I. Responsible for the protection of your personal data.Hotelera Malecón S.A. de C.V. hereinafter Royal Sunset with address in Boulevard Kukulcán, kilometer 10 Apple 51, Lote 13-B Zona Hotelera, Zip Code 77500, Cancún Quintana Roo México, is responsible for the collection and use of the personal data required from the customers, visitors and vacational member club, in terms of the rules established by the Mexican Federal Law for Data Protection of Private Individuals (Ley Federal de Protección de Datos Personales en Posesión de los Particulares LFPDPPP) as well in the provisions of the articles 1º, 3º and 5º of the General Data Protection Regulation (EU) 2016/679 (GDPR). II. Data collected and use of the information requested from our customers. The personal data and documents collected from our customers at the resort, in our Website, online services or by phone, will be used to start, management and maintenance of ours services and to send discounts, offers and promotions in terms of what is stated in this section. a) General Data The general data requested in our forms such as: name, gender, signature, home address, phone number, cell phone number, e-mail, date of birth, job, home city, economic dependents, country, national identity document or passport will be used for the following essential purposes: i. Provide all our services; ii. Include the information of our customers in our systems and databases to provide and administrate the services contracted; iii. Carry out the check-In and Check-out; iv. To comply with the different laws that regulate our services and activities; v. To attend complains, doubts and provide information to our customers, related to transportation, reservations or cancellations received by our Call Center; vi. To confirm, verify, correct and update your personal data; vii. For the administration of the services all inclusive, European plan and day pass viii. For the charge of our services and the collection efforts with respect to receivables that are not paid when due; ix. In order to do the charges on-line of the services and programs paid with credit card; x. To charge any extra charges or additional fees for extra services contracted by our customers and, xi. For the proper identification of our guests and customers. Additionally, this information can be used for the following non-essential purposes: a) To send our customers offers, discounts, special fees and other benefits; b) Spa Service c) Babysitting service d) To carry out wedding, banquets, and Honeymoon Service e) Gym Service f) Restaurant and Bar service g) Medical attention h) Transportation services i) Currency exchange j) For statistical purposes; and, k) For promotional and marketing purposes b) Financial and Patrimonial Assets Data The financial and patrimonial data collected such as credit card number, bank account, monthly income and additional incomes, will be used to purchase our wedding services and events, to purchase our vacation packages, to make reservations, to administrate our European plan analyze the financial profile of our guests and customers in order to grant them access to promotions and programs based on their economic characteristics. Furthermore, additional financial data and information related to the patrimonial assets of the clients may be required in compliance of Mexican Federal Law to prevent money laundering (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita LFPIORPI). According to Mexican Privacy Law, is required to obtain express consent of guests and customers in order to use and process their financial and patrimonial assets data for the different purposes and uses described above. Therefore, in compliance with the law, we will request your express authorization in written at the moment of the data collection. c) Sensitive Data The sensitive data collected such as health condition (allergies, disease, asthma, injuries, any illness) in our health questionnaire, babysitting service and medical care, will be used to value your health condition in order to purchase and carry out our services such as spa services, babysitting services and medical care. According to the LFPDPPP article 9º and the provisions contained in article 9 (2.a) of the GDPR is required to obtain express consent of guests and customers in order to use and process their sensitive data for the different purposes and uses described above. Therefore, in compliance with the laws, we will request your express authorization in written at the moment of the data collection. III. Data transfer. The personal data collected by Royal Sunset can be transfer to companies that help to provide some of the services requested by our customers. These data transfer is necessary to comply with the contract and therefore express consent is not necessary for these transferences. Out of these cases and unless one of the provisions stated in article 37 of the LFPDPPP and in the provision contained in article 49 of the GDPR are met, the data provided by our guests, customers or vacation members club, will not be transferred under any circumstances to third parties. IV. Use of images. Events: In order to document and communicate information about the activities and events held throughout the year in the resort, as well as news Royal Sunset can use, print, reproduce and publish the images of our guests, visitors, vacation members club and customers and their friends or family that attend our activities in print or electronic media, newsletters, publications, photographic memories, in all its forms and expressions, performances, editions, phonograms, video and emissions for the purposes indicated. These images will not be commercially exploited by Royal Sunset. Secondary Purposes The information that we collect from our guests, vacation members club, and customers may be used for advertising, marketing and/or market research, according to the relationship existing between them and Royal Sunset. When Royal Sunset pretends to use the images for these purposes, the company will request your express authorization in written before its use. V. Restrictions on the use or disclosure of personal data. In Accordance to the articles 16 section III of the LFPDPPP and article 18 of the GDPR, If our customers do not wish to receive communications or advertising by Royal Sunset at any time they can: Subscribe their data in the “do not call list” (REPEP for its acronym in Spanish), administrated by the Bureau of Consumer Protection (PROFECO). For more information visit http://rpc.profeco.gob.mx/; or, send an email to the address privacidad@royalsunset.com requesting stop being contacted for these purposes. VI. Rights of access, rectification, cancellation and opposition, and withdrawal of consent. As stated in the Federal Personal Data Protection Law and in the General Data Protection Regulation, customers may request the access, rectification, cancellation, oppose to the use of their personal data provided to the responsible, or revoke their consent. Their request will be answered by our Privacy Officer, through this email address: privacidad@royalsunset.com To exercise these rights of access, rectification, cancellation, opposition, and to revoke the consent, the following procedure must be followed: 1) Send an email to the address privacidad@royalsunset.com with your full name, your legal or commercial relationship with Royal Sunset, (for example guest or customer), and if you want to exercise your right of access, rectification, cancellation, opposition or revoke your consent. 