GENERAL PRIVACY NOTICE
A. Identity and address of Controller.
IIn accordance with the provisions of the Federal Law for the Protection of Personal Information Held by Third Parties (LFPD – Mexican acronym) and other applicable regulations, Hotelera Palace Resorts, SAPI de C.V. (hereinafter commonly referred to as "Grupo Palace Resorts" or "Controller", whose domicile to hear and receive communications is: Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P. 77506, expressly states:
B. Personal information collected and processed.
For the purposes described in this Privacy Notice we collect the following types of personal information:
2) Social environment
3) Sensitive personal information (health).
C. Processing of sensitive personal information. Health information.
Grupo Palace Resorts® does not collect sensitive personal information for the purposes described in the following section.
Therefore we require your express written consent to process such information.
[ ] I agree to have Controller process my sensitive personal information for the purposes described in this Privacy Notice.
D. Purpose of processing.
a. Relevant and necessary purposes.
Provide the expressly agreed services in any of their modes as user of the aquatic services managed and/or administered by Grupo Palace Resorts®.
Ensure the safety, functionality and quality of purchased services.
Evaluate the possibility and suitability of using aquatic services based on information provided by their users.
Announce changes in our service policies.
Invoicing and legal or third-party collection.
Announcing promotions and new aquatic services provided by Grupo Palace Resorts®.
Keeping of statistical and historical records of aquatic service users.
b. Additional purposes.
Conducting satisfaction surveys.
In addition to the above, we advise you that the personal information on third parties that you provide to Grupo Palace Resorts® for the purposes stated in any media (for example, information on family members), may be used only after you are informed of the content of this Privacy Notice and that such information will be processed.
E. Additional purposes. Refusal of processing.
[ ] I do not wish to participate in satisfaction surveys.
You may revoke your consent for the treatment of personal information for the additional purposes indicated earlier by using the mechanisms set up in this Privacy Notice and in accordance with applicable legislation.
F. Sharing of personal information.
Your personal information (including sensitive information) may be transferred to and processed by parties other than Controller. The receivers of such transferred information (domestic or international) belong to the following categories:
Controlling companies, subsidiaries or affiliates of Grupo Palace Resorts®, for centralized storage of information, control of registrations and cancellations, changes in service reservations; as well as for the collection of statistics on users of Controller, for the purpose of evaluating, improving and designing new services for users.
Nonaffiliated Third Parties (service providers), for the one and only purpose of having them assist Palace Elite Resorts® to perform the services related to reservations and purchasing of additional necessary or requested services by the User during their stay (performance of the legal relation between Controller and user/contracts executed or to be executed in benefit of the user, by Controller and a third-party).
Insurance, for compliance with existing regulations related to liability insurance that must be maintained by tourist service and lodging providers for the protection and safety of tourists or users and, as the case may be, for the transfer of information required by the insurance company hired and designated by the users themselves.
Persons subject to professional medical secrecy or equivalent obligation, in cases when the sharing of your sensitive personal information related to your present or future state of health with any legally entitled third party is indispensable for medical attention, prevention, diagnostic, health services, medical treatments or management of health services, when you are not able to grant your consent, under the terms set by the General Health Law and other applicable legislation.
Collection agencies, for the recovery of unpaid loans through the courts or private settlement.
G. Consent for the sharing of information.
Pursuant to the provisions of article 37 of the LFPD, the sharing of personal information described in numbers 1 through 5 of the immediately preceding section, does not require your consent pursuant to the provisions of article 37 of the LFPD.
Your personal information will not be shared with third parties without your consent except under the circumstances described in Article 37 of the LFPD, and in all cases such sharing will be performed in strict compliance with Article 17 of the LFPD Regulations.
H. Exercise of ARCO rights.
Under all legal circumstances you may exercise your rights to access, modify, cancel and oppose information (ARCO rights) using the legal procedures we have set up.
All such requests should be sent in writing to the address indicated in paragraph A of this Notice addressed to our Controller of Personal Information, and comply with the applicable legal requirements.
Information requests should contain the following:
I. Your name and address or other means of providing you with a response.
II. Valid identification documents or power of attorney, as the case may be.
III. A clear and precise description of the personal information on which you wish to exercise your ARCO Rights; and
IV. Any other element or document that could facilitate locating your personal information. Controller will answer you with a decision within 20 business days counted from the date on which your request is received. If the request is admissible it will be put into effect within 15 business days following the date on which Controller advises you of the decision. In the event that the information you provide is incorrect or insufficient, or if you fail to send the necessary identity documents or power of attorney, Controller will ask that you correct such deficiencies within five business days after receiving your request and you will have 10 business days to comply, counted from the day after you receive such notice. The process will be terminated if you do not answer within the required time.
You can request personal information in the form of plain copies or electronicdocuments in common formats (Word, PDF, etc.), by means of authorized restricted access to the databanks (access) containing your personal information or by any other legal means that guarantee and evidence the exercise of the requested right.
Alternatively, after fulfilling all the above-mentioned requirements, the Owner may submit their request by e-mail to and indicating "ARCO Rights and/or Consent Revoked" in the Subject line. Response times will remain the same as those mentioned in the immediately preceding paragraph. The use of electronic media in the exercise of ARCO rights authorizes Controller to answer the request using the same media unless the petitioner specifically requests another format.
You will be responsible for maintaining your personal information in possession of Controller updated. Therefore, under all circumstances you are responsible for the truth, accuracy, validity and quality of the personal information you provide, and you hereby undertake to keep such information updated by informing the Controller of any changes.
I. Revoking consent.
You may revoke your consent to have your personal information processed, without retroactive effect, in all cases in which said revocation does not make it impossible to fulfill any obligations arising from the legal relation in force between you and Controller.
The process for revoking consent will be the same as the one established in the immediately preceding section on how to exercise your ARCO rights.
J. Limitations on the disclosure of your personal information.
You may limit the use or disclosure of your personal information by sending our Personal Information Department a request to that effect. The requirements for personal identification and the procedure for answering your request remain the same as those indicated in the section on "Exercise of ARCO Rights".
Controller has the resources and procedures to ensure that some of your information is included in a Personal Exclusion List, on condition that you expressly request the inclusion of such information in said list. Controller will then issue to all registered owners [of said information] a letter certifying their inclusion in said list.
K. Modifications and update of this General Privacy Notice.
Controller may modify, update, extend or in any other way change the content and scope of this General Privacy Notice at any time and at their complete discretion. In such cases, Grupo Palace Resorts® will publish any changes on the website www.aquasafari.com.
Changes may also be announced by e-mail while the legal relations continues, when such form of communication has been agreed upon between you and Controller.
December 1, 2016