PRIVACY NOTICE

Comercializadora Access del Puerto, S.A. de C.V.

1. Identity and address of the responsible entity:

COMERCIALIZADORA ACCESS DEL PUERTO, S.A. de C.V., commercially known as MARIVAL ACCESS, a commercial corporation of mexican nationality, with its address in Paseo de los Cocoteros s/n, inside Marival Emotions Resort & Suites, in Nuevo Vallarta, municipality of Bahia de Banderas, Nayarit, Mexico, 63735, telephone number 322 226 82 00, extension 4577, website www.marivalaccess.com, is responsible for the use and protection of your personal data, pursuant to that we hereby inform you as follows:

2. With what purposes we will use your personal data?

The personal data we collect from you, will be used for the following primary purposes, which are necessary for the service that is being requested.

a) As a Customer, the following primary purposes will apply to you:

To affiliate you to the Marival Access program
To open, operate, administer and manage your account as a participant of the Marival Access program
Accumulate Marival Access points for the purchases you make in the establishments owned by the companies that are part of the group commercially known as Marival Group.
For the emission and shipping of the cards from the Marival Access Program.
To include you in our registry of affiliated companies, as well as to manage your file as a customer.
For your attention in case of health or safety incidents.
For the billing and collection of the contracted services, marketing management in general, which may include in a declarative but not restrictive manner: graphic design services, web design, social media, email marketing, and other services.
For your security during your stay at Marival® Access, we establish security measures and surveillance of the facilities, including monitoring, video cameras, control and surveillance of physical and logical access.
To keep you updated about the offers and promotions that from time to time are made by the businesses affiliated to Marival Access
Any other means of handling your data deriving from your character as a customer, visitor or user of our websites, such as invoicing, processing orders and integrating administrative files as documental support or in other nature about the commercial relation that exists with you

b) Particularly as employee or candidate to obtain a job with Comercializadora Access del Puerto, S.A. de C.V., the following primary purposes will apply to you:

For identification, verification and contact.
For your safety during your stay at Marival® Emotions Resort & Suites, we establish security measures and surveillance of the facilities, including monitoring, video cameras, control and surveillance of physical and logical access.
For the analysis, study and processing of your job application and other procedures related to the recruitment, selection, hiring and training of personnel.
Integration of your employee file.
For hiring and/or job promotion processes.
For performing socioeconomic and psychometric studies.
For granting labor benefits
For making job offers and job opportunities in the establishments to which the company renders its services.
For the payment of wages and other benefits established in the Federal Labor Law and individual or collective labor agreements.
For making a database for the prevention of the spread of COVID 19 and / or any other type of future health emergency, whose objective is to identify cases of risk of contagion of this virus, to protect the health of the staff of Comercializadora Access del Puerto, S.A. de C.V.
For processing registrations, modifications, payment of discounts or the corresponding downsizings before the Mexican Institute of Social Security, Institute of the National Fund for the Consumption of Workers, Institute of the National Fund for Workers' Housing and contracting of insurance of private medical expenses in favor of its employees.
Establishing, managing and operating of savings banks where the employees of Comercializadora Access del Puerto, S.A. de C.V. participate.

c) Particularly, as a Supplier of Comercializadora Access del Puerto, S.A. of C.V., the following primary purposes will apply to you:

For identification, verification and contact.
For your safety during your stay at Marival® Emotions Resort & Suites, we establish security measures and surveillance of the facilities, including monitoring, video cameras, control and surveillance of physical and logical access.
For the elaboration of contracts for the provision of services.
For the fulfillment of contractual obligations.
For the processes of payment, reception and / or return of goods and services acquired.
For the processing of orders and integration of administrative files as documentary or other support regarding the existing commercial relationship with you

Marival Access is a commercial program of rewards for its participants through the purchases and consumptions that are made in the participating establishments. For these purposes, it is necessary that you allow us to contact you to keep you updated about program offers and promotions.

Additionally, we will use your personal information for the following secondary purposes that are not necessary for the requested service, but that allow us and facilitate us to provide you a better service:

Marketing and advertising.
Commercial prospection.
Quality control.
Definition of consumer behaviors.
Carrying out feedback campaigns and data updates.

You have the right to oppose us contacting you with marketing, advertising or commercial prospecting purposes, but in this case, we might not be able to provide you with access to all the benefits of the Marival Access program.

In case you do not wish your personal data to be used for these secondary purposes, we hereby ask you to let us know that fact by sending an e-mail to the address [email protected], to orient you about the corresponding procedure.