2) Fill the application form that our Privacy Officer will send you, identifying the data on which you request the access, rectification, cancellation, opposition or the revoke of your consent, providing a copy of any of the identifications mentioned in the form in order to prove that you are the owner of the data or its legal representative. 3) After filling this form you must sent it to the e-mail address indicated in the previous paragraph, attaching all the documents that are relevant to answer your request. For “rectification” applications it will be necessary to specify the changes to be done, including the documentation that supports your request. 4) Once your request is received we will send you a notice with the file number and date of receipt. If your applicarion does not fulfill the legal requirements we will contact you within five business days of the receipt date informing you this situation. You will have ten business day to provide the information or documents required, otherwise your application will be considered as not submitted. 5) If your application was sent on a saturday, sunday or non-working day, it will be received the following working day. 6) Your request will be answered via e-mail in a period of twenty working days from the date of receipt. This period may be extended for twenty additional days for proper reasons, this situation will be notified to you in terms of the provisions of Article 97 of the LFPDPPP Regulations. 7) If your application is accepted we will give you access, rectify or cancel you data, register your opposition to the use of your information or revoke your consent within the fifteen business days from the date on which we answer your request. 8) This period may be extended for fifteen additional days for proper reasons, this situation will be notified to you in terms of the provisions of Article 97 of the LFPDPPP Regulations. 9) When your application is accepted, in terms of Articles 32, 33, 34 and 35 of the LFPDPPP we will sent your data without any charge through your email address, in case you request or need another form of delivery you will have to pay for the cost of shipment and/or the cost of reproduction of copies or other formats. VII. Online data management. This section describes the use of your personal data in the following website: – https://www.sunsetworldresorts.com/resorts/sunset-royal-beach-resort/ Online Privacy Policy Our policy regarding the information related to the use of our website is described below. You should review this Privacy Policy regularly since it may change at any time at our discretion. When you access the website of Royal Sunset, we register your Internet address (this address usually is temporary and is assigned by your Internet service provider when you log in), the type of operating system and browser you use. In addition, we can trace the pages of the site that you are visiting. The information we collect is used to improve the users experience of our website, the whole process is done without any knowledge of your name or any other information that will allow us to identify you. While visiting the website of Royal Sunset, unless you decide to identify with us, your navigation is anonymous. Royal Sunset, does not require that you provide personal data to use our website, unless necessary. Some applications may require you to disclose any personal information, our contact forms may require your email address to register and answer your comments, requests, questions or suggestions, and contact you if necessary. In these forms we will not require your name, financial, patrimonial and/or sensitive data, any disclosure of this information is your responsibility, regardless the above, if you voluntarily provide any of this information Royal Sunset assures it will be used with strict confidentiality. Cookies: A cookie is information that an Internet portal sends to your computer, which is stored on your hard drive. The next time you visit our site, we may use the information stored in the cookie to facilitate the use of our website. A cookie does not allow us to know your personal identity unless you explicitly choose to provide it. Most cookies expire after a period of time or can be deleted by you at any time. Also you can configure your browser to notify you when you receive a cookie so you can accept or reject it. Our website uses cookies to provide a personalized and secure experience to our users as well as to show users advertising related to their preferences. Cookies allow us to understand the behavior of our users on the site and improve it. If you decide to navigate our website, we understand that you consent to the processing of your personal data in accordance with “our online privacy policy” described in our Privacy Notice. Social Networks The data and information posted by the users of our social network, is published on their own account and is subjected to the terms and conditions established by the social network provider. Royal Sunset will use this information to answer the requests and questions asked by the users and to contact them in case they request so. The contact data of the users that request information about travel packages, tours and other services will be shared with our Customer Service Center to give them a personalized attention by e-mail or phone. The information provided by those users who decide to participate in our contests will be use to contact them in case they win and their image may be published. Data Portability In Accordance with the article 20 of the GDPR, you have the right to transfer your personal data to another supplier or controller without hindrance from the controller to which the personal data have been provided as long as the legal processing oy your data has been carried out by automated means. Royal Sunset ensures the most strict confidentiality and security to carry out the data transfer. VIII. Complaints regarding the use of your personal data If you believe that your rights regarding the protection of your personal data have been violated by any conduct, act or omission regarding the attention of your requests or in the use of your personal data, you can submit a complaint with the National Institute for Access to Information and Data Protection (INAI), for more information visit www.inai.org.mx IX. More Information – Privacy Office. If you have any questions regarding the content, interpretation or scope of this Privacy Notice, or need more information regarding the use of your personal data, please contact us through our Privacy Officer, at the following email address: privacidad@royalsunset.com donde será atendido. X. Updates. This Privacy Notice is effective from January 1º of 2012 and may be modified on a discretionary basis by Royal Sunset, in terms of the GDPR and LFPDPPP and its regulations, any amendment will be communicated by posting the new Privacy Notice in of our website listed in the VII section of this Privacy Note, and in the Resort Lobby. Last Update: December 1, 2018.

