Privacy Notice

ARRENDADORA HOST SL, S.A. DE C.V.

This document constitutes the Privacy Notice for the purposes of the provisions of the Federal Law for the Protection of Personal Data Held by Private Parties (hereinafter, the "Law"), its Regulations, as well as the Privacy Notice Guidelines (hereinafter and together with the Law, the "Legislation"). Therefore, this Privacy Notice (hereinafter, the "Notice") applies to personal information collected about the Data Subject by Arrendadora Host SL, S.A. de C.V. (hereinafter "AHost"). For the purposes of this Notice, terms used in this document with initial capital letters that are not defined herein shall have the meaning attributed to them in the Legislation.

1.- Identity and Address of the Data Controller

AHost, a company incorporated in accordance with the laws of the United Mexican States, with address at Calle Pedregal, number 24, Floor 3, Interior 300, Colonia Molino del Rey, Miguel Hidalgo, Postal Code 11040, in Mexico City, is responsible for obtaining, using, storing and disclosing the Personal Data of Data Subjects, in accordance with the provisions of this Notice, guaranteeing in its capacity as Data Controller the proper use, protection and confidentiality thereof, observing at all times the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality and responsibility, provided for in the Legislation.

2.- Personal Data

To offer and provide you with the services and products you request or contract with AHostrelated to accommodation reservations, payments, cancellations, modifications and excursion reservations and food through the platform hosted on our website https://www.niluhotels.mx (the "Site"), we will collect the following Personal Data from you: identification and contact data.

Additionally, AHost may collect Sensitive Data such as gender, electronic data (IP address, type and version of your browser, information about devices accessing the Site, connection data, information and parameters regarding search engines and applications you have downloaded). The purpose of collecting and processing Sensitive Data is so that AHost can verify and validate your identity, prevent fraud and evaluate the contracting request you make for our Services (as defined below) and/or issue a decision regarding such request, and to comply with applicable legal provisions in other matters. In this regard, in strict compliance with the provisions of the Legislation, you hereby expressly consent to the processing of Sensitive Data by AHost.

It is important to mention that, with the exception of the Sensitive Data listed above, the previously mentioned categories are categories of Personal Data. In case you require to know each of the Personal Data that is collected, please contact AHost through the means indicated in this Notice. The Personal Data that we may request from you and that is collected will be processed under the strictest physical, technical and administrative security measures that guarantee its protection and confidentiality, once your Consent is obtained.

Personal Data may be collected through the Site, or by any other electronic, telephone, video, or other technology means (the "Electronic Means"), including Landing Pages, hyperlinks, specific subsections for certain products offered by AHost or Plug-ins within the Site and, where applicable, through agents, promoters, commissioners, suppliers or commercial partners, including without limitation when the Data Subject: (i) registers to use any of the services available on the Site, including Landing Pages, hyperlinks or Plug-ins within the Site; (ii) uses the Site; (iii) sends questions, inquiries or comments or contacts the Site; (iv) requests information or materials; and/or (v) provides information to the Site in any way (such as chats, forums, uploads).

3.- Purposes

AHost will use your data for the following primary purposes:

1. Contact you to provide information about our accommodation reservation services, modifications to such reservations, cancellations, reservation follow-up and excursion reservations, registration in membership programs (the "Services");

2. Identify and validate the identity of the person requesting information regarding any of the Services and/or contracting or acquiring any of them as fraud prevention and identity theft actions;

3. Administer, operate and monitor the Services and products you request or contract with AHost and comply with your personal preferences;

4. Generate files for monitoring clients and suppliers in our database, directly or through a third party;

5. Process, evaluate and respond to requests you make through the Site;

6. Verify the accuracy and veracity of your Personal Data to offer an individualized version of our Services and commercial offer according to your needs and preferences;

7. Inform about changes or new products or Services that are related to the contracted service;

8. Comply with regulatory obligations contained in the Legislation and/or any other applicable legal system, as well as those obligations contracted with our current or potential clients, as well as with our suppliers and commercial partners;

9. Evaluate the quality of our service;

10. The promotion of products, services, additional benefits, discounts, promotions, bonuses, contests, market studies, raffles and advertising in general;

11. Respond to inquiries, claims or complaints raised by Data Subjects about the products and Services provided;

12. Prepare studies for research and statistical purposes;

13. Work with third parties, including collecting information from public use of social event websites, to help us better understand your interests and provide more personalized service;

Additionally, AHost will use your Personal Data for the following secondary purposes, which are not necessary for the provision of our Services, but which allow and facilitate us to provide you with better service and which could be of interest to you and improve your experience as a user (current or potential) of AHost Services:

1. Sending informative newsletters, communications, and general information for marketing, promotion, advertising and/or commercial prospecting purposes.

