Integral Privacy Notice

In compliance with the Federal Law for the Protection of Personal Data in Possession of Individuals and Regulations, as well as the Privacy Notice Guidelines and the General Data Protection Regulation of the European Union, we hereby inform you of the Privacy Notice.

GRUPO HOTELERO SAMAR, S.A. DE C.V. and its subsidiaries own the intellectual and industrial property rights of all images, videos, audios, videos, photographs, designs, downloadable documents available on its websites, trademarks, commercial image of Mía Reef Isla Mujeres Resort México, including commercial and/or advertising phrases. All rights reserved ©️ The content of the website, its elements and characteristics may not be used, reproduced, copied and/or transmitted in any form or by any means, electronic, printed or otherwise, without the written authorization of Grupo Hotelero Samar, S.A. de C.V. and its affiliates, and failure to comply with the above will constitute liability in administrative, civil and criminal matters.

DETAILS OF THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

GRUPO HOTELERO SAMAR, S.A. DE C.V. and its subsidiaries hereinafter “MÍA REEF” with address at Calle Zazil -Ha Playa Note No. 7, Islote El Yunque, Colonia Centro Municipality: Isla Mujeres, Quintana Roo, Mexico, will be responsible for the use, treatment and destination of your personal data.

Phone: MX +52 1 998 999 2050

E-mail: [email protected]

For the purposes of this Privacy Notice, the following terms shall mean:

Privacy Notice: Refers to this document, which is made available to you, in your capacity as the owner of personal data and prior to the processing of these, in accordance with Article 15 of the Federal Law on Protection of Personal Data Held by Private Parties.

Consent: Manifestation of the will of the owner of the personal data for the processing of the same.

Personal data: Any information concerning an identified or identifiable natural person.

Sensitive personal data: Those personal data that affect the most intimate sphere of the OWNER, or whose improper use may give rise to discrimination or entail a serious risk for him/her. In particular, are considered sensitive those that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions, sexual preference.

ARCO Rights: Refers to the rights of access, cancellation, rectification and opposition that the OWNER has in relation to his/her personal data.

Law: Federal Law for the Protection of Personal Data in Possession of Individuals and/or its Regulations.

Responsible: GRUPO HOTELERO SAMAR, S.A. DE C.V. and its subsidiaries, as legal entities that will process the personal data; hereinafter MÍA REEF.

Holder: The natural person to whom the personal data corresponds, hereinafter the HOLDER.

Processing of personal data: The access, use, handling, storage of personal data, by any means.

This Privacy Notice is made available to the HOLDER, in compliance with the provisions of the Law, as well as other applicable legal provisions.

By virtue of the foregoing, MÍA REEF , in its capacity as responsible, commits to observe the principles of legality, consent, information, quality, quality, purpose, loyalty, proportionality and responsibility in the processing of personal data and the rights of privacy and informational self-determination.

The processing of personal data, being a fundamental right recognized in the provisions of the United Mexican States, the Charter of Fundamental Rights of the European Union, as well as in the European Regulation and the Council of the European Union, shall apply to natural persons regardless of their nationality or place of residence. The above, in the understanding that MÍA REEF offers its services to people of different nationalities, including the European Union, so it is stated in this privacy notice as follows:

DATA COLLECTED BY MÍA REEF

In order to comply with the applicable legal provisions, the personal data that will be collected and processed by MÍA REEF, which are necessary to provide the contracted services:

1.Identification data relating to your information concerning a natural person (name, date of birth, gender, nationality, Federal Taxpayer Registry, address and age).

2.In the event that our services are contracted by legal entities through their representative, we will collect the data of the company and its legal representative: company name or denomination, fiscal address, Federal Taxpayers Registry and identification of the legal representative.

3.Contact information (landline or cell phone and e-mail).

4.Employment data, if applicable, related to information concerning your employment or position.

5.Holder´s fiscal data: Federal Taxpayers Registry, in order to issue the corresponding invoice. Also, account number; account type; bank card number; CLABE number; economic activity and tax regime in the Federal Taxpayers Registry.

MÍA REEF will implement the necessary administrative, technical and physical security measures to protect your personal data from damage, loss, alteration, destruction or unauthorized use, access or treatment, which we also require to be met by suppliers of goods and / or services we contract. These measures will not be less than those maintained by MÍA REEF for the management of their own information.