1. Responsible for handling your personal data

Promotora Sunset Beach Clubs S.A. de C.V. (“SUNSET”), a legal entity duly constituted in accordance to the laws of Mexico, domiciled in Blvd. Kululcán km. 10, lote 13-B, Zona Hotelera, CP. 77500, Cancún, Quintana Roo is the entity responsible for handling your personal data. For the Responsible entity, handling your data legitimately is a priority. This Privacy Notice serves as a complement of any other simplified privacy statements that our organization may have presented to you and serves as an addition to all those that purposely do not allude to such notices.

2. Personal Data Department:

Address: Boulevard Kukulcan Km. 10 Lote 13-B, Zona Hotelera, CP. 77500 en Cancún, Quintana Roo. Email: datospersonales@sunsetworld.net Service Hours: Monday through Friday 9:00 to 2:00 pm and 4:00 to 6:00 pm. Phone: +52 998 881 45 00

3. Objectives of the handling of personal data

The Responsible entity gathers your data with the following objectives:

1. To register you as a client of our services
2. For administrative purposes related to the implementation of the contractual obligations and the execution of the applicable legal obligations
3. To offer promotions
4. To follow up on the requirements of our clients
5. To process your requests thus manage the relationship you wish to establish with Promotora Sunset Beach Clubs S.A. de C.V. or the one already established between yourself and society
6. To follow up on the requirements and suggestions about products, services and estimates
7. To guarantee a correct and suitable service for you

In accordance with the guidelines published in the Official Journal of the Federation on January 17th 2013, we inform you that the necessary purposes for the existence, upkeep and compliance with our legal relation appear in detail in inserts a), b) and e) above. In accordance, it is necessary that you indicate your consent for the handling of your personal data in relation to the purposes detailed in inserts c) d) f) and g), as these are not strictly necessary or essential for our legal relation.

