Privacy Notice

1. Identity and address of the responsible entity:

The legal entity Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., commercially identified as MARIVAL EMOTIONS RESORT & SUITES, addressed at Paseo de los Cocoteros s/n, interior Marival Resort & Suites, in the Fraccionamiento Nuevo Vallarta, Municipality of Bahia de Banderas, Nayarit, C.P. 63735, Internet website https://www.marivalemotions.com, is the responsible for the use and protection of your personal information and therefore, here by informs the following:

2. For what purposes will we use your personal information?

The personal information that we obtain from you shall be used for the following purposes required to provide the services requested:

a) As a Customer of Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V.:

• For identification, verification and contact.

• For your security during your stay at Marival® Emotions Resort & Suites, we establish security measures and surveillance of the facilities, including monitoring, video cameras, control and surveillance of physical and logical access

• For your attention in case of health or safety incidents

• Contracting, management, operation and reservation of the services contracted with us that may refer to: hotel services, memberships, spa, food and beverages, tours, ground transportation arrangements, organization of weddings, conferences or conventions and other amenities or complementary tourist services.

• Processing and managing in general, your lodging reservation, as well as contracting other complementary services of your stay which from time to time you might contract thru us (ground transportation, excursions, spa, food and beverages packages also known as “All Inclusive”, reservations and access to use facilities or for the purchase of goods or services offered in other premises operated by affiliate enterprises of Marival® Group).

• Billing and collection of hotel rates, spa, restaurants, complementary services, and other considerations that result in their charge.

• For the provision of spa services, gym and for the provision of other complementary services that you contract with us.

• Any other manner of treatment of information deriving from your role of supplier, visitor or user of our websites, such as invoicing, processing orders or integration of administrative files as documental support or of any other nature regarding the commercial relationship that exists with you

• The provision of the service “Marival Kids”, which consists in nursery and organization of playful activities for children in the hotels owned and managed by Marival® Group. Your or your children’s personal data collected for said purposes will be treated according to the privacy disclaimer that will be put to your disposal at the moment of hiring the service and can also be consulted in the following link www.marivalgroup.com/marival-kids/privacy/ or requested by sending an e-mail to the following address: privacidad@marivalgroup.com

b) Particularly as employee or candidate to obtain a job with Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., will also apply the following primary purposes:

• For identification, verification and contact.

• For the analysis, study and processing of your job application and other procedures related to the recruitment, selection, hiring and training of personnel.

• Integration of your employee file.

• For hiring and/or job promotion processes.

• For performing socioeconomic and psychometric studies.

• For granting labor benefits.

• For making job offers and job opportunities in the establishments to which the company renders its services.

• For the payment of wages and other benefits established in the Federal Labor Law and individual or collective labor agreements.

• For making a database for the prevention of the spread of COVID 19 and / or any other type of future health emergency, whose objective is to identify cases of risk of contagion of this virus, to protect the health of the staff of Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V.

• For processing registrations, modifications, payment of discounts or the corresponding downsizings before the Mexican Institute of Social Security, Institute of the National Fund for the Consumption of Workers, Institute of the National Fund for Workers' Housing and contracting of insurance of private medical expenses in favor of its employees.

• Establishing, managing and operating of savings banks where the employees of Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V. participate,

c) Particularly, as a Provider of Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., will also apply the following primary purposes:

• For identification, verification and contact.

• For the elaboration of contracts for the provision of services.

• For the fulfillment of contractual obligations.

• For the processes of payment, reception and/or return of goods and services acquired.

• For the processing of orders and integration of administrative files as documentary or other support regarding the existing commercial relationship with you.

Additionally, we will use your personal information for the following secondary purposes that are not necessary to provide the services required, but that allow us and facilitate a better service:

• Marketing and advertisement.

• Commercial prospection.

• Quality Control.

• Consumption Behavior Definition.

• Make feedback and data update campaigns.

In case you do not wish your personal information to be used for these secondary purposes, we hereby request you to inform us using the option that may apply:

• In case you provide us your information in a direct way, please inform our coworker at this moment and request him to provide you with the corresponding form to register your denial.

• In case you provide us your information using our website, or a mobile app, you will have to send an e-mail to the following address: privacidad@marivalgroup.com.

