INTEGRAL PRIVACY NOTICE

In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties and Regulations, as well as the Privacy Notice Guidelines and the General Data Protection Regulation of the European Union, we hereby inform you of the Privacy Notice.

HOTELERÍA SUSTENTABLE BACALAR, S.A. DE C.V., Vape Publicidad SC and JLM Servicios Profesionales Integrales S.A. de C.V. hold the ownership of the intellectual and industrial property rights of all images, videos, audios, videos, photographs, designs, downloadable documents available on their websites, brands, commercial image of Mía Reef Isla Mujeres Resort, commercial and/or advertising phrases. All Rights Reserved ©️ The content of the website, the elements and features that comprise it may not be used, reproduced, copied and/or transmitted in any form or by any means, electronic, printed or otherwise, without the written authorization of Hotelería Sustentable Bacalar SA de CV, Vape Publicidad SC, therefore failure to comply with the provisions will constitute liability in administrative, civil and criminal matters.

DATA OF THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

HOTELERÍA SUSTENTABLE BACALAR, S.A. DE C.V., Vape Publicidad SC and JLM Servicios Profesionales Integrales SA de CV hereinafter “MÍA BACALAR” with address at Carretera Federal Bacalar Xtomoc km 42, Bacalar, Quintana Roo, Mexico, will be responsible for the use, treatment and destination of your personal data.

Phone: MX +52 983 689 0005

E-mail: [email protected]

For the purposes of this Privacy Notice, the following terms shall be understood:

Privacy Notice: Refers to this document, which is made available to you, in your capacity as owner of personal data and prior to the processing of these, in accordance with article 15 of the Federal Law on the Protection of Personal Data Held by Private Parties.

Consent: Manifestation of the will of the owner of the personal data for the processing of the same.

Personal data: Any information concerning an identified or identifiable natural person.

Sensitive personal data: Personal data that affects the most intimate sphere of the OWNER, or whose improper use may give rise to discrimination or entail a serious risk for the OWNER. In particular, data that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions, sexual preference are considered sensitive.

ARCO Rights: Refers to the rights of access, cancellation, rectification and opposition that the OWNER has in relation to his/her personal data.

Law: Federal Law on the Protection of Personal Data Held by Private Parties and/or its Regulations.

Responsible: HOTELERÍA SUSTENTABLE BACALAR, S.A. DE C.V., Vape Publicidad S.C. and JLM Servicios Profesionales Integrales S.A. de C.V., as legal entities that will process the personal data; hereinafter MÍA BACALAR.

Owner: The natural person to whom the personal data correspond, hereinafter the OWNER.

Processing of personal data: Access, use, handling, storage of personal data, by any means.

This Privacy Notice is made available to the OWNER, in compliance with the provisions of the Law, as well as other applicable legal provisions.

Pursuant to the above, MÍA BACALAR , as the controller, is committed to observing the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility in the processing of personal data and the rights to privacy and informational self-determination.

The processing of personal data, being a fundamental right recognized in the provisions of the United Mexican States, the Charter of Fundamental Rights of the European Union, as well as in the European Regulation and the Council of the European Union, will apply to natural persons regardless of their nationality or place of residence. The above, with the understanding that MÍA BACALAR offers its services to people of different nationalities, including the European Union, for which reason the following is stated in this privacy notice:

DATA COLLECTED BY MÍA BACALAR

In order to comply with the applicable legal provisions, the personal data that will be collected and processed by MÍA BACALAR, which are necessary to provide the contracted services:

1. Identification data relating to your information concerning a natural person (name, date of birth, gender, nationality, Federal Taxpayer Registry, address and age).

2. In the event that our services are contracted by legal entities through their representative, the data of the company and its legal representative will be collected: corporate name or name, tax address, Federal Taxpayer Registry and identification of the legal representative.

3. Contact information (landline or mobile phone number and email).

4. Employment data, if applicable, related to information concerning your employment or position.

5. Tax information of the owner: Federal Taxpayer Registry, in order to issue the corresponding invoice. Also, naccount number; account type; bank card number; CLABE number; economic activity and tax regime in Federal Taxpayers Registry cards.

MÍA BACALAR will implement the necessary administrative, technical and physical security measures to protect your personal data from damage, loss, alteration, destruction or unauthorized use, access or processing, and we also require that the suppliers of the goods and/or services we contract comply with these measures. These measures will not be less than those that MÍA BACALAR maintains for the management of its own information.