□ I give my consent for my personal data to be handled in accordance to all the objectives listed in the terms of this privacy notice.

4. Personal data collected

We collect the data you provide either in person at the address provided and by phone, email or through our web page. The personal data we obtain is the following:

1. Name, telephone, address, gender, number of children or people dependent on you, Federal tax payers register number and job references.

In accordance to article 9 of the Federal Law for the Protection of Personal Data in Possession of Individuals, when the entity responsible for handling your data collects it from you, you must give your clearly stated consent, thus we will require that at that moment you indicate if you do or do not give your consent to our handling it, through the electronic mechanism we have implemented for such purposes or, wherever appropriate, that you provide us with a duly signed document.

5. Sensitive, financial and proprietary data we collect

5.1 Financial and Proprietary data.- Our organization will ask you to provide the financial and proprietary data needed for our contractual relation. Such data includes the following:

1. Bank and bank account numbers and credit and/or debit card information.

6. Use of Cookies and Web Beacons

We inform you that we do not collect any personal data through the use of Cookies or Web Beacons and other technology to obtain personal information that could include the following:

• What browser or platform you use
• The Internet pages you visit
• The links you follow
• Your IP address
• The web page you visited before you clicked into ours

 7. Options and ways to limit the use or disclosure of personal data

You can stop receiving electronic, printed, or phone messages by contacting the entity in charge of your Personal data.

8. Means to exercise the right to access, rectify, cancel or object to the use of your data

You have the right to access the personal data we have in our power and the details about their handling, as well as to correct them in case they are inaccurate or incomplete; to cancel them when they turn out to be undue or unnecessary for the purposes that justified their procurement or oppose their use for a specific objective. The mechanism that has been implemented for those rights to be executed is presenting an application form (“Single form for exercising ARCO rights”) to the entity Responsible for handling your Personal Data whether in person at the address provided or through an email. You can download the form from our web page in the following section click here. In order to exercise your rights, you must present a form (“Single form for exercising ARCO rights”) to the Responsible entity including the following information:

• 1.- Full name and address;
• 2.- Proof of personality ID (Voting card issued by the IFE, valid passport, professional license, or in case you are not Mexican, valid migratory documents);
• 3.- In case the title holder is not the one presenting the form, a document must be presented to credit the person serving as a representative; a notarized power of attorney signed with two witnesses with the title holder’s and the legal representative’s ID (IFE card, valid passport, professional license or, in case the person is of a nationality other than Mexican, valid migratory documents)

• • In the case of minors, the documents to credit the legal representation of the minor will be: birth certificate and identification papers with a photo (one given by the minor’s academic institution), official papers from the Instituto Mexicano del Seguro Social (Mexican Social Security Institute), valid passport or any other document that serves as a valid photo ID, in addition to a declaration under oath by the signee of the document to be attached to the form as the “Certification of legal representation”;
  • In the case of a person medically unable to exercise their rights, the documents to credit legal representation will be: the interdiction act and the photo ID of the person that holds that legal situation, be it an IFE card, a valid passport a professional license or official immigration papers (in the case of non-Mexicans).

• 4.- A clear and precise description of the personal data which you wish to exercise ARCO rights over, detailing which right you wish to exercise and the reasons why you wish to exercise it
• 5.- Any document or information that serves as proof that your personal data is being handled by Promotora Sunset Beach Clubs S.A. de C.V.
• 6.- In case you require the rectification of data, the modifications to be made must be specified and all the documents to back this request presented (a birth certificate, proof of address or any other by which the change to be made can be supported).