Your denial of authorization for use of your personal information for these purposes shall not be a reason for denial of services and products requested or hired with us.

3. What personal information will be used for these purposes?

• Identification data: Name, Last name, signature, identification document with photograph, Unique Code for Registration of Population (CURP).

• General data: Full Address, either home address or work, personal or work e-mail; personal or work telephone number; Cellular Phone number, Nextel ID number (in its case) and Fax number; Date of Birth; age, marital status and nationality.

• Tax information: Code from the Federal Taxpayer’s Register (RFC), proof of tax situation, as well as your fiscal address and tax regime (in its case).

• Data related to bank accounts: Numbers related to bank accounts, credit cards and/or debit cards, name of the cardholder, account number and Banking Institution, CLABE (in its case), card number; expiration date of the card, type of card and security code. All this information is used with your expressed consent and in case you inform us your denial of authorization we might be unable to provide the services you hired since it might not be possible to process the corresponding payment.

• Patrimonial data: Statistical information regarding your rank of income and expenditures and about the memberships that in its case you acquire with Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V.

• Sensitive personal data: Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., collects the following sensitive personal data and purposes:

◦ Personal health data: provide medical or first aid care and services, for protecting people's health in emergency situations (including COVID-19 and / or any other type of health emergency), for the treatment of the special requirements from our clients focused on food allergies or restrictive diets. In the case of minors and particularly for Marival Kid’s program, we will require: age, full name, data of the parent or legal guardian, phone number and hotel room number; all these data are always obtained with the consent of the parent or legal guardian.

◦ Complementary data to integrate your employment file, which are necessary for the employment relationship and to ensure your safety, well-being and health inside the work establishment. Such data may be the following: biometric data, health data, ideological personal data (only union memberships).

◦ Complementary data to integrate your beneficiary file, according to the health and hygiene programs, managed by the foundation.

These personal data at no time and under no circumstances will be shared, except for personal health data, which will only be transmitted to medical institutions and other persons involved in emergencies where the owner of the personal data or relatives are at risk, or to provide care of health and hygiene programs of interest that are of interest to the associate.

• Employment data: We will require data from your past jobs, such as: position, activities, name of the institution and other data of the institution, number of direct reports, salary, benefits, name of your supervisor and other data that allow us to know your experience and employment history.

• Academic data: We will request information about your education, institutions in which you studied, term of your studies and academic degrees received and studies you currently do.

• Personal Data from sources of public access and received via consented transfers: resulting from public registers, directories, social networks and other lawful sources available in the market, as well as personal data shared by third parties you previously authorized.

• Personal data of third parties: You agree and acknowledge that, to obtain references from you about your work experience, identity and the veracity of the data you provided, we will ask you for personal references. For such purposes you represent and acknowledge that you have the authorization of the owner of the personal data to transfer their personal data as personal references, Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., will only and exclusively use that data for these purposes and not for any other particular purpose.

• Personal data from Employment Agencies: Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., may receive your personal data when you had registered your data in an employment or placement agency to which you have consented to transfer your personal data. In these cases, Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., compels itself to treat your personal data in accordance with the privacy notice of said employment or placement agency, always in compliance with the Federal Law on Protection of Personal Data Held by Private Parties, with the understanding that once you authorize Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., to treat your personal data, such treatment will be subject to this privacy notice.

• Personal data obtained from social networks: MARIVAL® EMOTIONS RESORT & SUITES, will be able to collect and process personal data and and information you shared in the social network of MARIVAL® EMOTIONS RESORT & SUITES (such as Facebook ®, Instagram ® and Twitter ®, Pinterest ®, Foursquare ®, Google ® among others), particularly the information you shared in the profile of MARIVAL® EMOTIONS RESORT & SUITES of said social networks or in the profile of other companies related to MARIVAL® EMOTIONS RESORT & SUITES, including the information you have shared with the character of “public”, as provided in the terms and conditions of use and their policies and recitals.

• Personal Data obtained from travel agencies: MARIVAL® EMOTIONS RESORT & SUITES might obtain your personal data when you make your lodging reservation thru a travel agency either mayor or minor, located in national soil or abroad, as well as thru other platforms which commercialize the services provided by MARIVAL® EMOTIONS RESORT & SUITES (websites, travel clubs, loyalty and benefits programs, vacation programs from airlines and other similar platforms known or to be known).

