A. Identity and address of Controller.
In accordance with the provisions of the Federal Law for the Protection of Personal Information Held by Third Parties (LFPD – Mexican acronym) and other applicable regulations, Hotelera Palace Resorts S. de R.L. de C.V. (hereinafter commonly referred to as "Le Blanc Spa Resorts®" or "Controller", whose domicile to hear and receive communications is: Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P. 77506, expressly states:

B. Personal information collected and processed.

For the purposes described in this Privacy Notice we collect the following types of personal information:

1- Identification.

2- Personal characteristics.

3- Income, financial and insurance information.

4- Geolocation Data.

5- Sensitive information (health and biometrics).

Le Blanc Spa Resorts® does not directly collect personal information on minors through its webpage, and minors must abstain from providing such information.

C. Processing of sensitive data. Health status and Biometric Data.

In specific cases, Le Blanc Spa Resorts® has a legal obligation to collect sensitive personal information related to your state of health.

Such personal sensitive information will be processed to comply with the purposes described in this Privacy Notice, and in particular for the performance of services offered by Controller whose nature requires Controller to adopt special measures to ensure the well-being and/or health of our guests.

When such sensitive personal information is required by Le Blanc Spa Resorts® the Data Subjects may refuse to supply it, in which case Le Blanc Spa Resorts® will reserve the right to provide or deny the specific service requested.

Le Blanc Spa Resorts® may also process sensitive personal information related to a person's state of health when such information is provided by the Data Subjects for the purpose of obtaining special assistance or services that are expressly required for their stay in our facilities.

Therefore, and only when it is strictly necessary, we will request your express consent in writing before processing such sensitive personal information, using a media that will provide adequate information on such processing.

On a voluntary basis, you may provide biometric data for identification purposes in our facilities and services.

In all cases, Le Blanc Spa Resorts® will inform you in advance if you may provide said biometric data, requesting your explicit and written consent in order to process them for the indicated purposes.

D. Purpose of processing.

a. Relevant and necessary purposes.

1- To provide express purchased services, in any of their modes, related to your stay in any of the Le Blanc Spa Resorts® facilities

2- Ensure the functionality and quality of services purchased through the use of identification and authentication technologies that guarantee personalized attention to your needs, safety of guests in all Le Blanc Spa Resorts® and, as the case may be, the purchase or confirmation of services provided by third parties to users and purchased before or during their stay.

3- Provide assistance, deliver information and help the user to purchase in-house or third-party services throughout their stay with Le Blanc Spa Resorts®.

4- To allow you access to our online services if you are eligible and choose such access.

5- Announce changes in our services.

6- Invoicing of delivered goods and services, as well as debt collection even judicially or through third parties.

7- Keeps statistics and historical records of our users.

b. Additional purposes.

1- Announcement of promotions and new products and/or services offered by Le Blanc Spa Resorts®.

2- Satisfaction surveys.

Furthermore, the information you provide on third parties for the stated purposes (for example: family information) should be provided only after you have been informed of such processing and of this Privacy Notice

E. Additional purposes. Refusal of processing.

[] I do not wish to receive promotions and new products and/or services provided by Le Blanc Spa Resorts®.

You may revoke your consent for the processing of your personal information in relation to the indicated additional purposes using the mechanisms provided in this Privacy Notice and by the applicable legislation.

F. Transfer of personal information.

Your personal information (including sensitive information) may be transferred to and shared by persons other than Controller. The receivers of such information (domestic and international) belong to the following categories:

1- Controlling company, subsidiaries or affiliates of Le Blanc Spa Resorts®; for the purpose of centralizing information, corporate distribution of advertising and/or viral promotions or collection of statistics, in order to evaluate, improve and design advertising campaigns.

2- Nonaffiliated third parties (service providers), solely so that they may assist Le Blanc Spa Resorts® in the performance of services related with service reservations and the purchase of additional services that are necessary or expressly required by the Data Subjects during their stay (complying with the legal relation existing between Controller and Data Subject and or executed or pending contracts and benefits of the Data Subject, by Controller or a third party).

3- Tourism trading partners (tour operators), to make clarifications related to reservations and the provision of Le Blanc Spa Resorts® services to guests

4- Persons subject to professional medical secrecy or an equivalent obligation, pursuant to the General Health Law and other applicable legislation; when the transfer of sensitive personal information related to your present or future state of health to any third party legally able to receive it, is indispensable for medical care, prevention, diagnostic, health assistance, medical treatment or the management of health services, in cases when the Data Subject is unable to grant their consent.

5- Collection agencies, for the recovery of unpaid loans through the courts or by settlement.

6- Business partners, to promote and/or sponsor products, services and special offers

G. Consent for the sharing of information.

Pursuant to article 37 of the LFPD, the sharing of personal information described in paragraphs 1 through 5 of the preceding section does not require your consent. The sharing of your personal information under paragraph 6 of the preceding section requires your consent.

[ ] I consent to have my personal information shared with the third parties identified as "Business Partners" for the stated purposes.