MÍA REEF will not collect sensitive personal data.

By making available this Privacy Notice, the HOLDER consents to the processing of personal data.

PURPOSES OF THE PROCESSING OF PERSONAL DATA

The main purposes of the processing of personal data of the OWNER by MÍA REEF are as follows

A) Main: In order to provide information about our services in a personalized way, identify customers, provide contracted services, care and personalized services, commercial contact, clarifications, suggestions, complaints, follow-up for the delivery of products or services, as well as for compliance with applicable law.

In addition, we will use your personal information for purposes that are not necessary to provide our services, but that allow us to facilitate and provide better service:

B) Additional: sending information related to our advertising, promotions or offers regarding our products and/or services, elaboration of studies and programs for marketing purposes, quality evaluations of the products and/or services we provide, statistics of consumption preferences.

In case you do not want your personal data to be processed for additional purposes, from this moment you can communicate the above, in person at the address of MÍA REEF, or contact us by phone:MX +52 1 998 999 2050 , or email [email protected], in order to express that you do not want your data to be processed for additional purposes. The refusal to use your personal data for these purposes may not be a reason for us to deny you the services and products you request or contract with MÍA REEF.

For the purposes outlined in this Privacy Notice, we may collect your data:

1.Personally through physical and/or electronic forms.

2.By telephone.

3.Electronic mail.

4.Applications for cell phones or computer.

5.And/or through other optical, sound, visual, graphic or any other legally permitted technology.

WITH WHOM DOES MÍA REEF SHARE YOUR PERSONAL DATA AND FOR WHAT PURPOSES?

MÍA REEF informs you that the personal data of the OWNER will be processed by MÍA REEF and / or its parent company, affiliates or subsidiaries. Additionally, the data collected may be shared with federal and local authorities, in compliance with obligations under applicable law and in adherence to their specified requirements.

By providing this Privacy Notice to you, you have given your consent for the processing of your personal data. Moreover, in accordance with Article 37 of the Federal Law on Protection of Personal Data Held by Private Parties, MÍA REEF may transfer your data for the fulfillment of the legal relationship.

Please note that for the transfers indicated with an asterisk (*), we require your explicit consent. If you do not explicitly refuse such transfers, we will assume that you have granted consent. If you do not agree to the transfer of data, please communicate your refusal to the following e-mail: [email protected].

We would like to inform you that MÍA REEF has communicated the obligation of the third parties mentioned above, regarding this Privacy Notice and its purposes. Therefore,they are expected to adhere to the obligations outlined herein when transferring your personal data.

ARCO RIGHTS (ACCESS, RECTIFICATION, CANCELLATION OR OPPOSITION)

As the OWNER of your personal data, you have the right to exercise your ARCO Rights (Access, Rectification, Cancellation, and Opposition).You have the right to know the personal data we will process, their purpose, and the conditions of their use (Access). Similarly, you have the right to request the correction of your personal information in case it is outdated, inaccurate or incomplete (Rectification).; You may request the removal of your data from our records or databases if you believe it is not being used in accordance with the principles, duties and obligations under the regulations (Cancellation). Additionally, you can oppose the; use of your personal data for specific purposes (Opposition). To initiate the exercise of these rights, please submit a written request addressed to MÍA REEF via email:[email protected]

The request must be submitted by the OWNER or the legal representative to the aforementioned email address, and it should include:

1.The full name of the OWNER and address or other means of communicating the response, including e-mail address.

2.Documents proving their identity or that of the legal representative.

3.A clear and precise description of the personal data in respect of which they wish to exercise their rights.

4.Any other element that facilitates the location of the personal data of the OWNER.

MÍA REEF will communicate to the OWNER within 20 (twenty) calendar days from receipt of the request for access, rectification, cancellation or opposition, in order to be effective within 15 (fifteen) calendar days. These deadlines may be extended for an equal period when, at the discretion of MÍA REEF, the circumstances of the case justify it.

If you require further information, the responsible will contact you. In the absence of a response from the HOLDER, the request will be deemed not submitted.

The right of access allows the OWNER to know which of their personal data is held by MÍA REEF.