• Personal data collected from subsidiary companies with which you have a contractual relation and with which you authorized to transfer such information to Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V.

The personal data described in the previous paragraphs of this section, are collected thru: i) the use of formats or printed documents; ii) the use of emails and/or iii) the voluntary provision of information and personal data when you stay in our facilities, when attending to sale presentations, when you communicate via telephone with us or our employees (including the customer services area); iv) thru our web site, as well as v) using public access sources and other sources available in the market.

The personal data collected by Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., is protected by security, administrative and physical measures which were adapted against the damage, loss, alteration, destruction, use, unauthorized use or treatment, in accordance with the LFPDPPP and its regulations. To know more about our security measures we would ask you to contact privacidad@marivalgroup.com.

4. How do we protect your personal data?

The personal data collected by Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., is protected by adequate security, administrative and physical measures against damage, loss, alteration, destruction, use, unauthorized or illegal access or treatment, disclosure, and against loss, damage or alterations or accidental destruction, in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties ("LFPDPPP") and its Regulations. To learn more about our security measures we ask you to contact us via email at privacidad@marivalgroup.com.

We strive to store your personal data in secure operating environments that are not accessible to the general public, and to implement security measures in our physical facilities to protect against the loss, misuse or alteration of your personal data by our employees or third parties.

However, it is not possible to guarantee 100% the security of any data transmission over the Internet or any data storage environment, so we cannot assure you in absolute terms that the personal data you provide to us is protected at all times. Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., asks you to inform us if you experience any unusual event that may indicate a security breach of your information; In the same way, you will be notified in case of any incident or vulnerability detected by Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., within the established deadlines and means, which the applicable regulations designate. In that case, we will endeavor to investigate whether this fact was related to the transmission of data whose origin or destination is www.marivalemotions.com, and we will inform you about the measures you can take and that have been taken to help correct the problem.

5. Information relating to minors:

www.marivalemotions.com, is a site for the general public and may collect information from minors, as long as it is provided by their parent or legal guardian.

In the event that Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., is informed, or detects, that a person under the age of 13 has sent us personal information, we will delete or destroy such information as soon as reasonably possible.

6. With whom shall we share your personal information and for what purposes?

We hereby inform you that your personal information is shared within and outside of the country in case it is necessary to accomplish the purposes set forth herein.

We also inform you that Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., is part of the corporate group commercially known as “MARIVAL GROUP” and it might share your personal information with other companies of the Group in terms of the provision set forth on article 37 from the Federal Protection of Personal Information in Possession of Particular Parties Act regarding the related parties. The companies that integrate that group are:

• Operador Hotelero Distinct Luxury Residences, S. de R. L. de C.V.

• Administraciones Profesionales de Vallarta, S.A. de C.V.

• Rinoval de México, S.A. de C.V.

• Vacation Club Services, S.A. de C.V.

• Operadora y Comercializadora Turística, S.A. de C.V.

• Desarrollo Transimar, S.A. de C.V.

• Destiladeras Resort Operations, S.A. de C.V.

• Fundación Pietro Rizzuto, A.C.

• Delicias Narezushi, S. de R.L. de C.V.

• Mobile Sail Technologies, S.A. de C.V.

• Constructores y Desarrolladores Inmobiliarios de la Bahía, S.A. de C.V.

• Comercializadora Access del Puerto, S.A. de C.V.

• Serviventas de México, S.A. de C.V.

• Servicios Terrestres del Nayar, S.A. de C.V.

• Travel Marketing 500, S. de R.L. de C.V.

Also we will share your personal information with independent third parties with which we need to interact to accomplish the purposes set forth herein. The third parties with which we will share your personal information might be:

Finally, we point out that we will transfer your data nationally or internationally, in the cases contemplated by article 37 of the LFPDPPP, in force in Mexico, which expressly establishes the possibility of sharing your data with competent authorities and controlling companies, subsidiaries or affiliates under the common control of the responsible party, or to a parent company or any company thereof, in the following cases:

• When the transfer is provided for in a law or treaty to which Mexico is a party;

• Where the transfer is necessary for the medical prevention or diagnosis, providing healthcare, medical treatment or the management of health services;

• When the transfer is made to holding companies, subsidiaries or affiliates under the common control of the responsible party, or to a parent company or any company of the same group of the responsible party that operates under the same internal processes and policies;

• When the transfer is necessary by virtue of a contract in force or to be entered into in the interest of the owner of the personal data, by the responsible party and a third party;

• When the transfer is necessary or legally required for safeguarding a public interest, or for the prosecution or administration of justice;

• When the transfer is necessary for the recognition, enforcement or defense of a right in a judicial process, and

• When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the responsible party and the owner of the personal data.

