Privacy Notice

1. Personal Data Subject to Processing

In accordance with the provisions of the Law, the processing of personal data will be carried out under the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility. Exotic Travelers will only collect and process such personal data as are necessary, adequate, and relevant for the fulfillment of the purposes described in this Privacy Notice.

Likewise, appropriate administrative, technical, and physical security measures will be adopted to guarantee the confidentiality, integrity, and availability of the information, as well as to prevent its damage, loss, alteration, misuse, unauthorized access, or unlawful disclosure.

The personal data that may be collected include:

• Identification and contact data: full name, date of birth, nationality, marital status, address, telephone number, e-mail, official ID with photograph, passport or visa.
• Membership data: membership number, membership contract, usage history, and validity.
• Employment and financial background: occupation, declared income, personal references, information regarding assets or property.
• Financial and payment data: tax ID (RFC), payment method, credit/debit card numbers, bank accounts, direct debit data, payment receipts, electronic invoices.
• Reservation and stay data: check-in and check-out dates, services contracted (spa, tours, gastronomic experiences, transportation, recreational, sports, or cultural activities).
• Consumption and activities: history of expenses at hotels, restaurants, bars, stores, and activities exclusive to the Club.
• Companions and emergency contacts: name, relationship, and contact details.
• Sensitive data (only when strictly necessary): health conditions, allergies, dietary or accessibility restrictions, medical or travel insurance included in the membership.

The processing of sensitive data will only be carried out with the express consent of the data subject, applying enhanced security measures, except in cases provided for by the Law.

2. Purposes of Processing

In compliance with the Law, the personal data collected will be processed only for purposes that are necessary, adequate, and relevant according to the relationship you maintain or may maintain with Exotic Travelers.

For purposes of transparency, such purposes are classified as primary purposes, which are essential to fulfill the legal relationship and corresponding legal obligations, and secondary purposes, which are additional or complementary uses for which you may express your refusal at any time.

a) Primary Purposes (necessary for the member relationship):

• Verify identity and formalize the execution of the membership contract.
• Manage payments, financing, direct debit arrangements, and invoicing.
• Administer access to member benefits, preferential rates, and discounts.
• Manage reservations, transportation, spa services, tours, preferential check-in and check-out.
• Coordinate gastronomic, cultural, sports, aquatic, and recreational experiences.
• Provide preferential attention at hotels and affiliated destinations.
• Maintain a record of members with consumption and service history.
• Comply with legal, fiscal, regulatory, security, and immigration obligations.
• Provide medical assistance in case of emergencies, pursuant to insurance included in the membership.

b) Secondary Purposes (optional):

• Send service quality and satisfaction surveys.
• Prepare statistical reports and consumption metrics.
• Communicate promotions, discounts, packages, and exclusive experiences.
• Invite members to social, cultural, and entertainment events organized by the Club or its affiliates.
• Share updates on destinations, openings, improvements to facilities, or additional benefits.

Note: If you wish to object to the processing of your personal data for secondary purposes, you may do so by sending an e-mail to memberservices@exotictravelers.com or by calling +1 213 221 0116. The party responsible for the processing and protection of your personal data is LT Brands, S.A. de C.V., through its Data Protection Department, at the domicile indicated above.

3. Transfers of Personal Data

In compliance with the Law, we inform you that your personal data may be transferred, within and outside Mexico, to third parties other than the data controller, only when such transfers are necessary to comply with a legal relationship, to comply with legal obligations, or when required by competent authorities. In all cases, the recipients of the data will assume the same security and confidentiality obligations as the data controller, limiting its use solely and exclusively to the purposes that justify the transfer.

Your data may be transferred in the following cases:

In cases where the transfer of personal data does not fall within the assumptions provided for by the Law (Arts. 35 and 36), we will obtain your prior express consent.

4. ARCO Rights

You have the right to Access the personal data we hold and know the manner in which they are processed; to Rectify your information if it is outdated, inaccurate, or incomplete; to Cancel your data when you consider they are no longer required for the purposes stated, are being misused, or when the relationship that gave rise to the processing has ended; and to Object to the processing of your personal data for specific purposes. These rights are known as ARCO Rights.

