This Privacy Notice is intended to inform you about the terms under which we will process the personal data of all natural persons who apply to carry out internships or to participate in university programs with us in Mexico.

Identity and domicile of Data Controller.

In compliance with the provisions of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPD – Mexican acronym) and other applicable regulations, Hotelera Palace Resorts S. de R.L. de C.V. (hereinafter commonly referred to as "Grupo Palace Resorts®" or the "Data Controller", whose domicile to hear and receive communications is: Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P. 77506, expressly states:

B. Personal data collected and processed.

For the purposes described in this Privacy Notice we collect the following categories of personal data:

1. Identification and contact data.
2. Personal characteristics data.
3. Social circumstance data.
4. Academic and professional data.
5. Job occupation data.
6. Economic, financial or insurance data.
7. Sensitive personal data (health status).

The data subject will be responsible for informing any third party (relatives or acquaintances) whose personal data he/her has provided for the fulfillment of the identified purposes, about the existence of the processing of their personal data by Grupo Palace Resorts® and about the content of this Full Privacy Notice.

C. Processing of sensitive data. Health status.

Through the relevant Request form, the Data Controller may collect personal data considered sensitive by the applicable legislation. Thus and by virtue of the process of incorporation into the requested university internship program, we will request your express and written consent for the processing of said sensitive personal data, through the legally permitted means.

D. Reasons of processing.

1. Relevant and necessary pursuits.
   1. Management, control and administration of the Collaboration Agreements that Grupo Palace Resorts® enters into with various Universities, so that the students of the latter carry out professional residences, voluntary internships, observation and study visits, stays and conferences.
   2. Management, control and administration of the activities and duties carried out by the university students who participate in the programs established between the corresponding Universities and Grupo Palace Resorts®.
   3. Evaluation and accreditation of students during their professional practices.
   4. Statistics and historical records of internships and university interns.
2. Additional purposes.
   1. Evaluation of results, so that the personal data of the students are considered to be incorporated into other open selection processes in Grupo Palace Resorts®.

E. Transfer of personal data.

Your personal data (including sensitive data) may be transferred to and processed by persons other than the Data Controller. The receivers of such personal data (domestic and international) belong to the following categories:

1. Controlling, subsidiaries or affiliated companies of Grupo Palace Resorts®; for the purpose of centralized safeguarding of information, or for their incorporation into open selection processes in other companies of Grupo Palace Resorts®.
2. Persons subject to professional medical secrecy or an equivalent obligation, when the transfer of sensitive personal information related to your present or future state of health to any third party legally able to receive it, is indispensable for medical care, prevention, diagnostic, health assistance, medical treatment or the management of health services, in cases when the owner of such information is unable to grant their consent, pursuant to the Ley General de Salud and other applicable legislation.
3. Universities or study centers, to communicate to them the evaluations and personalized results of the students who participated in internships or programs coordinated by Grupo Palace Resorts®.

The transfers of personal data referred to in the preceding paragraphs do not require your consent to be carried out, in accordance with the provisions of article 37 of the LFPD.

F. Exercise of ARCO rights.

Under all legal circumstances you may exercise your rights of access, rectification, cancellation or objection (ARCO rights) using the legal procedures we have set up. Such requests shall comply with the applicable legal requirements and be addressed to our Data Protection Officer, whose domicile is Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1 – 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P.77506.

The requests shall contain the following:

1. Your name and address or other means of providing you with a response.
2. Valid identification documents or power of attorney, as the case may be.
3. A clear and precise description of the personal data on which you wish to exercise your ARCO Rights; and
4. Any other element or document that could facilitate locating your personal data.

Grupo Palace Resorts® will reply with a decision within 20 business days counted from the date on which your request is received. If the request is admissible it will be put into effect within 15 business days following the date on which Data Controller advises you of the decision. In the event that the information you provide is incorrect or insufficient, or if you fail to send the necessary identity documents or power of attorney, Data Controller will ask that you correct such discrepancies within 5 business days after receiving your request and you will have 10 business days to comply, counted from the day after you receive such notice. The process will be terminated if you do not answer within the required time.

You may obtain the information or personal data requested through simple copies, electronic documents in conventional formats (Word, PDF, etc.), through restricted and authorized access to the system that processes your personal data (access) or through any other legitimate mean that guarantees and accredits the effective exercise of the requested right.

Alternatively, after fulfilling all the above-mentioned requirements, Data Subject may submit his/her request by e-mail to derechosarco@palaceresorts.com, complying with all the requirements listed above, and indicating "ARCO Rights and/or Consent Revoked" in the Subject line. Response times will remain the same as those mentioned in the immediately preceding paragraph. The use of electronic means in the exercise of ARCO rights authorizes Data Controller to answer the request using the same means unless Data Subject specifically requests another format.

You will be responsible for keeping your personal data in possession of Grupo Palace Resorts® updated. Therefore, you guarantee and are responsible, in any case, for the veracity, accuracy, validity and authenticity of the personal data provided, and undertake to keep them duly updated, communicating any changes to the Data Controller.

G. Revoking consent.

You may revoke your consent to have your personal data processed, without retroactive effect, in all cases in which said revocation does not make it impossible to fulfill any obligations arising from a legal relationship in force between you and Grupo Palace Resorts®. The process for revoking consent will be the same as the one established in the immediately preceding section on how to exercise your ARCO rights.

H. Limitations on the disclosure of your personal data.

You may limit the use or disclosure of your personal data by directing the corresponding request to our Data Protection Officer. The requirements to prove your identity, as well as the procedure to meet your request, will be the same as those indicated in the section "Exercise of ARCO rights" of this Notice.

I. Amendments or updates of this Full Privacy Notice.

Data Controller may amend, update, extend or in any other way change the content and scope of this Full Privacy Notice, at any time and at its complete discretion. In such cases Grupo Palace Resorts® will publish those changes on its website www.palaceresorts.com, in the section "Privacy Notices".

J. Language.

This Full Privacy Notice is published both in English and Spanish. In the event of any discrepancy, the Spanish version shall be taken as the main reference.

Last updated:
December 1st, 2021.