Privacy Notice

ARRENDADORA HOST SL, S.A. DE C.V.

This document constitutes the Privacy Notice for the purposes of the provisions of the Federal Law for the Protection of Personal Data Held by Private Parties (hereinafter, the "Law"), its Regulations, as well as the Privacy Notice Guidelines (hereinafter and together with the Law, the "Legislation"). Therefore, this Privacy Notice (hereinafter, the "Notice") applies to personal information collected about the Data Subject by Arrendadora Host SL, S.A. de C.V. (hereinafter "AHost"). For the purposes of this Notice, terms used in this document with initial capital letters that are not defined herein shall have the meaning attributed to them in the Legislation.

1.- Identity and Address of the Data Controller

AHost, a company duly incorporated under the laws of the United Mexican States, with registered address at Calle Pedregal, number 25, Floor 3, Suite 300, Colonia Molino del Rey, Miguel Hidalgo Borough, ZIP Code 11040, Mexico City, is responsible for the collection, use, storage, and disclosure of the Data Subjects’ Personal Data, in accordance with the provisions of this Notice, guaranteeing, in its capacity as Controller, the proper use, protection, and confidentiality thereof, while observing at all times the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and accountability set forth in the Legislation.

2.- Personal Data

In order to offer and provide you with the services and products you request or purchase from AHost related to lodging reservations, payments, cancellations, modifications, and bookings for excursions and food services through the platform hosted on our website https://www.selina.mx and/or https://www.niluhotels.mx/ (the “Website”), we will collect the following Personal Data from you: identification and contact data, including but not limited to: Unique Population Registry Code (CURP) and passport number.

Additionally, AHost may collect Sensitive Data such as gender and electronic data (IP address, browser type and version, information regarding the devices used to access the Website, connection data, information and settings related to search engines and applications downloaded on your device). The purpose of collecting and processing Sensitive Data is so that AHost may verify and validate your identity, prevent fraud, and assess the request you make for our Services (as such term is defined below) and/or issue a decision regarding such request, as well as comply with applicable legal provisions in other matters. Accordingly, in strict compliance with the provisions of the Legislation, you hereby expressly consent to the processing of Sensitive Data by AHost.

It is important to note that, except for the Sensitive Data listed above, the categories mentioned previously are categories of Personal Data. If you wish to know each specific Personal Data item collected, please contact AHost through the means indicated in this Notice. The Personal Data we may request from you and collect will be processed under the strictest physical, technical, and administrative security measures to guarantee their protection and confidentiality once your Consent has been obtained.

Personal Data may be collected through the Website or through any other electronic, telephone, video, or technological means (the “Electronic Means”), including Landing Pages, hyperlinks, specific subsections for certain products offered by AHost, or Plug-ins within the Website and, where applicable, through agents, promoters, brokers, suppliers, or business partners, including but not limited to when the Data Subject: (i) registers to use any of the services available on the Website, including Landing Pages, hyperlinks, or Plug-ins within the Website; (ii) uses the Website; (iii) sends questions, inquiries, or comments or contacts the Website; (iv) requests information or materials; and/or (v) provides information to the Website in any manner (such as chats, forums, uploads).

3.- Purposes

AHost will use your data for the following primary purposes:

1. To contact you in order to provide information about our lodging reservation services, modifications to such reservations, cancellations, reservation follow-up, and excursion bookings, as well as registration in membership programs (the “Services”);

2. To identify and validate the identity of the person requesting information regarding any of the Services and/or purchasing or acquiring any of them as part of fraud prevention and identity theft prevention measures;

3. To manage, operate, and monitor the Services and products you request or purchase from AHost and comply with your personal preferences;

4. To generate files for tracking customers and suppliers in our database, directly or through a third party;

5. To process, evaluate, and respond to requests you submit through the Website;

6. To verify the accuracy and truthfulness of your Personal Data in order to provide you with a customized version of our Services and commercial offerings according to your needs and preferences;

7. Inform about changes or new products or Services that are related to the contracted service;

8. To comply with legal obligations contained in the Legislation and/or any other applicable legal provisions, as well as obligations undertaken with our current or prospective customers, suppliers, and business partners;

9. To comply with obligations established in the General Law on Forced Disappearance of Persons, Disappearance Committed by Private Individuals, and the National Search System for Persons, as well as its regulatory and operational provisions, including the transmission of guest identification data (CURP and passport number, as applicable) to the Single Identity Platform (PUI) managed by the competent authorities responsible for person searches;

10. To evaluate the quality of our service;

11. To promote products, services, additional benefits, discounts, promotions, bonuses, contests, market studies, sweepstakes, and advertising in general;

12. To respond to inquiries, claims, or complaints submitted by Data Subjects regarding the products and Services provided;

13. To prepare studies for research and statistical purposes;

14. To work with third parties, including collecting publicly available information from social event websites, to help us better understand your interests and provide more personalized service.

