PRIVACY NOTICE

"PRIVACY NOTICE" AGREED ON, ON THE ONE PART, INVERSIONES POTOSINAS SA DE CV (HEREINAFTER "HOTEL SAN FRANCISCO") AND, ON THE OTHER PART, ANY AND ALL PERSONS HOLDING PERSONAL DATA THAT ARE SET IN THE FORMATS, PRINTED OR ELECTRONIC DATA, (HEREINAFTER "THE FORMATS") PROVIDED BY HOTEL SAN FRANCISCO (HEREINAFTER THE "OWNER OF THE PERSONAL DATA" AND JOINTLY WITH HOTEL SAN FRANCISCO THE "PARTIES").



I. DECLARATIONS: (a) HOTEL SAN FRANCISCO declares: (I) To be a company constituted in accordance with the laws of the Mexican Republic; (II) be domiciled at Av. Universidad 375, Col. Centro CP 78000, San Luis Potosí, San Luis Potosí, Mexico; (b) The Holder of the Personal Data declares under protest to tell the truth: (I) that all the data set forth in the FORMATS are true and exact; (II) that you have received information to your satisfaction regarding the content of this Privacy Notice and have fully understood and expressly accepted its terms and conditions and the way in which HOTEL SAN FRANCISCO protects the personal data provided to it; (III) that has sufficient legal capacity to be bound under the terms and conditions of this Privacy Notice.

II. PURPOSE AND SCOPE: The purpose of this Privacy Notice is to establish the terms and conditions under which HOTEL SAN FRANCISCO protects the personal data of its clients and guests who provide them with personal data, to protect their privacy and their right to self-determination. informative, in terms of the Federal Law on the Protection of Personal Data Held by Private Parties ("LFPDP") and the administrative regulation derived from it or related to it, regardless of the means or the way in which the personal data is collected and/or treated. This Privacy Notice allows HOTEL SAN FRANCISCO to comply with its contractual obligations, as well as those derived from the legislation and administrative regulation regarding the protection of personal data, in commercial and fiscal matters.

III. PRIVACY PRINCIPLES: HOTEL SAN FRANCISCO undertakes to observe the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility in the processing of your personal data: (a) PRINCIPLE OF LEGALITY: HOTEL SAN FRANCISCO collects and treats your personal data in a lawful manner, without using fraudulent means or deception; (b) PRINCIPLE OF LOYALTY: The processing of your personal data will be done in accordance with the provisions of this Privacy Notice in order to provide you with a reasonable expectation of privacy; (c) PRINCIPLE OF CONSENT: All processing of your personal data will be subject to your consent, with the exception of the cases provided for in the Federal Law on Protection of Data Held by Private Parties (“LFPDP”); (d) PRINCIPLE OF INFORMATION: HOTEL SAN FRANCISCO will inform you about the personal data and information that it collects from you and for what purposes; (e) PRINCIPLE OF DATA QUALITY: HOTEL SAN FRANCISCO undertakes to implement reasonable measures so that your personal data that is processed and stored in its databases is pertinent, correct and up-to-date for the purposes for which it was collected. Among such measures is the periodic sending of emails and/or telephone calls with reminders to update your personal data to ensure its veracity and accuracy; ( f ) PRINCIPLE OF PURPOSE: The processing of your personal data is limited to the fulfillment of the purposes set forth in this Privacy Notice. Any treatment of your data for different purposes that are not Privacy Notice compatible or analogous to those provided herein, will require obtaining your consent again; (g) PRINCIPLE OF PROPORTIONALITY: The treatment of your personal data will be that which is necessary, adequate and relevant in relation to the purposes described in this Privacy Notice. In the case of sensitive personal data, HOTEL SAN FRANCISCO will establish the necessary measures to limit its processing period to the essential minimum.