3. What personal data will we use for those purposes?

To carry out the purposes described in this privacy notice, we will use the following personal data:

a) Identification data: Name, last name, signature, photograph identification document, proof of fiscal situation, Sole Code of the Population Registry (CURP).

b) General data: Full address, either home or work address, personal or work e-mail; home or work telephone number; cellphone number, Nextel ID (when applicable) and fax number, date of birth, age, marital status and nationality.

c) Tax information: Code of the Federal Taxpayers Registry (RFC), as well as tax address and tax regime (when applicable).

d) Data linked to bank accounts, credit and/or debit cards, name of the owner of the account, account number and bank of origin, CLABE (when applicable), credit card number; expiration date of the card, type of card. All this data will be stored with your express consent, and in the event that you inform us of your opposition, we could be prevented from providing the services that were contracted, since it could not be possible to process the corresponding payment.

e) Sensitive personal data: Marival Access collects the following sensitive personal data and purposes:

Personal health data: to provide medical or first aid care and services, for protecting people's health in emergency situations (including COVID-19 and / or any other type of health emergency).
Complementary data to integrate your employment file, which are necessary for the employment relationship and to ensure your safety, well-being and health inside the work establishment. Such data may be the following: biometric data, health data, ideological personal data (only union memberships).

These personal data at no time and under no circumstances will be shared, except for personal health data, which will only be transmitted to medical institutions and other persons involved in emergencies where the owner of the personal data or relatives are at risk, or to provide care of health and hygiene programs of interest that are of interest to the associate.

f) Employment data: We will require data from your past jobs, such as: position, activities, name of the institution and other data of the institution, number of direct reports, salary, benefits, name of your supervisor and other data that allow us to know your experience and employment history.

g) Academic data: We will request information about your education, institutions in which you studied, term of your studies and academic degrees received and studies you currently do.

h) Personal Data from sources of public access and received via consented transfers: resulting from public registers, directories, social networks and other lawful sources available in the market, as well as personal data shared by third parties you previously authorized.

i) Personal data of third parties: You agree and acknowledge that, to obtain references from you about your work experience, identity and the veracity of the data you provided, we will ask you for personal references. For such purposes you represent and acknowledge that you have the authorization of the owner of the personal data to transfer their personal data as personal references, Comercializadora Access del Puerto, S.A. de C.V., will only and exclusively use that data for these purposes and not for any other particular purpose.

j) Personal data from Employment Agencies: Comercializadora Access del Puerto, S.A. de C.V., may receive your personal data when you had registered your data in an employment or placement agency to which you have consented to transfer your personal data. In these cases, Comercializadora Access del Puerto, S.A. de C.V., compels itself to treat your personal data in accordance with the privacy notice of said employment or placement agency, always in compliance with the Federal Law on Protection of Personal Data Held by Private Parties, with the understanding that once you authorize Comercializadora Access del Puerto, S.A. de C.V., to treat your personal data, such treatment will be subject to this privacy notice.

k) Personal data from sources of public access and received through consented transfers; coming from public records, directories, social media and other licit sources available in the market, as well personal data that had been shared by third parties to which you previously authorized.

l) Personal data from social media: MARIVAL ACCESS could collect and process personal data and information you shared on social media property of MARIVAL ACCESS (such as Facebook®, Instagram ®, Pinterest ®, Foursquare ®, Google ® and Twitter®, among others), particularly that information you shared in the MARIVAL ACCESS profile in such social media or in the profile of other companies related to MARIVAL ACCESS, including the information you shared as “public”, as established in the terms and conditions of use and policies and recitals of each social media.

m) Personal data collected from subsidiary companies with which you have a contractual relation and which you have authorized to transfer such information to Comercializadora Access del Puerto S.A de C.V.

The personal data described in the paragraphs listed before in this section, are collected through: i) the use of formats or printed documents; ii) use of e-mails and/or iii) the voluntary provision of information and personal data that when you stay in our facilities, when you communicate by phone with us or with our staff (including the department of customer service); iv) by our website, as well as v) the use of sources of public access and other sources available in the market and vi) the profiles on social media of Marival Access.

The personal data collected by MARIVAL ACCESS is protected by security measures: administrative, physical and technical, adequate against the damage, loss, alteration, violation, destruction, use, access or un-authorized processing, in accordance with the provision set forth in the Federal Law of Personal Data Protection in Possession of Private Parties (“LFPDPPP”) and its regulations. To know more about our security measures, we ask you to contact us at [email protected].