Additionally, AHost will use your Personal Data for the following secondary purposes, which are not necessary for the provision of our Services but allow and facilitate providing you with better service and may be of interest to you and improve your experience as a current or potential user of AHost Services:

1. Sending newsletters, communications, and information for marketing, promotional, advertising, and/or commercial prospecting purposes.

2. Informing you about new products or services.

3. Carrying out business intelligence activities, conducting market research, increasing visibility of your activity on the Website, monitoring Website quality, evaluating and improving the Website, and sending our newsletter and offers. Sending and receiving communications through the Website related to our Services.

If you, as the Data Subject, do not wish for your Personal Data to be processed for the secondary purposes described above, you may object to such processing at any time by exercising your right to object in accordance with this Notice. For such purposes, you may submit a written request expressing the foregoing through the email address reservations@vonda.mx.

4.- Remissions and Transfers of Personal Data

AHost informs you that it may make Referrals (communication of data between AHost and third parties acting as Data Processors, which may or may not be subsidiaries or affiliates of AHost) regarding some or all of your Personal Data, within and outside the country, and that, pursuant to Article 53 of the Regulations of the Law and other applicable provisions of the Legislation, your consent will NOT be required.

Likewise, you are hereby informed that, for the proper provision of our Services, we may require the involvement of companies unrelated to AHost whose participation is necessary at some stage of the provision of the Services, including companies specializing in data analysis and user behavior identification, technical failure verification, customer support, cloud communications, information storage and data encryption, CRMs, and payment processors.

Additionally, in compliance with the General Law on Forced Disappearance of Persons, Disappearance Committed by Private Individuals, and the National Search System for Persons, AHost will be required to transfer guests’ CURP and/or passport numbers to the Single Identity Platform (PUI). Such transfer constitutes a legal obligation and therefore does not require the Data Subject’s consent pursuant to Section I of Article 37 of the Federal Law on the Protection of Personal Data Held by Private Parties.

It is important to note that the companies indicated above by way of example are recipients of your Personal Data solely under the figure of Data Processor, which, pursuant to Section XII of Article 2 of the Law, is defined as “the individual or legal entity that alone or jointly with others processes Personal Data on behalf of the Controller,” with Controller being understood as “the private individual or legal entity that decides on the processing of Personal Data.” In this regard, such third parties may only process your Personal Data in accordance with the instructions expressly provided by AHost (as Controller) and/or according to the legal relationship they maintain with AHost, and do not have the authority and/or decision-making power to independently determine the processing to which your Personal Data will be subject.

5.- ARCO Rights

You, as the Data Subject, are the owner of your Personal Data; therefore, at all times you shall have the right to:

Access your Personal Data that we hold and process;
Rectify your Personal Data if it is inaccurate or incomplete;
Cancel your Personal Data when you believe it is excessive or unnecessary for the purposes that justified its collection and processing, there has been improper use thereof by us, and/or the purposes that gave rise to its processing no longer exist, so that it is no longer retained in our files, records, archives, and systems; and/or
Object to the processing of your Personal Data for specific purposes or secondary purposes (provided there is a legitimate reason for doing so and the processing is not strictly necessary to fulfill obligations arising from the legal relationship established between you and us) and/or when your data is subject to automated processing that produces unwanted legal effects or significantly affects your interests, rights, or freedoms.

These rights regarding your Personal Data, referred to in the Legislation as ARCO rights, may be exercised at any time through the following free means:

By sending an email to reservations@vonda.mx; and/or
By written request with acknowledgment of receipt to our address located at Calle Pedregal, number 25, Floor 3, Suite 300, Colonia Molino del Rey, Miguel Hidalgo Borough, ZIP Code 11040, Mexico City.

Your request to exercise your ARCO rights must contain:

The Data Subject’s full name, address, or another means to communicate the response to your request;
Documents proving your identity or, where applicable, the legal representation of the Data Subject (voter ID or passport);
A clear and precise description of the Personal Data regarding which you seek to exercise any of the ARCO rights; and
Any other element or document that facilitates locating the Personal Data.

In the case of requests for rectification of Personal Data, the Data Subject must additionally indicate the modifications to be made and provide the documentation supporting the request.

Once the request containing all the above requirements is received, AHost shall have a maximum period of 20 (twenty) business days to notify the Data Subject of the adopted decision so that, if appropriate, such decision may be implemented within 15 (fifteen) days following the date on which the response is communicated. The periods referred to above may be extended once for an equal period whenever justified by the circumstances of the case, in accordance with the provisions of the Legislation.

The periods indicated above for the submission, processing, and response to ARCO rights requests shall begin to run on the same day we receive your request, provided it is within our business hours, which are from 9:00 a.m. to 6:00 p.m., Monday through Friday (excluding official holidays).