7. Storage Periods:

Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., will keep personal data for as long as necessary to fulfill the purposes for which it has collected the information, including the purposes to satisfy any legal, accounting and reporting requirements, in accordance with the provisions of article 37, of the LFPDPPP Regulations, in force in Mexico.

For the purpose of determining the appropriate retention period, we take into account the amount, nature and degree of confidentiality of the personal data, the potential risk of harm arising from the unauthorized use or disclosure of your personal data, the purposes for which we processed such data and whether we can achieve those purposes by other means, as well as the legal provisions in force.

8. How may you access, rectify or cancel your personal information or oppose to its use?

You have the right to know what personal information we have obtained from you, the purpose for its use and the conditions of use that you are provided with (Access). Also, it is your right to request the correction of your personal information in the case that it is out of date, inexact or incomplete (Rectification); request its elimination from our records, or databases when it is considered that it is not being used adequately (Cancellation); as well as to oppose the use given to your personal information for specific purposes (Opposition), Revoke of consent (Revocation of consent). These rights are known with the acronym ARCO.

Regarding the procedure and requirements for exercising you ARCO rights we hereby inform you the following:

a) What information and/or documentation shall the application contain?

Regarding the general requirements that the application must cover, are the following:

• Name of the owner of the personal data.

• Documents proving the identity of the holder (passport, voter registration card issued by the National Electoral Institute, state or federal professional license or driver's license).

• Where appropriate, name of the representative of the owner and documents to prove their identity and personality. In the case of proxies of natural persons, the representation will be accredited through the following 3 options: a) public instrument (document signed by a Notary Public), b) power of attorney signed before two witnesses (attaching a simple copy of their official identifications), c) You and your representative to appear at the hearing of the person in charge, presenting your official identification (passport, voter registration card issued by the National Electoral Institute, state or federal professional license or driver's license).

• Address or any means to receive notifications.

• Clear and precise description of personal data and the right to be exercised or what is requested.

• The data or documents that facilitate identifying the information subject of the application (for example, membership number, date of stay, reservation number, dates of lodging, etc).

Also, in relation to the type of application, we require please indicate the following additional information, so that your request can be answered more efficiently:

• Access Request:

◦ Indicate the modality in which you prefer that the requested personal data be reproduced.

• Rectification Request:

◦ Specify the modifications that are requested to the personal data, as well as provide the documents that support the request.

• Cancellation Request:

◦ Point out the causes that motivate the request to delete the data from the files, records or databases of the person responsible.

• Opposition Request:

◦ In the event that the request refers to a particular treatment, the specific purposes for which the exercise of the right is requested should be indicated.

• Revocation of consent: You can revoke the consent that, where appropriate, you granted us for processing your personal data. However, it is important that you bear in mind that not in all cases we will be able to comply with your request or stop its use immediately, since it is possible that due to some legal obligation we are required to continue processing your personal data. Likewise, you should consider that, for certain purposes, the revocation of your consent will mean that we can no longer provide the service you requested, or the conclusion of your relationship with us.

b) Through what means may the principal’s identity be ascertained, and in its case, it’s legal representative as well as the authorities of the latter?

For the exercise of any of the ARCO rights, you will have to file the corresponding request through the following means:

By e-mail to the address privacidad@marivalgroup.com or also you can contact our Personal Information Department for it to process your request, provide you orientation and facilitate the corresponding form. The address from our Personal Information Department is Paseo de los Cocoteros S/N, hotel Marival® Emotions Resort & Suites, fraccionamiento Nuevo Vallarta, municipality of Bahía de Banderas, Nayarit, zip code 63735, telephone number 322-2268200 (extension 4493).

The format of attention to requests ARCO, official for Marival® Emotions Resort & Suites, please request it in the account privacidad@marivalgroup.com.

c) What is the term in which we will respond to your request?