HOTEL SAN FRANCISCO undertakes to cancel the personal data provided by you once they are no longer necessary for the fulfillment of the purposes set forth in this Privacy Notice. The foregoing, without prejudice to keeping the information and documentation required to comply with the obligations set forth in the Code of Commerce, in the Fiscal Code of the Federation and other fiscal legislation, as well as in any other present or future applicable legislation ( h) PRINCIPLE OF RESPONSIBILITY: In order to comply with this Privacy Notice, the "LFPDP" and the administrative regulation derived from it, HOTEL SAN FRANCISCO has established the company's Personal Data Department, which has , among other functions, to process the requests that you formulate to assert your rights in terms of the LFPDP and the requirements of the IFAI and other competent authorities.

IV. INFORMATION AND DOCUMENTATION THAT IS COLLECTED AND PROCESSED: HOTEL SAN FRANCISCO collects and processes your personal data, that is, the information that can reasonably identify you, and that may appear in various documents. The personal data that will be collected and processed include: name and surnames; domicile, work, or fiscal; Email address; landline and/or cell phone number; credit card number and security key; key of the Federal Taxpayer Registry (RFC). The personal data will be collected by HOTEL SAN FRANCISCO through its formats, or by comparing the originals or their certified copies with the copies that the Owner of the data gives you of: the voter card; the passport or identity card of the national military service released; The credit card; the registration certificate in the RFC; where appropriate, the proof of address - water rights payment slip, property tax payment slip, or electricity supply service payment slip. HOTEL SAN FRANCISCO also collects personal data from publicly accessible sources and from other sources available in the market to which you may have given your consent to share your personal information.

V. PURPOSES OF THE INFORMATION: The personal data described in number IV above, are collected and processed with the purpose of: (i) managing the information of our guests, clients and prospects, to maintain an updated database; (ii) manage relationships with our customers and prospects, providing information about services and activities contracted or in the process of being contracted; (iii) carry out commercial management and customer and guest services; (iii) manage the marketing of services based on: the reservation confirmation document and the receipt of deposits on account; (iv) document and guarantee the confirmed reservation according to the agreed conditions; (v) enter into contracts with the client; (vi) provide information to the client and the guest in a clear and visible manner, on the conditions, policies and provisions for the contracting and use of services and facilities, as well as on environmental practices, means of payment, rates for services, modalities and calendars, as well as any change that occurs in the reservation, after its confirmation, or about any unusual circumstance in the establishment such as works, limitations of hours or services, among others; (vii) manage food services, room service, room cleaning and maintenance, telephone service, parking, among others, based on policies previously defined and communicated to customers and guests; (viii) manage the parcel and courier service for deliveries and shipments of packages on behalf of the client or guest; (ix) manage the currency exchange service on behalf of exchange houses; (x) manage charges and collection from customers and guests, via bank cards, credits and cash; (xi) prepare, manage, send and collect invoices or digital tax receipts; (xii) manage the credit to clients and guests for the payment of services; (xiii) prepare and manage commercial documents for clients and guests, in printed or electronic format; (xiv) manage incentives for customers and guests; (xv) manage contests in which guests and clients are invited to participate; (xvi) send promotional material, be it marketing or telemarketing, including notifications of offers, notices and/or promotional messages – which may contain information from hotel suppliers or other third parties –, which will be sent to you, unless you inform the Department of Data expressly your willingness not to receive such notifications; (xvii) prepare internal statistics that indicate the services and products most appreciated by customers, guests and other users of hotel services; (xviii) manage the entry and exit of guests and clients, based on previously defined and communicated policies; (xix) monitor and control physical and logical access to hotel facilities and assets; (xx) control visitor access; (xxi) manage security by applying the current legal regulations necessary in terms of security, hygiene and contingencies, evacuation plan and emergencies; (xxii) safeguard the valuables of guests and clients; (xxiii) safeguard, destroy, send or deliver, as the case may be, objects, documents and payment instruments forgotten by clients or guests; (xxiv) manage the treatment and response to complaints or claims from guests and clients through the means and supports that are provided for their presentation; (xxv) manage legal acts in order to resolve disputes arising between clients and/or guests with the hotel; (xxvi) manage the payment of compensation agreed with the insurers, on behalf of the client or guest; (xxvii) manage customer satisfaction based on surveys and knowledge of their needs and preferences, and other purposes of a nature analogous to those described above.

