In compliance with the Federal Law for the Protection of Personal Data in the Possession of Private Parties (hereinafter the "Law"), its Regulation, and the Guidelines of the Privacy Notice, published in the Official Federal Gazette (Diario Oficial de la Federación) on January 17, 2013 (hereinafter the "Guidelines"), the present privacy notice of PARQUE QUETZALCÓATL, S. DE R.L. DE C.V. (hereinafter "Parque Quetzalcóatl" or the "Controller"), has the purpose of informing you, as the data subject, before the processing of any data, about the purposes for which they are collected and the processing that will be carried out on such personal data.

 

When reading this Privacy Notice, please consider the following definitions:

 

• Personal Data: Any information concerning an identified or identifiable data subject.

 

• Sensible Personal Data: Personal data that affects the most intimate sphere of the data subject, or whose improper use could give rise to discrimination or pose a serious risk to the data subject. Sensitive personal data may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical, and moral beliefs, union membership, political opinions, and sexual orientation.

 

• Database: The ordered collection of personal data concerning an identified or identifiable data subject.

 

• Restriction of Processing: The identification and conservation of personal data once the purpose for which they were collected has been fulfilled, for the sole purpose of determining possible liabilities in relation to their processing, until the legal or contractual statute of limitations period. During this period, personal data may not be processed and after this period, it will be cancelled in the corresponding database.

 

• Cancelation: Suppression of personal data. 

 

• Dissociation: The procedure by which personal data cannot be associated with the data subject or allow, due to its structure, content, or level of disaggregation, the identification of the same.

 

• Processor: The individual or legal entity who alone or jointly with others processes personal data on behalf of the controller.

 

• Controller: The individual or private legal entity that decides on the processing of personal data.

 

• Third party: The individual or legal entity, national or foreign, other than the data subject or the data controller.

 

• Data Subject: The individual to whom the personal data belongs.

 

• Transfer: Any communication of data made to a person or entity other than the data controller or processor.

 

• Processing: The collection, use, disclosure, or storage of personal data, by any means. Use encompasses any action of accessing, handling, utilizing, transferring, or disposing of personal data.

 

In accordance with the provisions set forth in Article 16 of the Law and other related provisions of its Regulation and the Guidelines, we inform you the following:

​

I. IDENTITY AND ADDRESS OF THE CONTROLLER.

 

The Controller is PARQUE QUETZALCÓATL, S. DE R.L. DE C.V., with address  located at Vito Alessio Robles 51, interior 203, Col. Exhacienda de Guadalupe Chimalistac, Alcaldía Álvaro Obregón, Zip Code 01050, Mexico City. 

 

II. PURPOSES OF DATA PROCESSING AND TRANSFER.

 

The personal data collected by Parque Quetzalcóatl will be used solely and exclusively for the purposes for which they were provided and will be recorded in Parque Quetzalcóatl's database.

 

The primary purposes, understood as those that originated and are necessary for the legal relationship between you and the Controller, are the following:

 

• Preparation of quotes for private events, photo sessions, and or guided tours.

• Scheduling appointments to carry out cultural visits to the properties managed by the Controller.

• Sending you information regarding scheduled appointments to visit properties managed by the Controller.

• Contacting you via telephone or email to follow up on services requested, contracted, or provided by the Controller.

• Following up on visits, photo sessions, and private events organized at the facilities of the properties managed by the Controller.

• Registration of attendees and suppliers for cultural visits, photo sessions, and private events held at the facilities of the properties managed by the Controller.

• Storage for the conservation of visitor records through a third party.

• Responding to your inquiries sent through the Controller's social media channels.

• Execution of contracts related to the Controller's corporate purpose with suppliers and data subjects, including lease contracts and provision of services.

• Preparation of invoices or electronic tax receipts (CFDI) in favor of data subjects.

• Requesting invoices or electronic tax receipts (CFDI).

• Making payments to suppliers contracted by the Controller.

• Collecting fees for cultural events, private events, photo sessions, or cultural visits.

• Informational purposes for sending notices, communications, and/or any relevant information related to services contracted by the Controller.

• Fulfilling obligations required by competent authorities.

• Video surveillance for security reasons.

 

Additionally, your personal data will be used for the following secondary purposes: 

 

• Sending you information related to private events, recreational activities, conferences, symposiums, and private, cultural and academic events.

• Sending you communications for advertising, marketing and/or promotional purposes related to the activities carried out by the Parque Quetzalcóatl.

• Customizing the activities carried out by Parque Quetzalcóatl depending on the type of client (general public or corporate events).

 

If you do not wish your personal data to be processed for the secondary purposes indicated, you may withhold your consent by sending an email to avisodeprivacidad@parquequetzalcoatl.com, specifying the secondary purpose(s) for which you do not want us to use your personal data.

​

III. METHODS FOR OBTAINING PERSONAL DATA.

 

Your personal data will be obtained through one of the following methods:

 

• Personally: When visiting the facilities of the properties managed by the Controller or attending events organized by the Controller where the completion of forms is requested.

 

• Direct: When you provide personal data through the submission of emails, contact via social media, or on the website of the Controller or electronic forms.

 

• Indirect: When the data is available from any other commercial information source or permitted by the Law. When data is obtained through this method, the Controller will not be obligated to notify changes made to this Privacy Notice.

 

IV. CATEGORIES OF COLLECTED PERSONAL DATA.

 

The categories of personal data to be collected and subjected to processing are the following:

 

• Identification and contact information, including full name, current address, contact email address, mobile phone number, nationality, data contained in official identification documents, emergency contact information, Taxpayer Registry (Registro Federal de Contribuyentes), fiscal address, and tax regime.