An access request will be fulfilled by making available to the OWNER or his representative, upon proof of identity, the documents containing the required personal data, either by photocopies, a CD containing such information, a USB device, or any other means determined by MÍA REEF. The delivery of the data will be free as long as the access request is not repeated in a period of less than 12 months. The OWNER will only cover the costs of reproduction in copies or other formats and shipping.

The OWNER may rectify their personal data when it is inaccurate or incomplete, indicating in the request for rectification the changes to be made and providing MÍA REEF with documentation supporting their request. In the event that the request of the OWNER is admissible, MÍA REEF shall inform the data processors and third parties of the changes in question, in the event that data transfers have been made under the terms of this Privacy Notice.

The right of cancellation consists in the deletion of personal data, proceeding subsequently to a blocking period to be determined in accordance with the statute of limitations for actions arising from the applicable legal relationship. The cancellation of personal data will not proceed in the cases provided by law. MÍA REEF may retain the data only for the purposes of liabilities arising from the processing of personal data. Once the data is canceled, the owner will be notified.

The OWNER shall have the right at any time and for legitimate reasons to object to the processing of his data. If the request is admissible, MÍA REEF will not be able to process the data subject´s data.

MÍA REEF may deny access to personal data, or grant the opposition when the applicant is not the OWNER or the legal representative is not duly accredited to do so, or when the database does not contain the OWNER´s personal data, the rights of a third party are violated, there is a legal impediment or resolution of a competent authority that restricts access to personal data or does not allow its rectification, cancellation or opposition and when the rectification, cancellation or opposition has been previously made.

To learn about the procedure and requirements for the exercise of ARCO rights, you may call MX +52 1 998 999 2050 or send an email to [email protected] who will process the requests for the exercise of these rights, and will answer any questions you may have regarding the processing of your information.

MODIFICATIONS TO THE PRIVACY NOTICE

MÍA REEF reserves the right to make changes or updates at any time due to legal provisions, internal policies, new requirements for the provision of service or products we offer, changes in our privacy practices, alterations to our business model, or other causes.

We are committed to keeping you informed about any changes that this privacy notice may undergo, through www.miahotelsandresorts.com. Additionally, we will notify you through your email if deemed appropriate.

For any doubts or clarifications regarding this privacy notice, you can write a free entry in the Spanish language and send it via e-mail to: [email protected].

LIMITING THE USE OR DISCLOSURE OF YOUR PERSONAL INFORMATION

To empower you to limit the use and disclosure of your personal information, we offer you the following options:

1.Registration in the Public REgistry to Avoid Advertising: Managed by the Federal Consumer Attorney´s Office (PROFECO), this registry aims to prevent your personal data from being used to receive advertising or promotions from companies offering goods or services. For additional information on this registry, you can consult the PROFECO´s website or directly contact them.

2.Registration in the Exclusion List: This option ensures that your personal data will not be utilized for marketing, advertising or commercial prospecting purposes by us. For more details, please send an email to the following address:[email protected].

REVOCATION OF CONSENT FOR THE PROCESSING OF PERSONAL DATA

Consent for the processing of personal data may be revoked through a written request from the OWNER, directed to the e-mail address indicated in this Privacy Notice, including the reasons for revoking consent.

To understand the procedure and requirements for revoking consent, you can call MX +5219989992050; visit our website https://www.hotelmiareefislamujeres.com/aviso-de-privacidad or send an email to [email protected]

It is important to note that in certain cases, we may not be able to fulfill your request or cease the use immediately., This is because some legal obligations may require the continued processing of your personal data for specific purposes. Revoking, your consent may result in our inability to continue providing the requested service, or the conclusion of your relationship with us.

By accessing this website or by acquiring our services and / or products of MÍA REEF, the HOLDER acknowledges understanding this Privacy Notice, expressing knowledge, agreement with its contents, and explicitly stating acceptance for MÍA REEF to carry out the processing of personal data under the terms stated therein.

ARTIFICIAL INTELLIGENCE

MÍA REEF informs you that on its website, social networks such as Facebook, Instagram and WhatsApp, we use virtual assistants or chatbot, whose system interprets and automates the text of your written conversation and responds to the question or query sent, which allows us to provide you with more efficient information. MÍA REEF may use algorithms based on artificial intelligence to perform certain activities of analysis of consumer trends and preferences on the use of products and services, predicting behavior and consumer trends on our services, profiling and analysis of information for technical purposes and improvement of our products and services.