Likewise, HOTEL SAN FRANCISCO will implement video-surveillance cameras in its facilities for security purposes. The recordings are kept in a secure area with restricted access to managers, directors and, where appropriate, the competent authorities. Recordings are routinely destroyed unless necessary for an incident investigation or legal proceeding.

With respect to its employees, to carry out adequate internal control, as well as to make the corresponding payments derived from an employment relationship.

With respect to employee prospects, to schedule job interviews, carry out evaluations, contact them and maintain internal controls for follow-up and eventual hiring. With respect to its suppliers and clients, for purposes of identification, location, contact, shipments, making payments, collection, statistics, information on services and/or products, quality evaluation, as well as their transmission to third parties by any means permitted by law.

SAW. TRANSFER OF PERSONAL DATA TO THIRD PARTIES: HOTEL SAN FRANCISCO will not sell your personal data to third parties. In order to provide its services and carry out the processes described in number V above, HOTEL SAN FRANCISCO has entered into various commercial agreements with suppliers of products and services, both in national territory and abroad, which are obliged, by virtue of the corresponding contract, to maintain the confidentiality of the personal data provided by HOTEL SAN FRANCISCO and to observe this Privacy Notice. By virtue of the foregoing, said providers may not use the personal data provided by HOTEL SAN FRANCISCO for any other purpose than to provide the services contracted by HOTEL SAN FRANCISCO. You may also transfer your personal data to other third parties that support you to fulfill the contracts or legal relationships you have with you.

VII. RETENTION AND SECURITY OF PERSONAL DATA: HOTEL SAN FRANCISCO keeps your personal data for as long as it is necessary to process your requests for information and/or services, as well as to maintain accounting, financial and auditing records in terms of the legislation. mercantile, fiscal and administrative in force. The personal data collected by HOTEL SAN FRANCISCO is protected by appropriate administrative, technical and physical security measures against damage, loss, alteration, destruction or unauthorized use, access or treatment, in accordance with the provisions of the LFPDP and the administrative regulation derived from it. All personal data stored in electronic format is kept in confidential and secure databases. HOTEL SAN FRANCISCO evaluates its security equipment and procedures regularly and modifies them if necessary. To prevent unauthorized access or improper disclosure of personal data, and in order to maintain its accuracy, integrity, availability, and confidentiality, HOTEL SAN FRANCISCO also uses relevant legal procedures and controls in terms of the LFPDP and those provided in the administrative regulation derived from the Law. When processing patrimonial personal data, such as information related to your bank account, HOTEL SAN FRANCISCO uses a variety of technologies and procedures designed to protect your personal data, the use of usernames and secret passwords, tools computer encryption (PGP) for laptops, as well as FTPS data transfer. Such personal data is stored in computer systems protected with programs against viruses, spyware and other malicious code; additionally, it uses networks protected with firewalls, and controlled access facilities.

VII. PERSONAL DATA DEPARTMENT: HOTEL SAN FRANCISCO puts at your disposal the Personal Data Department, which will be in charge of receiving, registering and dealing with your requests to exercise your right of access, rectification, cancellation and opposition to the processing of your personal data. , as well as to limit the use or disclosure of your data, and the other rights provided for in the LFDDP. For any request, clarification or comment related to this Privacy Notice, please contact: HOTEL SAN FRANCISCO, attention to the Department of Personal Data Protection, at Av. Universidad 375, Col. Centro Cp. 78000, San Luis Potosi, San Luis Potosi, Mexico; You can also contact him via email at: sfnews@sanfranciscohotel.com.mx, at Telephone 01 (444) 8141000.IX. ARCO RIGHTS: HOTEL SAN FRANCISCO is committed to your privacy and to the fulfillment of the rights that correspond to you in terms of the LFPDP. The following rights are called ARCO Rights: RIGHT OF ACCESS: You have the right to know about the personal data referring to your person that is held by HOTEL SAN FRANCISCO and to whom it has been shared and for what purposes. RIGHT TO RECTIFICATION: You have the right to have your personal data rectified when they are inaccurate or incomplete.