2. Inform about new products or services.

3. Carry out commercial intelligence, conduct market research, give visibility to your activity on the Site, Site quality monitoring, Site evaluation and improvement and send our newsletter and offers. Send and receive communications through the Site in relation to our Services.

If you, as Data Subject, do not wish your Personal Data to be processed for secondary purposes, you may, at any time, object to processing for such purposes by exercising your right of opposition in accordance with this Notice. For these purposes, you may submit a written document from this moment, stating the above through the email contacto@vonda.mx.

4.- Remissions and Transfers of Personal Data

AHost informs you that it may make Remissions (communication of data between AHostand third parties acting as Data Processors, who may be subsidiary or affiliate companies of AHost or not) regarding some or all of your Personal Data, within and outside the country and that, under the terms of article 53 of the Law Regulations and other applicable Legislation, your consent will NOT be required.

Likewise, you are informed that for the correct provision of our Services we may require the intervention of companies outside AHost, whose intervention is necessary in some phase of service provision, including data analysis and user behavior identification companies, technical failure verification, customer service, cloud communications, information storage and data encryption, CRMs and payment processors.

It is important to mention that the companies indicated above as examples are recipients of your Personal Data solely under the figure of Data Processor, which, according to fraction XII of article 2 of the Law, is defined as "the natural or legal person who alone or jointly with others processes Personal Data on behalf of the Data Controller", understanding as Data Controller "the private natural or legal person who decides on the processing of personal data". In this regard, such third parties may only process your Personal Data in accordance with the instructions that AHost (as Data Controller) provides them expressly and/or according to the legal relationship they have with AHost, but they do not have faculties and/or decision-making power to determine autonomously and independently the processing to which your Personal Data will be subjected.

5.- ARCO Rights

You, as Data Subject, are the owner of your Personal Data, therefore, at all times you will have the right to:

Access your Personal Data that we possess and process;
Rectify them in case they are inaccurate or incomplete;
Cancel them, when you consider that they are excessive or unnecessary for the purposes that justified their obtaining and processing, there is improper use of them by us, and/or the purposes that gave rise to their processing have ceased to exist, so that they no longer remain in our files, records, files and systems; and/or;
Object to their processing for specific purposes or secondary purposes (provided there is legitimate cause for such purposes and that the processing is not strictly necessary for compliance with any obligation derived from the legal relationship created between you and us) and/or that your data be subject to automated processing that produces unwanted legal effects or significantly affects your interests, rights or freedoms.

These rights over your Personal Data referred to in the Legislation as ARCO rights, you may exercise them at any time through the following free means:

Sending an email to the electronic address contacto@vonda.mx; and/or
In writing in format with acknowledgment of receipt, at our address located at Calle Pedregal, number 25, Floor 3, Interior 300, Colonia Molino del Rey, Miguel Hidalgo, Postal Code 11040, in Mexico City.

Your request to exercise your ARCO rights must contain:

Full name of the Data Subject, address or other means to communicate the response to your request;
Documents that prove your identity or, where applicable, the legal representation of the Data Subject (voter ID or passport);
Clear and precise description of the Personal Data regarding which you seek to exercise any of the ARCO rights; and
Any other element or document that facilitates the location of Personal Data. In the case of requests for rectification of Personal Data, the Data Subject must also indicate the modifications to be made and provide documentation supporting their request.

Once the request is received with all the above requirements, AHost will have a maximum period of 20 (twenty) business days to notify the Data Subject of the determination adopted, so that, if appropriate, it becomes effective within 15 (fifteen) days following the date on which the response is communicated. The aforementioned periods may be extended only once for an equal period, provided that the circumstances of the case justify it, in accordance with the provisions of the Legislation.

The periods indicated above for the presentation, attention and response to requests for exercising your ARCO rights will begin to be computed on the same day that we have received your request, provided that it is within our business hours, which are from 9:00 AM to 6:00 PM Monday through Friday (excluding official holidays).

In case the information provided in the request is insufficient or erroneous, or the necessary documents are not attached, AHost may, within 5 (five) business days following its receipt, require the Data Subject to provide the elements or documents necessary to process it, with the latter having a period of 10 (ten) business days to attend to the requirement, which will begin to run from the day following receipt of the requirement; failure to respond within said period will result in the corresponding request being considered as not presented, without responsibility for AHost, however, the Data Subject may resubmit the request at any time. AHost's response will be given through the means you indicate in the respective request.

6.- Revocation

The Data Subject may revoke the consent granted to AHost for the processing of their Personal Data at any time, without retroactive effects, in those cases where such revocation does not imply the impossibility of fulfilling obligations derived from a current legal relationship between the Data Subject and AHost. The Data Subject acknowledges that, for certain purposes, if the revocation of their consent is appropriate, this could imply that AHost cannot continue providing the service for which it was contracted or, alternatively, the conclusion of the existing relationship between the parties. The procedure for revoking consent, where applicable, will be the same as established in the previous section for exercising ARCO rights.

