A. Identity and address of Controller.
In accordance with the provisions of the Federal Law for the Protection of Personal Information Held by Third Parties (LFPD – Mexican acronym) and other applicable regulations, Administración Riviera Resorts, S. A. de C.V. (hereinafter commonly referred to as “Grupo Palace Resorts” or “Controller”, whose domicile to hear and receive communications is: Carretera Cancún Puerto Morelos km 21, Manzana 01, Lote 1– 11, Edificio A, Supermanzana 47, Municipio Benito Juárez, Cancún, Quintana Roo, C.P. 77506, expressly states:
B. Personal information collected and processed.
For the purposes described in this Privacy Notice we collect the following types of personal information:
1). Identifying information
2). Personal characteristics
3). Social environment
4). Academic and professional
5). Employment 6). Income, finances or insurance
6). Sensitive personal information (Health) The Owner [of such information] will be responsible for informing all third parties (family or friends) whose information they provide for identification purposes on the content of this General Privacy Notice and that Grupo Palace Resorts® will process such information.
C. Processing of sensitive personal information.
Health information. Controller may collect personal information considered legally as sensitive.
Therefore and considering Grupo Palace Resorts® participation in university field programs, we require your express written consent to process such health information:
I hereby consent that Controller may process my personal sensitive information for the indicated purposes.
D. Purpose of processing.
a. Relevant and necessary purposes
1. Administration, management and control of Collaboration Agreements executed by Grupo Palace Resorts® with different universities so that students may perform their professional internships, field practices, observation and study visits, stays, residencies and conferences.
2. Administration, management and control of activities and work performed by university students participating in official programs with Grupo Palace Resorts®.
3. Evaluation and accreditation of students during their professional internships.
4. Statistics and historical records of university internships and residencies.
b. Additional purposes
1. Evaluation of results so that all personal information may be added to other Grupo Palace Resorts® open selection processes.
E. Additional purposes.
Do not add my personal information to other Grupo Palace Resorts® open selection processes. You may revoke your consent to the processing of personal information for the additional purposes indicated herein. This can be done using the same mechanisms indicated in this Privacy Notice and pursuant to applicable legislation.
F. Sharing of personal information.
Your personal information (including sensitive information) may be shared and processed by other than Grupo Palace Resorts®, in the following circumstances:
1. Controlling companies, subsidiaries or affiliates of Grupo Palace Resorts®; for the purpose of centralized information storage or for its use in open selection processes with other Grupo Palace Resorts® companies.
2. Persons subject to medical secrecy privileges or equivalent obligations, in the event that transferring your personal sensitive information on your present and future health to third parties legally authorized to handle such, either because such information is essential for medical treatment, prevention, diagnosis, health assistance, medical treatments or health services management, when the owner of such information is not in condition to grant such consent, under the terms set by the General Health Law and other legislation.
3. Universities and Learning Centers, to provide them with personalized evaluations and results on students who participated in internships or programs coordinated by Grupo Palace Resorts®.
G. Consent to information sharing.
Under all legally admissible circumstances you may at any time exercise your right to access, rectify, cancel and oppose information (ARCO rights) by following the procedures we have implemented. In all other cases, your personal information will not be transferred to third parties without your consent except under the exceptions provided in article 37 of the LFPD, and in all cases in compliance with the conditions of article 37 of the LFPD Regulations.
H. Exercise of ARCO rights.
Under all legal circumstances you may exercise your rights to access, modify, cancel and oppose information (ARCO rights) using the legal procedures we have set up.
All such requests should be sent in writing to the address indicated in paragraph A of this Notice addressed to our Controller of Personal Information, and they should comply with the applicable legal requirements Information requests should contain the following:
I. Your name and address or other means of providing you with a response.
II. Valid identification documents or power of attorney, as the case may be.
III. A clear and precise description of the personal information on which you wish to exercise your ARCO Rights; and
IV. Any other element or document that could facilitate locating your personal information. Controller will answer you with a decision within 20 business days counted from the date on which your request is received. If the request is admissible it will be put into effect within 15 business days following the date on which Controller advises you of the decision. In the event that the information you provide is incorrect or insufficient, or if you fail to send the necessary identity documents or power of attorney, Controller will ask that you correct such deficiencies within five business days after receiving your request and you will have 10 business days to comply, counted from the day after you receive such notice.
The process will be terminated if you do not answer within the required time. You can obtain the requested personal information in the form of plain copies or electronic documents in common formats (Word, PDF, etc.), by means of authorized restricted access to the databanks (access) containing your personal information or by any other legal means that guarantee and evidence the exercise of the requested right. Alternatively, after fulfilling all the above-mentioned requirements, the Owner may submit their request by e-mail to firstname.lastname@example.org and indicating “ARCO Rights and/or Consent Revoked” in the Subject line. Response times will remain the same as those mentioned in the immediately preceding paragraph.
The use of electronic media in the exercise of ARCO rights authorizes Controller to answer the request using the same media unless the petitioner specifically requests another format. You will be responsible for maintaining your personal information in possession of Controller updated. Therefore, under all circumstances you are responsible for the truth, accuracy, validity and quality of the personal information you provide, and you hereby undertake to keep such information updated by informing Controller of any changes.
I. Revoking consent.
You may revoke your consent to have your personal information processed, non-retroactively, in all cases in which said revocation does not make it impossible to fulfill any obligations arising from the legal relation in effect between you and Controller. The process for revoking consent will be the same as the one established in the immediately preceding section on how to exercise your ARCO rights.
J. Limitations on the disclosure of your personal information.
You may limit the use or disclosure of your personal information by sending our Personal Information Department a request to that effect. The requirements for personal identification and the procedure for answering your request remain the same as those indicated in the section on “Exercise of ARCO Rights”. Controller has the ability and means to ensure that some of your information is included in a Personal Exclusion List, on condition that you expressly request the inclusion of such information in said list. Controller will then issue to all registered owners of such information a letter certifying their inclusion in said list.
K. Modification or updating of this General Privacy Notice.
December 1, 2016