The data subject or their legal representative may request the exercise of ARCO Rights from the data controller at any time. The request must contain and be accompanied by the following:

• The name of the data subject and domicile or other means to receive notifications;
• Documents proving the identity of the data subject or, where appropriate, the identity and authority of the representative;
• A clear and precise description of the personal data regarding which ARCO Rights are sought, except for the right of access;
• A description of the ARCO Right being exercised, or the request being made; and
• Any other element or document that facilitates the location of the personal data.

Once your request is received, we may request additional information within the first five business days, and you will have ten business days to respond. The response will be provided within a maximum of twenty business days from the date of receipt of the request, and if applicable, it will be effective within fifteen business days thereafter. Deadlines may be extended once, under the terms permitted by the Law.

Contact details for exercising ARCO Rights:

• Responsible Area: Data Protection Department
• Domicile: Calle de Acceso L 28 Mz 16, No. L 37, Edificio A, 3rd Floor, Local J, SM 309, Cancún, Municipality of Benito Juárez, Quintana Roo, C.P. 77560.
• E-mail: memberservices@exotictravelers.com
• Telephone: +1 213 221 0116
• Business hours: Monday to Friday, from 9:00 a.m. to 6:00 p.m.

5. Revocation of Consent

You may revoke the consent you have granted us for the processing of your personal data at any time. However, please note that not in all cases can we immediately terminate the use of your data, since it is possible that, due to a legal obligation or an existing legal relationship, we may be required to continue processing them.

Revocation may be requested through the contact details indicated in this Privacy Notice. Once your request is received, we may request additional information within five business days, and you will have ten business days to provide it. The resolution will be communicated within a maximum of twenty business days from receipt, and if applicable, it will be effective within fifteen business days thereafter. Deadlines may be extended once under the terms permitted by the Law.

Contact details for Consent Revocation:

• Responsible Area: Data Protection Department
• Domicile: Calle de Acceso L 28 Mz 16, No. L 37, Edificio A, 3rd Floor, Local J, SM 309, Cancún, Municipality of Benito Juárez, Quintana Roo, C.P. 77560.
• E-mail: memberservices@exotictravelers.com
• Telephone: +1 213 221 0116
• Business hours: Monday to Friday, from 9:00 a.m. to 6:00 p.m.

6. Options to Limit Use or Disclosure

In addition to ARCO Rights and revocation of consent, you may limit the use or disclosure of your personal data through the mechanisms made available by the data controller. These options include the possibility of enrolling in internal exclusion lists maintained by the data controller, as well as registering your telephone number in the Public Registry to Avoid Advertising (REPEP) managed by PROFECO, available at www.gob.mx/profeco

For more information on these mechanisms and procedures, you may contact the Data Protection Department using the contact details set forth in this Privacy Notice.

7. Security Measures

Exotic Travelers has implemented and maintains administrative, technical, and physical security measures designed to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or disclosure. Such measures take into account the nature of the data processed, the risks involved in their handling, and available technological development, with the aim of maintaining the confidentiality, integrity, and availability of the information at all times.

Internal privacy and security policies, mandatory for all personnel with access to data, as well as contractual clauses with third-party processors, have been established to ensure that processing is always carried out under appropriate protection standards and in compliance with the Law.

8. Modifications to the Privacy Notice

This Privacy Notice may be modified due to legal, internal, or service-related changes. Modifications will be disclosed through Exotic Travelers’ official website, where the current version will always be available: https://www.exotictravelers.com/newexotic/s/politica-de-privacidad

9. Authority

If you consider that your rights under the Law have been violated by the data controller (such as failure to respond to ARCO requests, incomplete or unsatisfactory responses), you may file a complaint with the competent authority in the protection of personal data.

For further information on this procedure, as well as applicable requirements and deadlines, you may consult the relevant regulations or the official channels of said authority.

10. Data Protection Department Contact Information

For any questions regarding the content of this Privacy Notice, as well as to exercise ARCO Rights, revoke consent, limit the use or disclosure of personal data, or any other matter related to the processing of your information, you may contact the Data Protection Department through the following means:

• Responsible Area: Data Protection Department
• Domicile: Calle de Acceso L 28 Mz 16, No. L 37, Edificio A, 3rd Floor, Local J, SM 309, Cancún, Municipality of Benito Juárez, Quintana Roo, C.P. 77560.
• E-mail: memberservices@exotictravelers.com
• Telephone: +1 213 221 0116
• Business hours: Monday to Friday, from 9:00 a.m. to 6:00 p.m.

11. Acceptance

The use of our services implies that you have read, understood, and accepted the terms of this Privacy Notice.