7.- Medidas de Seguridad y Limitación del uso o divulgación de los Datos Personales

AHost has implemented strict physical, technical and administrative security measures for the proper protection of your Personal Data, so that they maintain their confidential nature and prevent unauthorized access, use or processing thereof, as well as possible damage, loss or alteration at any phase of providing our Services.

AHost will use your Personal Data in strict adherence to the purposes provided in this Notice and for the time necessary in accordance with applicable legal provisions.

Likewise, AHost makes available the following email address contacto@vonda.mx. so that the Data Subject can express at any time their refusal to continue receiving communications or promotions from us from the account where they receive such communications or promotions, as well as join our exclusion list, which aims to register their refusal to process their Personal Data for marketing and advertising purposes. The Data Subject may also exercise their right to limit the use or disclosure of their Personal Data, for example, for marketing and/or advertising purposes, following the same procedure as with ARCO rights.

8.- Cookies and Other Technologies

El Sitio utiliza cookies, que son archivos de datos que se almacenan en el disco duro del equipo de cómputo o del dispositivo de comunicaciones electrónicas de un usuario al navegar en un sitio de internet específico, el cual permite intercambiar información de estado entre dicho sitio y el navegador del usuario. La información de estado puede revelar medios de identificación de sesión, autenticación o preferencias del usuario, así como cualquier dato almacenado por el navegador respecto al sitio de internet. Si usted desea conocer el procedimiento para deshabilitar las cookies, por favor consulte la sección de “Ayuda” de su navegador de Internet.

A través de las cookies, AHost mide la información sobre los usuarios que visitan el Sitio, recaba datos sobre el sistema operativo, horario, el navegador y el medio con los que se ingresan al Sitio. De igual forma, AHost recaba el promedio de tiempo de navegación y las estadísticas de las secciones más consultadas. AHost obtiene los datos antes referidos con la finalidad de conocer el comportamiento de los Titulares, perfilar y adecuar campañas de marketing.

Si usted no lo desea, puede configurar su navegador para aceptar, gestionar o rechazar todas o algunas cookies, así como eliminar las descargadas o instaladas en su dispositivo. Sin embargo, es posible que algunas de sus características técnicas y funcionales no se presten o muestren adecuadamente y, por tanto, su experiencia de navegación dentro del Sitio podrá ser menos satisfactoria.

El Sitio puede contener links hacia y provenientes de otros sitios de Internet distintos al nuestro. AHost no es responsable por las prácticas de privacidad ni el tratamiento de los Datos Personales de esos sitios. AHost recomienda que usted consulte las prácticas de privacidad de dichos sitios de Internet antes de su utilización.

9.- Modifications of the Privacy Notice

This Notice may undergo modifications or updates derived from regulatory changes; our own needs for the products or Services we offer; privacy practices; changes in our business model, or other causes. Changes and updates to this Notice will be made known to you on our Site or by any means of communication we have with the Data Subject, notifying the changes and/or updates to this Notice. Once the change(s) to the Notice are published, they will enter into force the day following their publication, in the media referred to above. The Data Subject will have 5 (five) days from publication on the Site to express if they do not agree with the modifications, in which case, AHost may cease providing the Services. After this period expires without disagreement from the Data Subject, it will be considered that they accept the modifications to the Notice.

Likewise, you may contact us at any time through the indicated means to address any type of doubt, clarification or suggestion regarding your Personal Data.

10.- Right to Information of Data Subjects and Competent Regulatory Authority

If you consider that your right to protection of your Personal Data has been violated by any conduct of our employees or our actions or responses, you may contact us through the indicated means, without prejudice to the right to go before the Secretariat of Anti-corruption and Good Government (SABG), which is the guarantor authority in Mexico for the right to protection of Personal Data held by private parties.

11.- Consent

By using the Electronic Means and/or requesting or contracting our Services, and by providing us, by any means, your Personal Data, you, in your capacity as Data Subject, expressly recognize and accept this Notice, therefore such consent grants us the faculty to proceed with the processing of your Personal Data in the manner indicated in this Notice and in strict adherence to the Legislation, without prejudice to the rights conferred upon you by the Legislation.

Likewise, as Data Subject of Personal Data, you state that you have read this Notice, that you know the categories of Personal Data collected (including categories related to financial and patrimonial data, and any other category or Personal Data that requires your express consent), as well as the purposes for which they will be processed; and that you freely consent to the processing of your Personal Data under the terms described.

Date of last update: June 2025