20 working days (every day of the year, with the exception of Saturdays, Sundays and non-working days by Law).

d) What means shall we use to communicate our response to your request?

By e-mail or by postal service.

e) In what media can the personal data that was requested, in its case, be reproduced?

In the same manner in which it was supplied by the customer.

f) Regarding the procedure and requirements for exercising you ARCO rights we hereby inform you the following:

The forms or corresponding systems and orientation about exercising the ARCO rights can be obtained by contacting our Data Protection Department at the following email address: privacidad@marivalgroup.com and physically located at Paseo de los Cocoteros s/n, hotel Marival® Emotions Resort & Suites, fraccionamiento Nuevo Vallarta, municipality of Bahia de Banderas, Nayarit, zip code 63735, telephone number 322-2268200 (extension 4493).

g) Is there a cost for the exercise of my ARCO rights?

The exercise of the ARCO rights is at no cost. However, you may be required to pay only for the justified expenses of the shipping, or the cost of reproduction in copies or other formats. Also, if the same person withdraws their request in a period of less than twelve months, the costs may not be in excess of three days of the Minimum Wage Enforceable in the Distrito Federal (Federal District), unless that there are substantial modifications to the privacy disclaimer that may motivate new inquiries.

h) What happens if a request is incomplete or does not include all the data included in the procedure?

If your application does not have the information described in section 4 Requirements (sections a and b), or is not clear, is erroneous or incomplete, Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., may request the owner to provide the Missing information, to meet your request within 5 working days of receipt of the request, if the request is not answered, it will be considered as not submitted.

The owner will have 10 business days to meet the requirement of Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V., counted from the day after he received it. In the event that the owner attends to the information request, the deadline for the person responsible to respond will begin to run the day after the owner has attended the request.

For more information regarding the procedure, we have the following means available:

• Email: privacidad@marivalgroup.com

• Contacting our data protection department, which is in charge of processing the ARCO rights requests, are the following:

◦ Name of the person or department of personal data: GRUPO MARIVAL PERSONAL DATA DEPARTMENT.

◦ Address: Paseo de los Cocoteros s / n, interior Marival® Emotions Resort & Suites, Nuevo Vallarta, municipality of Bahía de Banderas, Nayarit, México, 63735.

◦ Email: privacidad@marivalgroup.com

◦ Telephone number: 322-2268200

9. How can you limit the use or disclosure of your personal information?

With the purpose of limiting the use or disclosure of your personal information, we offer the following means:the client may limit the use or disclosure of their personal information by sending an e-mail where the concrete question is sent to the e-mail privacidad@marivalgroup.com

Additionally, we inform you that we have the following lists of exclusion, wherein you can register so your personal information is not used for such purposes.

10. The use of tracking technologies in our Internet website:

We inform you that in our website we use cookies or other technologies, through which is possible to monitor your behavior as an internet user, as well as to provide you a better service and experience when browsing through our website. The personal data that we gather through these technologies, will be used for the following purposes:

• To monitor and prevent the unauthorized use of digital platforms; to improve our digital tools and update then in conformity with the evolution of technology; and to offer personalized content.

The personal information that we obtain from these tracking technologies are the following:

• identification data from one session.

• Preferred language chosen by the user.

• Region in which the user is located.

• Type of browser from the user.

• Type of the operative system from the user.

• Websites visited by the user.

• Search made by a user.

• Advertising reviewed by a user.

For more information, it is suggested that you search in our Cookies policy

11. How will I know of changes in this privacy disclaimer?

This privacy disclaimer may be modified, changed or updated derived from new legal requirements; because of our own needs or because of the change in products or services that we offer; our privacy practices, our changes in business model, or because of other causes.

We commit ourselves to keep you informed in regards to the changes that this privacy disclaimer may have, through: sending of e-mail and in the internet website.

The process by which notices of changes or updates to this privacy disclosure is the following:

TThe changes or updates to the privacy disclaimer shall be made known by the means that are described in this policy and shall be effective 1 week afterwards. In case of doubts or comments, the clients must direct themselves to privacidad@marivalgroup.com

Latest update: 1/04/2023

DISCLAIMER.- This is a courtesy English translation. Should any conflict or controversy result between the Spanish and the English version, the Spanish version shall prevail