Processing your data as a brand user.

1. Who is the data controller?

LUXURY SUSTAINABLE HOTELS AC, a legal entity registered in Playa del Carmen, Mexico, is the company responsible for managing the Regenera Luxury brand. You can contact the Regenera Luxury Data Protection Officer at [email protected].

2. For what purposes do we process your data?

We process your data for managing and improving quality and processes throughout the Group, commercial management of Group brands, sending commercial communications, commercial profiling, and customising services for all Regenera Luxury companies and brands.

3. What personal information do we obtain?

The data we process is obtained when you are a user, a customer, or show an interest in any of the Regenera Luxury brands. These may be obtained:

• From forms you fill in and requests you send to Regenera Luxury, for example, your requests for services;
• From the information provided to hotels and companies to contract our services;
• From information generated by your stays at our hotels and/or by providing the services contracted;
• From Group guest and customer complaints and from satisfaction surveys;
• From profiles and analytics from users browsing Group websites, registered or not. This may involve browsing tracking technologies (more information in our cookies policy);
• From your participation in commercial campaigns, e.g. competitions or promotions, carried out by any of the Regenera Luxury companies through websites, social networks, or other commercial events.

The data categories we process are typically:

• Identification and contact details;
• Personal data such as gender, date and country of birth, nationality, family status, and language;
• Financial and transaction data for any of our products or services;
• Data on past contact with the Group;
• Data on claims and complaints sent: name, origin of the claim, type and reason for claim, and contact identification and location details;
• Data on preferences and customer profile, and commercial monitoring data;
• Consolidated data generated by browsing our websites.

4. To whom may we transfer your data?

We will only transfer your data under legal obligation or with your prior consent.

5. Legal basis for processing

The definition and control of standards, quality management, and commercial management are based on the legitimate interest in processing consolidated customer data of the different Group companies for internal administrative and management control purposes, as well as to assess and promote the Regenera Luxury brand and company products and services.

Commercial profiling and subsequent processing to offer you customised commercial communications or services are based on your unequivocal consent, declared when providing data or afterwards. Sending commercial communications by electronic means is based on your consent. Withdrawal of such consent does not condition the provision of contracted services nor affect any processing conducted up to the time of withdrawal.

6. How long will your data be stored?

Profiles and data processed for commercial purposes will remain active as long as the data subject does not revoke consent or request their erasure and, in any case, during the terms established in applicable legal provisions and while necessary to deal with possible liabilities arising from the processing. We store the media containing your consent for data processing, such as signed forms, electronic logs, and check-in sheets, during processing and for the applicable legal terms.

7. What are your rights?

You can confirm whether or not we are processing your personal data and access it. You can request corrections to inaccurate data, completion of incomplete data, or the erasure of data no longer needed for its original purposes, among other reasons.

In certain circumstances, you may request that the processing of your data be restricted; in this case we will only process the affected data to formulate, file, or defend against claims or to protect the rights of others. For reasons related to your specific situation, you may also oppose the processing of your data, and we will cease processing except for legal reasons that prevail over your interests, rights, and freedoms.

Revoking consent and stopping direct marketing. You may revoke your consent at any time and oppose the processing of your data for direct marketing purposes, including commercial profiling. Withdrawal of consent will not affect the legality of processing based on prior consent. Under certain conditions, you can request data portability. You can also file a complaint with the Mexican Data Protection Authority or any other competent supervisory authority.

To exercise your rights, send a request together with a copy of your national identity document or another valid identification document, by post or email to the addresses indicated in the “Who is the data controller?” section. To revoke your consent to receiving commercial communications by electronic means, simply send an email to [email protected].