 

• Image-related data.

 

• Financial data, including interbank CLABE, credit card, or debit card information.

​

V. EXCEPTIONS TO CONSENT FOR THE PROCESSING OF PERSONAL DATA.

 

In accordance with the provisions of Article 10 and other relevant sections of the Law and its Regulation, we inform you that there is an exception to the obligation to obtain consent for the processing of personal data in the following cases:

 

• When its obtention is provided for by law.

• Personal data is found in sources of public access.

• Personal data undergo a prior disassociation procedure.

• When the obtaining of personal data pertains the fulfilling obligations arising from a legal relationship between you and the Controller.

• There is an emergency situation that could potentially harm a data subject in their person or property.

• They are indispensable for medical care, prevention, diagnosis, the provision of health care, medical treatments, or the management of health services, while you are not able to give consent, under the terms established by the General Health Law and other applicable legal provisions, and provided that such data processing is carried out by a person subject to professional secrecy or equivalent obligation.

• A resolution is issued by a competent authority.

​

VI. MEANS TO LIMIT THE PROCESSING OR DISCLOSURE OF PERSONAL DATA.

 

To revoke the consent granted to the Controller by you or to limit the disclosure of the personal data provided, you must submit a request via email to the following address: avisodeprivacidad@parquequetzalcoatl.com

 

VII. TEMPORALITY.

 

The temporality of the processing of your personal data provided by you will be for the time necessary to fulfill the aforementioned purposes, starting from the date on which they are provided.

 

VIII. TRANSFER OF PERSONAL DATA.

 

Your personal data may be transferred to the following individuals or legal entities:

 

• Authorities to whom the Controller is obliged to report, for the purpose of complying with applicable regulations.

• Employees of the Controller, for the purpose of carrying out the activities of the controller (guided tours, private events, and photo sessions).

• Individuals or legal entities who, alone or jointly with others, process personal data on behalf of the Controller.

​

IX. CONSENT EXCEPTION TO THE TRANSFER OF PERSONAL DATA.

 

According to Article 37 and other relevant sections of the Law and its Regulations, you are informed that there is an exception to the obligation to obtain consent for the transfer of personal data in the following cases:

 

• When the transfer is provided for by Law or a Treaty in which Mexico is a party.

• When the transfer is necessary for preventing or diagnosing medical conditions, the provision of health care, medical treatment, or the management of health services.

• When the transfer is made to controlling companies, subsidiaries, or affiliates under the common control of the Controller, or to a parent company or any company in the same group as the Controller that operates under the same internal processes and policies.

• When the transfer is necessary in terms of a contract entered into or to be entered into in the interest of the data subject, by the Controller and a third party.

• When the transfer is necessary or legally required for the safeguarding of a public interest, or for the procurement or administration of justice.

• When the transfer is necessary for the recognition, exercise, or defense of a right in a judicial proceeding.

• When the transfer is necessary for the maintenance or fulfillment of a legal relationship between you and the Controller.

​

​

X. MODIFICATIONS TO THE PRIVACY NOTICE.

 

If any modification is made to this Privacy Notice, the Controller undertakes to inform you of such modification through any means, whether printed, electronic, including the Controller's website, or by any other optical means.

 

XI. REQUESTS TO EXERCISE ARCO RIGHTS

 

In terms of Articles 28, 29, 30, 31, 32, and other related articles of the Law and its Regulation, you have the right to exercise the rights of access, rectification, cancellation, or opposition to your personal data.

 

The contact details of the person responsible for handling requests to exercise ARCO rights are as follows:

 

• Person in charge of handling requests: Natalia Senosiain Jiménez

 

• Address: Vito Alessio Robles 51, Col. Exhacienda de Guadalupe Chimalistac, Álvaro Obregón, Zip Code 01050, Mexico City.

 

• Phone: 5519880781

 

• Email: avisodeprivacidad@parquequetzalcoatl.com

 

To exercise your ARCO rights, you must send a request to the email address of the person responsible for handling such requests, stating the following information, and including the following documents:

 

• Your name.

 

• Your address.

 

• Your phone number.

​

• Documents proving your identity.

 

• Clear and precise description of the data you wish to access, rectify, cancel, or oppose to its use or disclosure.

 

The means by which the response or determination adopted regarding the respective requests will be communicated to you is via email, within a period of ten business days, counted from the date the request for access, rectification, cancellation, or opposition was received.

 

If the request is deemed appropriate, the measures adopted will be effective within fifteen business days following the date the corresponding determination was communicated.

 

In the case of requests for access to personal data, delivery will proceed, upon accreditation of your identity or that of your legal representative, as appropriate.

 

The aforementioned deadlines may be extended only once for an equal period, provided that the circumstances of the case justify it, which is subject to the criterion of the Controller or the person responsible for handling requests to exercise ARCO rights.

 

The Controller has the authority to request, and you have the obligation to update your personal data in accordance with other legal provisions issued in matters of prevention and detection of acts or operations carried out with illicit proceeds.

 

Should you have any questions or need any clarifications, you may communicate by telephone or email with the Controller.

​

XII. ACCEPTANCE AND ACKNOWLEDGMENT

 

I acknowledge having read this Privacy Notice and understand that the processing of my personal data is necessary to establish and maintain the relationship with the Controller. Consequently, I authorize the processing, use, and transfer in accordance with the provisions of this Privacy Notice, during the period of the relationship by the Controller, and subsequently, in accordance with the applicable laws, considering that such processing is necessary for the continuity of the Controller's activities.