Acceptance of this Privacy Notice through electronic media which Le Blanc Spa Resorts® uses to collect personal data, especially through its webpage www.leblancsparesorts.com, means you agree to have your personal information shared with its "Business Partners".

You can notify Le Blanc Spa Resorts® at any time to withdraw your consent for the future sharing of your personal information

In all other cases, your personal information will not be shared with third parties without your consent, except the exceptions described in article 37 of the LFPD and in compliance with the conditions of article 17 of the LFPD Regulations.

H. Exercise of ARCO rights.

Under all legal circumstances you may exercise your rights to access, modify, cancel and oppose information (ARCO rights) using the legal procedures we have set up.

All such requests should be sent in writing to the address indicated in paragraph A of this Notice addressed to our Department of Personal Information, and comply with the applicable legal requirements

Information requests should contain the following:

I. Your name and address or other means of providing you with a response.

II. Valid identification documents or power of attorney, as the case may be.

III. A clear and precise description of the personal information on which you wish to exercise your ARCO Rights; and

IV. Any other element or document that could facilitate locating your personal information.

Controller will answer you with a decision within 20 business days counted from the date on which your request is received. If the request is admissible it will be put into effect within 15 business days following the date on which Controller advises you of the decision. In the event that the information you provide is incorrect or insufficient, or if you fail to send the necessary identity documents or power of attorney, Controller will ask that you correct such deficiencies within five business days after receiving your request and you will have 10 business days to comply, counted from the day after you receive such notice. The process will be terminated if you do not answer within the required time.

You can obtain the requested personal information in the form of plain copies or electronic documents in common formats (Word, PDF, etc.), by means of authorized restricted access to the databanks (access) containing your personal information or by any other legal means that guarantee and evidence the exercise of the requested right.

Alternatively, after fulfilling all the above-mentioned requirements, the Data Subjects may submit their request by e-mail to derechosarco@palaceresorts.com and indicating "ARCO Rights and/or Consent Revoked" in the Subject line. Response times will remain the same as those mentioned in the immediately preceding paragraph. The use of electronic media in the exercise of ARCO rights authorizes Controller to answer the request using the same media unless the petitioner specifically requests another format.

You will be responsible for maintaining your personal information in possession of Controller updated. Therefore, under all circumstances you are responsible for the truth, accuracy, validity and quality of the personal information you provide, and you hereby undertake to keep such information updated by informing Controller of any changes.

I. Revoking consent.

You may revoke your consent to have your personal information processed, without retroactive effect, in all cases in which said revocation does not make it impossible to fulfill any obligations arising from the legal relation in force between you and Controller.

The process for revoking consent will be the same as the one established in the immediately preceding section on how to exercise your ARCO rights.

J. Limitations on the disclosure of your personal information.

You may limit the use or disclosure of your personal information by sending our Personal Information Department a request to that effect. The requirements for personal identification and the procedure for answering your request remain the same as those indicated in the section on "Exercise of ARCO Rights".

Controller has the resources and procedures to ensure that some of your information is included in a Personal Exclusion List, on condition that you expressly request the inclusion of such information in said list. Controller will then issue to all registered Data Subjects a letter certifying their inclusion in said list.

K. Automatic personal information collection media.

Le Blanc Spa Resorts® uses cookies to facilitate navigation on the website www.leblancsparesorts.com. Cookies are a tool used by Web servers to save and recover information stored in your browser in order to save your personal preferences and provide a better browsing experience when you visit a website.

Cookies have an expiry date which may vary during any single session or visit to the website and will expire on a specific date counted from the time they become active. Most cookies used by www.leblancsparesorts.com are associated with a single anonymous user and their equipment, they do not provide information that can be used to obtain the name of a User, they cannot read information from your hard disk nor insert a virus in your texts.

We can also gather information using "web beacons", "pixel tags", "clear gifs" or similar means (generically called "web beacons") which allow us to collect nonpersonal or added information such as domain names, the site areas you visit, operating system you use, version of your system, browser version and the URL you last visited. This information is used to improve your experience on the site and analyze traffic patterns.

We may also use third party advertising on our sites. These advertisers may also use cookies and pixel tags to identify among other things, what advertisements you viewed and on what pages.

Le Blanc Spa Resorts® does not have control over the use of this technology by third parties and therefore we cannot be held liable for their actions and policies.

You may configure your browser to accept or reject cookies automatically or to receive a notification that will allow you to decide whether to accept or reject that cookie. Even when you configure your browser to reject all cookies or to expressly reject cookies from www.leblancsparesorts.com, you will be able to continue browsing the website but not all its features will be available. In any case, you can eliminate www.leblancsparesorts.com cookies at any time by following the procedure indicated in the Help section of your browser.

L. Modifications or updates of this General Privacy Notice.

Controller may modify, update, extend or in any other way change the content and scope of this General Privacy Notice at any time and at its complete discretion. In such cases Le Blanc Spa Resorts® will publish those changes on its www.leblancsparesorts.com website in the section "Privacy Notices".

Le Blanc Spa Resorts® may also announce changes to this Privacy Notice by e-mail when such a mode of correspondence has been agreed upon.

Updated
December 01st, 2021.