signed, and the Titleholder will have 10 (ten) business days, after receiving the notice, to provide the required information, otherwise the request will be considered as not submitted.
   
   When submitting your request, OTLC shall deliver an ACKNOWLEDGMENT stating the date of receipt of the request.
   
   
2. II. Response. OTLC will respond to the request by e-mail or in person at the address indicated by OTLC for such purposes, within 20 (twenty) business days, as of the date when the request acknowledgment of receipt is sent to the Titleholder or his/her representative.
   Once the required documents have been submitted, OTLC will have the obligation to inform the Titleholder or his/her representative, in order to count the working days in which the request will be carried out.
3. 
   III. Resolution. When the request is admissible, in regard to the personality and ownership of the ARCO Rights, and the Titleholder and/or his/her representative have been informed of this, the terms to carry out the requested shall be as follows:
   
   
   1. A. For data access: within a period of 15 (fifteen) days from the affirmative response made by OTLC, the electronic documents that guarantee your request will be sent by the same means you make your request.
   2. B. For the rectification of the information: within a period of 15 (fifteen) days from the affirmative response made by OTLC, the electronic documents that guarantee the rectification will be sent by the same means you used for your request.
   3. C. For the cancellation or opposition of the information: first a blocking of the information will be made, from the moment in which the matching of the required documentation was made; access to personal information will be restricted to any person until there is an answer to the request either affirmative or negative, in the first case within a period of 15 (fifteen) days from the affirmative response made by OTLC, and in the second case the unlocking of the data will be made to continue with the processing.
      
      The terms referred to in the preceding paragraphs may be extended only once for an equal period if deemed necessary and upon prior notice made by OTLC. In accordance with Article 34 (thirty-four) of the Law, OTLC may deny access to personal information, or to make the rectification or cancellation or grant opposition to the processing thereof, in the following cases:
      
      
      1. I. When the applicant is not the owner of the personal information, or the legal representative is not duly accredited to do so.
      2. II. When the applicant's personal information is not found in the database.
      3. III. When the rights of a third party are harmed.
      4. IV. When there is a legal impediment, or the resolution of a competent authority, which restricts access to the personal information, or when it does not allow the rectification, cancellation, or opposition of the same
      5. V. When the rectification, cancellation, or opposition has been previously made.

It also provides that the refusal may be partial in which case, OTLC will carry out the access, rectification, cancellation, or opposition required by the Titleholder.

In all the above cases, OTLC must inform the reason for its decision and communicate it to the Titleholder, or if applicable, to the legal representative, within the deadlines established for such purpose, through the same means by which the request was carried out, accompanying, where applicable, the evidence that may be relevant.

The exercise of the "ARCO Rights" will be free of charge, but in the event that what is stated in Article 35 of the Law takes place, that is to say, the Titleholder reiterates his/her request in a period of less than 12 (twelve) months, the cost will be the result of the sum of 3 (three) times the Unit of Measurement and Updating (UMA) in force at the time of the request and the Value Added Tax, unless there are substantial modifications to the Privacy Notice that motivate new Requests for the Exercise of the ARCO Rights.

All justified expenses resulting from shipping, reproduction in copies, or formats will be at the expense of the Titleholder or his/her representative.

OTLC reserves the right to modify or update this privacy notice at any time. These modifications will be available to the public through the following means: (I) visible announcements in the Vacation Club offices; (II) leaflets or brochures available in the Vacation Club; (III) in our website https://oasis-tlc.com/en, or (IV) we will send them to the last e-mail address you have provided us.

For the purposes of this Privacy Notice, it shall be governed first by the provisions herein and, supplementarily to the provisions of the Federal Law on Protection of Personal Data Held by Private Parties, the Regulations of the Federal Law on Protection of Personal Data Held by Private Parties, the Guidelines of the Privacy Notice published in the Official Gazette of the Federation, and other applicable legal regulations.

If you have any questions about this Privacy Notice, about the processing of your personal information, or you have any concerns or complaints regarding the administration of this Privacy Notice, or if you wish to submit a written request about your personal information, you may contact us by emailing memberexperience@oasis-tlc.com.

In this act, the Titleholder declares that he/she has fully read, understood, and accepted the terms set forth in this Privacy Notice available through the Website, which constitutes the free, unequivocal, and informed consent, including all changes established in the updates of the same, regarding the processing of the Personal Information.