• • The Responsible entity will respond to your request via email or personally in the aforementioned address within 20 (twenty) business days from the time an acknowledgement of receipt has been sent. In case the request is applicable, the response could be sent via email or presented in person. In order to respond, Promotora Sunset Beach Clubs S.A. de C.V., may ask you to present, at the address mentioned above, an original of the documents that you sent, together with your requisition form, within the 5 (five) business days. If the term has passed and you have yet to present the documents, your request will be filed and the Privacy notice will remain valid until you present a new request form.
  • When the request proceeds and the documents have been duly checked as to the personality and proprietorship of the ARCO rights, the terms to carry out the request will be the following:
  • To have access to the data: within a period of 15 (fifteen) days from the time of an affirmative response from the Responsible entity; the electronic documents guaranteeing your request will be made available to you through the same means used to make your request.
  • For the rectification of data: within a period of 15 (fifteen) days from the time of an affirmative response from the Responsible entity; the electronic documents guaranteeing the rectification will be made available to you through the same means used to make your request.
  • For the cancelation or objection to the data: first they will be blocked, from the moment a thorough check of the required documents begins, thus access to personal data will be restricted to any person until there’s a response to the request whether affirmative or negative. In the first instance, within 15 (fifteen) days from the time of an affirmative response from the Responsible entity and in the latter instance the data will be unblocked to continue being handled.

The terms listed in the inserts above could be postponed only once for a similar period, in case it is necessary, subject to previous notice by the Responsible entity. Promotora Sunset Beach Clubs S.A. de C.V. could deny the exercise of ARCO rights in the following cases:

1. When you are not the owner of the personal data or have not been duly credited as a representative of that owner;
2. When your personal data are not to be found in the data base of the Responsible entity;
3. When the rights of a third party are harmed;
4. When there is a legal impediment or a resolution by a relevant authority that restrict the ARCO rights;
5. In case of a cancellation, when the personal data are being handled for prevention or for a medical diagnosis or the management of health services or;
6. When a rectification, cancellation or objection has taken place previously.

The denial could be partial, in which case Promotora Sunset Beach Clubs S.A. de C.V. will carry on with the procedures to access, rectify, cancel or object the applicable data. The exercise of the “ARCO rights” will be free, but if you repeat your request within a 12 (twelve) month period, the cost will be the equivalent of 3 (three) days of the minimum wage in force in Mexico City, plus the VAT, unless there are substantial modifications to the Privacy Notice that lead to new Requests to Exercise ARCO rights. You must cover the expenses of justified shipment costs or the cost of copies and other formats. For further information, please contact the entity Responsible for personal data in the aforementioned email.

9. Mechanisms and procedures so the owner of the data, whenever appropriate, can revoke his/her consent at any moment

You may reverse the consent you have given for the handling of your data at any moment, for that to happen, it is necessary to contact the entity Responsible for the protection of your data, where you will be told what steps to take.

10. Transfer of personal data within and outside Mexico

We have made a commitment not to transfer your personal information to third parties without your consent, excepting the special cases foreseen in article 37 of the Federal Law for the Protection of Personal Data in Possession of individuals, and to make said transfer within the terms dictated by the law.

11. Implemented safety measures

For the protection of your personal data, we have set up administrative, physical and technical safety measures in order to avoid losses, misuse or modifications to your information. When we communicate or share your information with third parties providing us with a service, we require and verify that they have the necessary safety measures to protect your personal data, forbidding the use of your personal information for uses other than those they were meant for; under the understanding that any noncompliance by said third parties with that foreseen in the Federal Law for the Protection of Personal Data in the Possession of Individuals or its Guidelines is the exclusive responsibility of said third parties.

12. Modifications to the privacy notice

We reserve the right to carry out modifications or updates to the present privacy notice at any given moment. These modifications will be available to the public through the following: (i) noticeable announcements in the corporate office; (ii) bulletins or flyers available in the corporate office; (iii) in our web page www.sunsetworldresorts.com; or (iv) we will send them to the last known email you provided.

13. Right to promote the rights protection and data verification procedures that the Institute advocates

Any complaint or additional information about the handling of your personal data or any doubt in relation to the Federal Law of the Protection of Personal Data in the Possession of Individuals or its Guidelines could be directed to the Federal Institute for Access to Public Information and Data Protection (IFAI). For further information www.ifai.org.mx For further information, you can send us an e-mail to the following address datospersonales@sunsetworld.net.