RIGHT OF CANCELLATION: You have the right to request at any time that your personal data be deleted, which will happen once the blocking period has elapsed. The blocking implies the identification and conservation of your personal data, once the purposes for which they were collected are fulfilled, and its purpose is to determine the possible responsibilities in relation to their treatment, until the term of legal or contractual prescription of these. . During this period, your personal data will not be processed and after this, it will be canceled in the corresponding database. Once the data has been canceled HOTEL SAN FRANCISCO will give the corresponding notice. In the event that your personal data had been transmitted prior to the date of rectification or cancellation and continue to be processed by third parties, HOTEL SAN FRANCISCO will inform you of said request for rectification or cancellation, so that you can proceed to carry it out as well.

RIGHT OF OPPOSITION: You have the right to request at all times, whenever you have a legitimate cause, that HOTEL SAN FRANCISCO stop processing your personal data. Procedure for exercising ARCO Rights: To exercise ARCO rights, you or your representative must submit a request for access, rectification, cancellation or opposition with the following information and documentation: (i) the name of the owner and address or other means to communicate the response to your request; (ii) the documents that prove your identity (simple copy in printed or electronic format of your voter card, passport or FM-3) or, where appropriate, the legal representation of the holder (simple copy in printed or electronic format of the simple power of attorney with the autograph signature of the holder, two witnesses and the president and their corresponding official identifications - voter ID, passport or FM-3); (iii) the clear and precise description of the personal data with respect to which you seek to exercise any of the ARCO rights; and (iv) any other element or document that facilitates the location of your personal data. In the case of requests for rectification of personal data, you must also indicate the modifications to be made and provide the documentation that supports your request. HOTEL SAN FRANCISCO will respond within a maximum period of twenty days, counted from the date on which the request was received. of access, rectification, cancellation or opposition, its determination adopted, so that, if appropriate, it becomes effective within fifteen days following the date on which the response is communicated. In the case of requests for access to personal data, HOTEL SAN FRANCISCO will proceed with its delivery prior accreditation of the identity of the applicant or his legal representative, as appropriate. The aforementioned terms may be extended only once for an equal period, as long as the circumstances of the case justify it. The delivery of personal data will be free, it will only be up to you to cover the justified shipping costs or the cost of reproduction in copies or other formats. In the event that you repeat your request in a period of less than twelve months, you must cover the corresponding costs in terms of the LFPDP, unless there are substantial modifications to the privacy notice that motivate new consultations.

X. CHANGES TO THE PRIVACY NOTICE: HOTEL SAN FRANCISCO may modify this Privacy Notice at any time, in order to implement improvements or incorporate new measures provided for in the Law and other regulatory provisions, an issue for which it is suggested you review with regularly its content. Updates will be published in a local newspaper, or in other electronic media. If HOTEL SAN FRANCISCO makes significant changes, it will also notify you by other means such as sending an email.

XI. CONSENT: You provide your express consent for the collection, processing and use of your personal data in accordance with this Privacy Notice by expressing your will through a written, electronic or any other technology statement, or by voluntarily providing the requested information. You provide your tacit consent to the use of automatic data capture tools by not objecting to this privacy notice published in the local newspaper, without objecting to its content within 48 hours of its publication. You grant your tacit consent for the collection, use and disclosure of your personal data in terms of video surveillance by appearing at the HOTEL SAN FRANCISCO facilities and not objecting to the content of this Privacy Notice within 48 hours of its date. of publication. In some cases, the LFPDP allows HOTEL SAN FRANCISCO to collect, use and disclose your personal data without your consent. If HOTEL SAN FRANCISCO obtains personal information through third parties, it will require them to confirm that they have your consent for the disclosure of your personal data to HOTEL SAN FRANCISCO. You have the right to withdraw your consent regarding the collection, use and disclosure of your personal data. If you request that HOTEL SAN FRANCISCO revoke your consent, HOTEL SAN FRANCISCO will take the necessary measures to destroy or eliminate the personal data that you have provided us, with the exceptions provided in the LFPDP. Residual personal information may remain in archived or historical records. In addition, HOTEL SAN FRANCISCO does not allow the destruction of fiscal or accounting information of the transactions that may be necessary to maintain or comply with legal obligations. However, HOTEL SAN FRANCISCO will not use your personal information for other purposes once you revoke your consent.