4. How do we protect your personal data?

The personal data collected by Comercializadora Access del Puerto, S.A. de C.V. is protected by adequate security, administrative and physical measures against damage, loss, alteration, destruction, use, unauthorized or illegal access or treatment, disclosure, and against loss, damage or alterations or accidental destruction, in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties ("LFPDPPP") and its Regulations. To learn more about our security measures we ask you to contact us via email at [email protected].

We strive to store your personal data in secure operating environments that are not accessible to the general public, and to implement physical, technical and administrative security measures in our physical facilities and informational technology to protect against the loss, misuse or alteration of your personal data by our employees or third parties.

However, it is not possible to guarantee 100% the security of any data transmission over the Internet or any data storage environment, so we cannot assure you in absolute terms that the personal data you provide to us is protected at all times. Comercializadora Access del Puerto, de C.V. asks you to inform us if you experience any unusual event that may indicate a security breach of your information; In the same way, you will be notified in case of any incident or vulnerability detected by Comercializadora Access del Puerto, S.A. de C.V., within the established deadlines and means designated by the applicable regulations. In that case, we will endeavor to investigate whether this fact was related to the transmission of data whose origin or destination is www.marivalaccess.com, and we will inform you about the measures you can take and that have been taken to help correct the problem.

5. Information relating to minors:

www.marivalaccess.com, is a site for the general public and does not offer services directed to minors.

In the event that Comercializadora Access del Puerto, S.A. de C.V. is informed, or detects, that a person under the age of 13 has sent us personal information, we will delete or destroy such information as soon as reasonably possible.

6. With whom will we share your personal information and for what purposes?

We inform you that your personal data can be transferred to third parties inside and outside the national territory in case it is necessary to carry out the purposes set forth in this privacy notice.

Also, we inform you that Comercializadora Access del Puerto, S.A. de C.V., is part of a corporate group commercially known as “MARIVAL GROUP” and is possible that it transfers your personal data with other companies of the same group, in terms of the provisions set forth on Article 37 of the LFPDPPP regarding the related parties. The companies that are part of the group are:

Rinoval de México, S.A. de C.V.,
Operador Hotelero Distinct Luxury Residences, S. de R.L. de C.V.
Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V.
Administraciones Profesionales de Vallarta, S.A. de C.V.
Vacation Club Services, S.A. de C.V.,
Operadora y Comercializadora Turística, S.A. de C.V.,
Travel Marketing 500, S. de R.L. de C.V.,
Desarrollo Transimar, S.A. de C.V.,
Destiladeras Resort Operations, S.A. de C.V.,
Fundacion Senador Pietro Rizzuto, A.C
Delicias Narezushi, S.A. de C.V.
Mobile Sail Technologies, S.A. de C.V.
Constructores y Desarrolladores Inmobiliarios de la Bahía, S.A. de C.V.,
Serviventas de México, S.A. de C.V.,
Servicios Terrestres del Nayar, S.A. de C.V.

We will also share your personal data with independent third parties with which we are required to interact in order to perform the purposes set forth herein. Said independent third parties, especially include bank institutions that process your payments. This transfer in some cases will be optional and you will be able to oppose it at any moment.

The third parties with which we will share your personal data can be:

Third party	Country	Purpose	Type of transfer
Bank Institutions	Mexico	Payment processing.	Voluntary I authorize this: Yes_____ No_____
Tax Administration Service (“Servicio de Administración Tributaria”)	Mexico	To comply with the current tax provisions thru filing the periodic tax returns	Obligatory
Federal Consumer Protection Agency (Procuraduría Federal del Consumidor)	Mexico	Undertaking procedures provided by the Federal Consumer Protection Act	Obligatory
Zinrelo, INC.	United States of America	Manager of the Marival Access loyalty program	Obligatory
INFONAVIT	Mexico	Institute affiliation, and other actions related to its financing.	Obligatory
FONACOT	Mexico	Institute affiliation, and other actions related to its financing.	Obligatory
IMSS	Mexico	Social Security compliance established by law.	Obligatory
Authorities at the federal or state level for labor and social benefits.	Mexico	Obligation compliance of the relation worker -employer.	Obligatory
Judiciary authorities.	Mexico	Attention and compliance of judicial authority requirements.	Obligatory