MÍA BACALAR will not collect sensitive personal data.

By making this Privacy Notice available, the OWNER grants his/her consent to the processing of personal data.

PURPOSES OF PROCESSING PERSONAL DATA

The main purposes of the processing of the personal data of the OWNER by MÍA BACALAR are those stated below:

A) Main: In order to provide you with information about our services in a personalized manner, identify customers, provide contracted services, personalized attention and services, commercial contact, clarifications, suggestions, complaints, follow-up for the delivery of products or provision of services, as well as for compliance with applicable legislation.

Additionally, we will use your personal information for purposes that are not necessary to provide you with our services, but that allow us to facilitate and provide better service:

B) Additional: Sending information related to our advertising, promotions or offers regarding our products and/or services, preparation of studies and programs for marketing purposes, quality evaluations of the products and/or services we provide,consumer preference statistics.

If you do not wish for your personal data to be processed for additional purposes, you can inform us of this from now on,personally at the address of MÍA BACALAR, or contact uson the phone:MX +52 983 689 0005, or email [email protected], in order to indicate that you do not wish your data to be processed for additional purposes. The refusal to use your personal data for these purposes may not be a reason for us to deny you the services and products you request or contract with MÍA BACALAR.

For the purposes indicated in this Privacy Notice, we may collect your data:

1. Personally through physical and/or electronic forms.

2. By telephone.

3. Email.

4. Applications for mobile phones or computers.

5. And/Or through other optical, sound, visual, graphic means or by any legally permitted technology.

WITH WHOM DOES MÍA BACALAR SHARE YOUR PERSONAL DATA AND FOR WHAT PURPOSES?

MÍA BACALAR informs you that the personal data of the OWNER will be processed by MÍA BACALAR and/or its parent company, affiliates or subsidiaries. Likewise, the data collected may be shared with federal and local authorities, in compliance with the obligations contemplated in the applicable legislation and in compliance with their requirements.

By making this Privacy Notice available to you, you have given your consent to the processing of your personal data. Furthermore, in accordance with article 37 of the Federal Law on the Protection of Personal Data Held by Private Parties, MÍA BACALAR will transfer your data to comply with the legal relationship.

We inform you that for transfers indicated with an asterisk (*) we require your consent. If you do not state your refusal for such transfers, we will understand that you have given us your consent. If you do not accept the transfer of data, you must notify us by email: [email protected].

It is hereby made known thatMIA BACALARhas informed the third parties referred to above of their obligations regarding this Privacy Notice and its purposes, and therefore they assume the obligations established herein when transferring their personal data to it.

ARCO RIGHTS (ACCESS, RECTIFICATION, CANCELLATION OR OPPOSITION)

You, as the OWNER of your personal data, may exercise the rights of access, cancellation, rectification and opposition, with respect to your data (ARCO Rights). You have the right to know what personal data we will process, what we use it for and the conditions of use we give it (Access). Likewise, it is your right to request the correction of your personal information if it is outdated, inaccurate or incomplete (Rectification); that we delete it from our records or databases when you consider that it is not being used in accordance with the principles, duties and obligations provided for in the regulations (Cancellation); as well as to oppose the use of your personal data for specific purposes (Opposition). The exercise of these rights will be initiated through the submission of a written request addressed to MÍA BACALAR by email:[email protected]

The request must be submitted by the OWNER or his legal representative to the email address referred to, said request must contain:

1. The full name of the OWNER and address or other means to communicate the response, including email address.

2. Documents proving your identity or that of your legal representative.

3. A clear and precise description of the personal data regarding which you will exercise your rights.

4. Any other element that facilitates the location of the personal data of the OWNER.

MÍA BACALAR will notify the OWNER within a maximum of 20 (twenty) calendar days, counted from having received the request for access, rectification, cancellation or opposition, the decision adopted, so that it becomes effective within the following 15 (fifteen) calendar days. These periods may be extended for an equal period when, at the discretion of MÍA BACALAR, the circumstances of the case justify it.

Should you require further information, the controller will contact you. In the event of no response from the OWNER, the request will be deemed not to have been submitted.

TThe right of access applies when the OWNER wishes to know which of his/her personal data is held by MÍA BACALAR.