RIGHT OF OPPOSITION: You have the right to request at all times, whenever you have a legitimate cause, that HOTEL SAN FRANCISCO stop processing your personal data. Procedure for exercising ARCO Rights: To exercise ARCO rights, you or your representative must submit a request for access, rectification, cancellation or opposition with the following information and documentation: (i) the name of the owner and address or other means to communicate the response to your request; (ii) the documents that prove your identity (simple copy in printed or electronic format of your voter card, passport or FM-3) or, where appropriate, the legal representation of the holder (simple copy in printed or electronic format of the simple power of attorney with the autograph signature of the holder, two witnesses and the president and their corresponding official identifications - voter ID, passport or FM-3); (iii) the clear and precise description of the personal data with respect to which you seek to exercise any of the ARCO rights; and (iv) any other element or document that facilitates the location of your personal data. In the case of requests for rectification of personal data, you must also indicate the modifications to be made and provide the documentation that supports your request. HOTEL SAN FRANCISCO will respond within a maximum period of twenty days, counted from the date on which the request was received. of access, rectification, cancellation or opposition, its determination adopted, so that, if appropriate, it becomes effective within fifteen days following the date on which the response is communicated. In the case of requests for access to personal data, HOTEL SAN FRANCISCO will proceed with its delivery prior accreditation of the identity of the applicant or his legal representative, as appropriate. The aforementioned terms may be extended only once for an equal period, as long as the circumstances of the case justify it. The delivery of personal data will be free, it will only be up to you to cover the justified shipping costs or the cost of reproduction in copies or other formats. In the event that you repeat your request in a period of less than twelve months, you must cover the corresponding costs in terms of the LFPDP, unless there are substantial modifications to the privacy notice that motivate new consultations.

X. CHANGES TO THE PRIVACY NOTICE: HOTEL SAN FRANCISCO may modify this Privacy Notice at any time, in order to implement improvements or incorporate new measures provided for in the Law and other regulatory provisions, an issue for which it is suggested you review with regularly its content. Updates will be published in a local newspaper, or in other electronic media. If HOTEL SAN FRANCISCO makes significant changes, it will also notify you by other means such as sending an email.

XI. CONSENT: You provide your express consent for the collection, processing and use of your personal data in accordance with this Privacy Notice by expressing your will through a written, electronic or any other technology statement, or by voluntarily providing the requested information. You provide your tacit consent to the use of automatic data capture tools by not objecting to this privacy notice published in the local newspaper, without objecting to its content within 48 hours of its publication. You grant your tacit consent for the collection, use and disclosure of your personal data in terms of video surveillance by appearing at the HOTEL SAN FRANCISCO facilities and not objecting to the content of this Privacy Notice within 48 hours of its date. of publication. In some cases, the LFPDP allows HOTEL SAN FRANCISCO to collect, use and disclose your personal data without your consent. If HOTEL SAN FRANCISCO obtains personal information through third parties, it will require them to confirm that they have your consent for the disclosure of your personal data to HOTEL SAN FRANCISCO. You have the right to withdraw your consent regarding the collection, use and disclosure of your personal data. If you request that HOTEL SAN FRANCISCO revoke your consent, HOTEL SAN FRANCISCO will take the necessary measures to destroy or eliminate the personal data that you have provided us, with the exceptions provided in the LFPDP. Residual personal information may remain in archived or historical records. In addition, HOTEL SAN FRANCISCO does not allow the destruction of fiscal or accounting information of the transactions that may be necessary to maintain or comply with legal obligations. However, HOTEL SAN FRANCISCO will not use your personal information for other purposes once you revoke your consent.

XII. APPLICABLE LEGISLATION: The interpretation and application of this Privacy Notice is governed by the Federal Law on Protection of Personal Data Held by Private Parties, the Federal Civil Code, and other applicable laws and regulatory and administrative provisions.

XIII. VALIDITY: This Privacy Notice is effective as of its publication date, as provided in the Third and Fourth Transitory Articles of the LFPDP.