Finally, we point out that we will transfer your data nationally or internationally, in the cases contemplated by article 37 of the LFPDPPP, in force in Mexico, which expressly establishes the possibility of sharing your data with competent authorities and controlling companies, subsidiaries or affiliates under the common control of the responsible party, or to a parent company or any company thereof, in the following cases:

When the transfer is provided for in a law or treaty to which Mexico is a party;
Where the transfer is necessary for medical prevention or diagnosis, providing health assistance, medical treatment or the management of health services;
When the transfer is made to holding companies, subsidiaries or affiliates under the common control of the responsible party, or to a parent company or any company of the same group of the responsible party that operates under the same internal processes and policies;
When the transfer is necessary by virtue of a contract in force or to be entered into in the interest of the owner of the personal data, by the responsible party and a third party;
When the transfer is necessary or legally required for safeguarding a public interest, or for the prosecution or administration of justice;
When the transfer is necessary for the recognition, enforcement or defense of a right in a judicial process, and
When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the responsible party and the owner of the personal data.

7. Storage periods:

Comercializadora Access del Puerto, S.A. de C.V., will keep personal data for as long as necessary to fulfill the purposes for which it has collected the information, including the purposes to satisfy any legal, accounting and reporting requirements, in accordance with the provisions of article 37, of the LFPDPPP Regulations, in force in Mexico.

For the purpose of determining the appropriate retention period, we take into account the amount, nature and degree of confidentiality of the personal data, the potential risk of harm arising from the unauthorized use or disclosure of your personal data, the purposes for which we processed such data and whether we can achieve those purposes by other means, as well as the legal provisions in force.

8. How can you access, rectify or cancel your personal data or oppose its use?

You have the right to know what personal data we have from you, for what purposes we will use it (primary and secondary purposes) and the use conditions that we give to it (Access). Likewise, is your right to request the correction of your personal information in case it is not updated, is inaccurate or incomplete (Rectification); for us to eliminate from our records or data bases when you considerer that such information is not being used adequately (Cancellation); as well as to oppose to the use of your personal data for specific purposes (Opposition); or, to revoke your consent to the use or disclosure of your personal data (Revocation). These rights are known as ARCO rights

With regards to the procedure and requirements to exercise your ARCO rights, we hereby inform you as follows:

a) What information, documentation and requirements will the application have to include?

Regarding the general requirements that must be contained in the application, these are as follows:

Name of the owner of the personal data.
Documents that prove the identity of the owner (passport, voting credential issued by the National Electoral Institute, professional state or federal credential or driver’s license).
When applicable, name of the owner’s representative and documents to prove his/her identity and capacity. Pursuant to the agents of individuals, the representation will be proven through the following 3 options: a) public deed (document issued by a Notary Public), b) proxy signed before two witnesses (attaching a simple copy of their official identification documents), c) appearing yourself and your representative to declare before the responsible, presenting your official identification (passport, voting credential issued by the National Electoral Institute, professional state or federal credential or driver’s license).
Address or any means to receive notifications.
Clear and precise description of the personal data and the right that is intended to exercise or of what is being requested.
The documents or information that help us to identify the information subject matter of the request (for example Access client number, full name, e-mail address recorded in the system).

Likewise, pursuant to the type of request, we require you please to indicate the following additional information, in order for your request to be processed in a more efficient manner:

Access request: Indicate the method in which you prefer the requested personal data to be reproduced.
Rectification request: Specify the modifications that are requested for the personal data, as well as providing the documents that support such request.
Cancellation request: To appoint the causes that motivate the request of eliminating the data from the files, registries or data bases of the responsible party.
Opposition request: Manifest the causes or the situation that caused the owner to request the treatment of his or her personal data to conclude, as well as the damage that would be caused in case such treatment continues. In case that the request is regarding a treatment in particular, the specific purposes to which the exercise of the right is being requested, must be indicated.
Revocation of consent: You can revoke the consent that, where appropriate, you granted us for processing your personal data. However, it is important that you bear in mind that not in all cases we will be able to comply with your request or stop its use immediately, since it is possible that due to some legal obligation we are required to continue processing your personal data. Likewise, you should consider that, for certain purposes, the revocation of your consent will mean that we can no longer provide the service you requested, or the conclusion of your relationship with us.

b) Through what means can the owner prove his or her identity and, when applicable, his or her representative, as well as the capacity of the latter?:

To exercise any of the ARCO rights, you must file the corresponding request through the following means:

By e-mail to the address [email protected] or also you can contact our Personal Data Department for it to process your request, provide you orientation and provide you the corresponding form. The address of our Personal Data Department is Paseo de los Cocoteros s/n, hotel Marival Emotions Resort & Suites, Nuevo Vallarta, municipality of Bahía de Banderas, Nayarit, zip code 63735, telephone number 322-2268200 (extension 4493).