A request for access will be fulfilled by making available to the OWNER or his representative, after proving his identity, the documents containing the required personal data, either by means of photocopies, a CD containing said information, a USB device or any other means determined by MÍA BACALAR. The delivery of the data will be free of charge as long as the request for access is not repeated in a period of less than 12 months. The OWNER will only cover the costs of reproduction in copies or other formats and shipping.

The OWNER may rectify his/her personal data when these are inaccurate or incomplete, indicating in the rectification request the modifications that must be made and providing MÍA BACALAR with the documentation that supports his/her request. If the OWNERs request is admissible, MÍA BACALAR must inform the data processors and third parties of the changes in question, in the event that data transfers have been made under the terms of this Privacy Notice.

The right to cancellation consists of the elimination of personal data, followed by a blocking period that will be determined in accordance with the statute of limitations for actions arising from the applicable legal relationship. The cancellation of personal data will not be applicable in the cases provided for by law. MÍA BACALAR may retain the data exclusively for the purposes of liabilities arising from the processing of personal data. Once the data has been cancelled, its owner will be notified.

The OWNER shall have the right at any time and for legitimate reasons to object to the processing of his/her data. If the request is approved, MÍA BACALAR will not be able to process the OWNERs data.

MÍA BACALAR may deny access to personal data, or carry out rectification or cancellation or grant opposition when the applicant is not the OWNER or the legal representative is not duly accredited to do so, or where appropriate when the personal data of the OWNER are not found in its database, the rights of a third party are violated, there is a legal impediment or resolution from a competent authority that restricts access to personal data or does not allow its rectification, cancellation or opposition and when the rectification, cancellation or opposition has been previously carried out.

To learn about the procedure and requirements for exercising ARCO rights, you may call: MX +52 983 689 0005 or send an email to [email protected] , which will process requests to exercise these rights and answer any questions you may have regarding the processing of your information.

MODIFICATIONS TO THE PRIVACY NOTICE

MÍA BACALAR reserves the right to make changes or updates at any time as a result of legal provisions, internal policies, new requirements for the provision of services or products we offer; our privacy practices; changes in our business model, or for other reasons.

We undertake to keep you informed of any changes to this privacy notice at www.miahotelsandresorts.com and, if appropriate, by email.

For any questions or clarifications regarding this privacy notice, you may write a free letter in Spanish and send it by email: [email protected].

LIMITATION OF USE OR DISCLOSURE OF YOUR PERSONAL DATA

In order for you to limit the use and disclosure of your personal information, we offer you the following means:

1. Your registration in the Public Registry to avoid Advertising, which is managed by the Federal Consumer Protection Agency, with the purpose of ensuring that your personal data is not used to receive advertising or promotions from companies of goods or services. For more information about this registry, you can consult the PROFECO website, or contact it directly.

2. Your registration on the Exclusion List, so that your personal data is not processed for marketing, advertising or commercial prospecting purposes by us. For more information, send an email to the following address [email protected].

REVOCATION OF CONSENT FOR THE PROCESSING OF PERSONAL DATA

Consent for the processing of personal data may be revoked by means of a written request from the OWNER, addressed to the email address indicated in this Privacy Notice, in which the reasons for revoking consent must be included.

To learn about the procedure and requirements for revoking consent, you may call the telephone number MX +52 983 689 0005 visit our website https://www.miabacalar.com/aviso-de-privacidad or send an email to [email protected]

We also inform you that we will not be able to respond to your request or terminate the use immediately in all cases, since it is possible that due to some legal obligation we may be required to continue processing your personal data for certain purposes, the revocation of your consent implies that we cannot continue providing the service you requested, or the conclusion of your relationship with us.

By accessing this website, the OWNER or by purchasing our services and/or products from MÍA BACALAR, declares that he/she is aware of this Privacy Notice and, consequently, grants his/her knowledge and agreement with its content, and also expressly declares his/her acceptance for MÍA BACALAR to process his/her personal data in the terms indicated therein.

ARTIFICIAL INTELLIGENCE

MÍA BACALAR informs you that in certain cases it may use algorithms based on artificial intelligence to carry out certain activities to analyze consumer trends and preferences regarding the use of products and services, predict behavior and consumer trends regarding our Services, create profiles and analyze information for technical purposes and to improve our products and Services.