PRIVACY NOTICE

HOTEL CASA LOTERÍA SAYULITA

In accordance with the provisions of Articles 15, 16, and related articles of the Federal Law on the Protection of Personal Data Held by Private Parties, HOTEL CASA LOTERÍA SAYULITA provides the following privacy notice:

I. The identity and address of the responsible party collecting the data:

ZAGAPE S.A. DE C.V. is a legal entity constituted under Mexican law and will be referred to as HOTEL CASA LOTERÍA SAYULITA. This entity is responsible for collecting, protecting, and preserving personal data, including sensitive, patrimonial, and financial data. The primary purpose of the company is to provide lodging services to third parties.

The address for receiving all types of notifications is Playa Azul 10, in Sayulita, Bahía de Banderas, Nayarit.

II. How personal data is obtained:

We may obtain information through the following means:

1. Directly provided by you in writing;

2. Verbally;

3. Internet or electronic forms;

4. Telephone services;

5. Through surveillance cameras in public areas;

6. Any other means permitted by law.

III. The data we collect:

The data we obtain from individuals wishing to stay at HOTEL CASA LOTERÍA SAYULITA, hereinafter referred to as "GUESTS," to fulfill the purposes established in this notice, includes:

1. Full Name;

2. Nationality;

3. CURP (Unique Population Registry Code of Mexico);

4. Age;

5. Gender;

6. Date of birth;

7. Place of birth;

8. Home address;9. Phone number;

10. Email address;

11. Autograph signature;

12. Photograph and image;

13. Vehicle entering the parking lot;

14. Vehicle license plates;

Personal Data we collect from SERVICE PROVIDERS:

1. Full Name;

2. Nationality;

3. CURP;

4. Business name;

5. Purchasing contact;

6. Email address for electronic banking payments.

In accordance with applicable law, we consider that you have implicitly granted us your consent regarding your personal data mentioned above.

You can object at any time by following the procedure outlined in section VI, entitled "Means to Exercise ARCO Rights," of this privacy notice.

Additionally, we will collect financial data as follows:

1. Banking institution for payments;

2. Credit or debit card number;

3. Bank account number;

In case of requesting financial data, we will obtain your express consent for their treatment in accordance with applicable legislation. We will provide you with forms for your signature.

IV. Purposes for processing data:

The personal data of the holder will be used by HOTEL CASA LOTERÍA SAYULITA for the following purposes, as the entity responsible for protecting your personal data:

1. Purposes aimed at "GUESTS"

a. Providing contracted services;

b. Supplying purchased products;

c. Fulfilling contractual obligations;

d. Sending invoices;

e. Following up on the collection process;f. Any other purpose compatible or analogous to the previously established purposes.

2. Secondary Purposes:

Additionally, we will use your personal information for the following secondary purposes, which are not necessary to provide the requested service but allow us to offer better attention:

a) Quality evaluations of contracted services or products.

If you do not wish for your personal data to be processed for these secondary purposes, you may submit a written request as outlined in chapter VI of this privacy notice.

Refusal to use your personal data for these purposes will not be a reason to deny you the services you request or contract with us.

V. Options and means offered to limit the use or disclosure of data:

HOTEL CASA LOTERÍA SAYULITA is committed to safeguarding your information under strict security measures to ensure its confidentiality. Security standards have been established in administrative, legal, and technological areas to prevent unauthorized third parties from accessing your personal data.

It is worth mentioning that the holder of the personal data may initiate a procedure for Access, Rectification, Cancellation, or Opposition (ARCO) to limit the use or disclosure of their data as outlined in chapter VI of this notice.

VI. Means to exercise ARCO rights regarding personal data:

You may revoke the consent you have given us for the processing of your personal data. However, please note that we may not be able to fulfill your request or immediately stop using your data in all cases, as we may be legally required to continue processing your data. Also, consider that revoking your consent for certain purposes may mean we can no longer provide the service you requested, or it may result in the termination of your relationship with us.

The holder may exercise their rights of rectification, access, cancellation, or opposition to the processing of their data by submitting a request according to the following procedure:

Send your request via email to: admon.zagape@gmail.com addressed to the administration department, or contact +52 322 236 4785, responsible for handling your requests.The data and documentation that must be attached to your request, according to

Article 29 of the applicable legislation, are:

a. The name of the holder of the personal data, their address, and an alternative means to communicate the response to their request.

b. Documents proving the identity of the holder of the personal data or, if applicable, the legal representation.

c. A clear and precise description of the personal data for which you seek to exercise ARCO rights; and

d. Any other element or document that facilitates locating your Personal Data; and

e. For requests for data rectification, the holder must indicate the modifications to be made and provide supporting documentation.

f. In case of doubt about your identity, HOTEL CASA LOTERÍA SAYULITA reserves the right to request any other document to verify

your identity.

If any information is missing from your request, you will be asked to provide the missing information as soon as possible. If the documentation contains erasures, alterations, or reasonable doubts about being apocryphal or if the legal representative is not the legitimate representative of the data holder, you will be asked to present the original or certified copies at the responsible office.

If all formalities required for the procedure are met, a response will be provided within twenty days from the date the request was received or from the date the prevention has been fully corrected. The above-mentioned period may be extended once for anequal period, as justified by the circumstances of the case, in accordance with Article 32 of the applicable law.

VII. Transfers of data that may be made:

We inform you that HOTEL CASA LOTERÍA SAYULITA does not transfer information to third parties without your express prior authorization.

Transfers may only be made without your consent as provided in Article 37 of the Federal Law on the Protection of Personal Data Held by Private Parties, in the following cases:

a. When the transfer is provided for in a law or treaty to which Mexico is a party;

b. When the transfer is necessary for medical diagnosis, health care, medical treatment, or management of health services;

c. When the transfer is made to controlling, subsidiary, or affiliated companies under the common control of the responsible party, or to a parent company or any company of the same group operating under the same processes and internal policies;

d. When the transfer is necessary by virtue of a contract entered into or to be entered into in the interest of the holder, by the responsible party and a third party;

e. When the transfer is necessary or legally required to safeguard a public interest, or for the procurement or administration of justice;

f. When the transfer is necessary for the recognition, exercise, or defense of a right in a judicial process; and

g. When the transfer is necessary for maintaining or fulfilling a legal relationship between the responsible party and the holder.

VIII. Means and procedure by which the responsible party will communicate changes to the privacy notice, in accordance with applicable law.

HOTEL CASA LOTERÍA SAYULITA reserves the right to make modifications and additions to this privacy notice at any time.

All modifications will be notified by an announcement on the website where this document is contained.

Publication date: July 2024