The official form for processing ARCO requests for Marival Access, can be downloaded in the following link [www.marivalaccess.com]

c) In how many days will we respond to your request?

20 business days (all days of the year, except for Saturdays, Sundays and holidays provided by law):

d) Through which means will we communicate the response to your request?

Through email or through the contact information you provide us in your request.

e) Through which means can the personal data I request be reproduced (when applicable)? In the same manner in which it had been provided by the client.

f) We hereby place at your disposal the following forms or systems to facilitate the exercise of your ARCO rights:

The corresponding forms or systems and orientation about the exercise of the ARCO rights can be obtained contacting our Department of Personal Data in the e-mail address [email protected] and physical address in Paseo de los Cocoteros s/n, hotel Marival Emotions Resort & Suites, Nuevo Vallarta, municipality of Bahía de Banderas, Nayarit, zip code 63735, telephone number 322-2268200 (extension 4493), or you could download them from the following link: [www.marivalaccess.com]

g) Is there any cost for exercising my ARCO rights?

The exercise of the ARCO rights is free. However, you can be required to cover only the justified costs of shipping or the cost of copies or other formats. Likewise, if the same person reaffirms the request in a time frame shorter than 12 months, the costs will not be bigger than three days of the General Minimum Salary in force in Mexico City, unless there are substantial modifications to the privacy notice that motivate new consultations.

h) What happens if a request is incomplete or all the data that is included in the procedure is not attached?

In case that your request does not have the information described on section 4 Requirements (paragraph a and b); Marival Access will be able to request the owner to provide the missing information, through a writ named “prevention”, which will have to be issued in the maximum term of 5 business days starting the day after the request was filed.

The owner will have 10 business days, after receiving the “prevention”, to provide the required information, since on the contrary, such request will be considered as if it was not filed.

For more information about the procedure, we place to your disposal the following means: to e-mail address: [email protected]

The contact information of the person or personal data department, which is in charge of processing the requests of ARCO rights, are the following:

a) Name of the person or department of personal data: Department of Protection of Personal Data, Marival Group.

b) Address: Paseo de los Cocoteros s/n, inside Marival Emotions Resort & Suites, Nuevo Vallarta, municipality of Bahía de Banderas, Nayarit, Mexico, 63735

c) E-mail: [email protected]

d) Telephone number: 322-2268200, extension 4493.

9. How can you limit the use or disclosure of your personal information?

With the purpose of you being able to limit the use and disclosure of your personal information, we hereby offer you the following means:

The client can limit the use and release of his or her personal data, by sending an e-mail making the concrete description to the following e-mail address [email protected].

Additionally, we inform you that we have the following exclusion listings, in which you will be able to subscribe or unsubscribe in our dispatch platforms, for your personal data not to be treated for certain purposes (mainly secondary):

Name of the listing	Applicable purpose	Means to obtain more information
Marketing	Marketing or advertising	[email protected]
Marketing	Marketing or advertising	[email protected]

10. The use of tracking technologies in our Internet website:

We inform you that in our website we use cookies and other technologies through which it is possible to monitor your behavior as an internet user, as well as to provide you a better service and experience while browsing our website. For more information, please consult our Cookies Policy.

These technologies can be enabled by following the following steps: you can change the permits of your browser for accepting or blocking cookies.

For more information it is suggested to make a search in google with the phrase “how to manage cookies in [name of the applicable browser]?”.

11. How can you know about changes to this privacy notice?

This privacy notice can be amended, modified or updated due to new legal requirements; of our own needs due to the products or services we offer; of our privacy practices; of changes in our business model, or due to other causes.

We are committed to keep you informed about the changes that this privacy notice might suffer, by: sending an e-mail and posting it on the website.

The procedure through which the notifications about the changes or updates to this privacy notice will be made, is the following:

The changes or updates to the privacy notice will be informed by the means described herein and will be effective 1 week afterwards. In case of any doubts or comments, the clients must address them to [email protected]

DISCLAIMER.- This is a courtesy English translation. Should any conflict or controversy result between the Spanish and the English version, the Spanish version shall prevail.

Last Update: 18/04/2023