If the information provided in the request is insufficient or incorrect, or if the necessary documents are not attached, AHost may, within 5 (five) business days following receipt, request that the Data Subject provide the necessary elements or documents to process the request. The latter shall have 10 (ten) business days to comply with the request, counted from the day following receipt thereof. Failure to respond within such period shall result in the corresponding request being deemed not submitted, without liability for AHost; however, the Data Subject may resubmit the request at any time. AHost’s response shall be provided through the means indicated in your respective request.

6.- Revocation

The Data Subject may revoke the consent granted to AHost for the processing of Personal Data at any time, without retroactive effects, in those cases where such revocation does not imply the impossibility of fulfilling obligations arising from an existing legal relationship between the Data Subject and AHost. The Data Subject understands that, for certain purposes, if revocation of consent is appropriate, this could imply that AHost may no longer continue providing the service for which it was contracted or, alternatively, the termination of the existing relationship between the parties. The procedure for revoking consent, where applicable, shall be the same as that established in the previous section for exercising ARCO rights.

7.- Security Measures and Limitation on the Use or Disclosure of Personal Data

AHost has implemented strict physical, technical, and administrative security measures for the proper protection of your Personal Data, in order to preserve its confidential nature and prevent unauthorized access, use, or processing thereof, as well as possible damage, loss, or alteration at any stage of the provision of our Services.

AHost shall use your Personal Data in strict accordance with the purposes set forth in this Notice and for as long as necessary in accordance with applicable legal provisions.

Likewise, AHost makes available to you the following email address reservations@vonda.mx so that the Data Subject may at any time express refusal to continue receiving communications or promotions from us from the account through which such communications or promotions are received, as well as request inclusion in our exclusion list, the purpose of which is to record your refusal to allow the processing of your Personal Data for marketing and advertising purposes. The Data Subject may also exercise the right to limit the use or disclosure of Personal Data, for example, for marketing and/or advertising purposes, by following the same procedure established for ARCO rights.

8.- Cookies and Other Technologies

The Website uses cookies, which are data files stored on the hard drive of a user’s computer or electronic communications device when browsing a specific website, allowing the exchange of status information between the website and the user’s browser. Status information may reveal session identifiers, authentication data, or user preferences, as well as any data stored by the browser regarding the website. If you wish to learn the procedure for disabling cookies, please consult the “Help” section of your internet browser.

Through cookies, AHost measures information regarding users visiting the Website, collects data regarding operating systems, time, browser, and means used to access the Website. Likewise, AHost collects average browsing time and statistics regarding the most visited sections. AHost obtains the aforementioned data in order to understand Data Subjects’ behavior and profile and tailor marketing campaigns.

If you do not wish this, you may configure your browser to accept, manage, or reject all or some cookies, as well as delete downloaded or installed cookies from your device. However, some technical and functional features may not operate or display properly and, therefore, your browsing experience on the Website may be less satisfactory.

The Website may contain links to and from websites other than our own. AHost is not responsible for the privacy practices or the processing of Personal Data by such websites. AHost recommends that you review the privacy practices of such websites before using them.

9.- Changes to the Privacy Notice

This Notice may be modified or updated due to regulatory changes; our own needs regarding the products or Services we offer; privacy practices; changes in our business model; or other causes. Changes and updates to this Notice will be made available to you through our Website or any communication means available with the Data Subject, notifying changes and/or updates to this Notice. Once the changes to the Notice are published, they shall become effective on the day following publication through the aforementioned means. The Data Subject shall have 5 (five) days from publication on the Website to express disagreement with the modifications, in which case AHost may cease providing the Services. Once this period expires without objection from the Data Subject, it shall be understood that the Data Subject accepts the modifications to the Notice.

Likewise, you may contact us at any time through the means indicated herein to address any questions, clarifications, or suggestions regarding your Personal Data.

10.- Right to Information of Data Subjects and Competent Regulatory Authority

If you believe that your right to the protection of your Personal Data has been violated by any conduct of our employees or by our actions or responses, you may contact us through the means indicated herein, without prejudice to your right to contact the Ministry of Anti-Corruption and Good Government (SABG), which is the guarantor authority in Mexico for the right to the protection of Personal Data held by private parties.

11.- Consent

By using the Electronic Means and/or requesting or purchasing our Services, and by providing us with your Personal Data through any means, you, in your capacity as Data Subject, expressly acknowledge and accept this Notice. Such consent grants us the authority to process your Personal Data in the manner indicated herein and in strict compliance with the Legislation, without prejudice to the rights conferred upon you by the Legislation.

Likewise, as the Data Subject of the Personal Data, you declare that you have read this Notice, that you are aware of the categories of Personal Data collected (including categories related to financial and asset data, and any other category or Personal Data requiring your express consent), as well as the purposes for which such data will be processed; and that you freely consent to the processing of your Personal Data under the terms described herein.

This Privacy Notice is also available to you at https://www.niluhotels.mx/blank-3

Date of last update: June 2026