Privacy notice

Who is our corporate data protection director and how can you contact them?

Our corporate data protection director is the person within Galería Plaza León who has been formally designated by our general director to promote and safeguard the protection of the personal data in our possession, as well as to address data subjects’ rights.

For all matters related to the processing and protection of your personal data, you may contact our corporate data protection director by sending an email to: privacidaddatos.gpleo@brisas.com.mx and/or guillermo.zagal@brisas.com.mx.

For what purposes will we use your personal data?

The personal data we collect from you will be used for the following purposes that are necessary to provide our services:

• To reserve and/or check you in and provide the services you request or contract.
• To provide lodging and/or food and beverage services.
• To make our facilities and services available for meetings, weddings, banquets, or events.
• To grant memberships or day passes for exclusive use of our facilities.
• To provide complimentary safety-deposit box service.
• To provide parking.
• To assist you in requesting taxi service.
• To address special needs arising from your health condition or disabilities.
• If you wish, to enroll you in our rewards programs and apply points to your statement.
• Where applicable, to provide immediate cash advances for extraordinary payments to third parties, charged to your account (“paid out”).
• To handle lost-and-found or forgotten-item requests.
• To keep control of and collect payment for the services and consumptions you incur.
• To create and keep our customer database up to date.
• To issue invoices and/or payment receipts.
• To send account statements.
• To handle clarifications, complaints, and inquiries.
• To process returns or refunds.
• To perform financial analysis of accounts receivable.
• In case of outstanding balances, to carry out collection procedures.
• Where applicable, to prepare contracts or negotiated-rate agreements with deferred payments or a billing date.
• Video surveillance, for security reasons.

In addition, we will use your personal information for the following secondary purposes that are not necessary to provide the requested services, but that allow us to offer better service and promote our offerings:

• To send you information about our hotels and seasonal offers.
• To send you promotions from our rewards programs.
• Guest satisfaction surveys (GSI).
• Marketing, advertising, and commercial prospecting.

If you do not want your personal data to be processed for the secondary purposes indicated, or for any of them, you may notify us now by sending an email to our corporate data protection director.

Refusing the use of your personal data for these purposes will not be grounds for us to deny the services you request or contract with us. You have five business days to let us know, without prejudice to later exercising your right of revocation or objection.

What personal data will we use for these purposes?

To carry out the purposes described in this privacy notice, we will use the following categories of personal data: Identification; contact; financial and/or asset-related; employment; health data, which are considered sensitive personal data. We inform you that before collecting your sensitive personal data, we will request your express written consent to this privacy notice.

With whom do we share your personal information and for what purposes?

We inform you that your personal data may be transferred within the country to the following individuals or entities, without legally requiring your consent:

• The transfer is provided for in a law or treaty to which Mexico is a party;
• The transfer is necessary for medical prevention or diagnosis, the provision of health care, medical treatment, or the management of health services;
• The transfer is necessary by virtue of a contract entered into or to be entered into in the interest of the data subject, by the controller and a third party.
• The transfer is necessary or legally required to safeguard a public interest, or for the procurement or administration of justice.
• The transfer is necessary for the maintenance or fulfillment of a legal relationship between the controller and the data subject.
• Authorities to whom we must transfer data by law, in order to comply with the corresponding regulations.
• Authorities, when the transfer is necessary for the recognition, exercise, or defense of a right in a judicial proceeding.
• Physicians, paramedics, or health-service providers, in the event of an accident, medical emergency, or health situation, in order to assist you.
• Companies belonging to our same corporate group (Grupo Brisas), which protect your personal data under our same internal policies and procedures, for the following purposes: (i) to provide the services you request; (ii) statistical information; (iii) commercial prospecting, advertising, and marketing.

We may also transfer your identification and contact personal data to the following individuals or entities, in which cases we do require your consent:

• Credit-card payment processors, E-global and Prosa, if they request data on your charges in connection with a charge clarification. The purpose of the transfer is to assist those processors in making the clarification.
• Nearby hotels, to help you find lodging if, due to an event beyond our control, we cannot honor your reservation (only the name is transferred).
• Electronic mailing companies, in order to send you information about our services and promotions by email.
• Hospitality and marketing companies, to promote our services.

If you do not express your refusal of these transfers, which you may do by sending an email to our corporate data protection director, we will understand that you have given us your consent.

How can you access, rectify, or cancel your personal data, or object to its use?

You have the right to know what personal data we hold about you, what we use it for, and the conditions of that use (Access). You also have the right to request correction of your personal information if it is outdated, inaccurate, or incomplete (Rectification); to have us delete it from our records or databases when you consider it is not being used properly (Cancellation); and to object to the use of your personal data for specific purposes (Objection) under applicable law. These rights are known as ARCO rights.

To exercise any of the ARCO rights, you may submit the corresponding request by email to the data protection officer, who will inform you of the procedure and requirements to exercise those rights and will address any questions or comments you may have. You may also exercise your ARCO rights by requesting and completing the corresponding form at the front desk of Galería Plaza León, titled “ARCO Rights Request”. The data protection officer will then follow up on your request in accordance with applicable regulations.

You may revoke the consent you may have granted us. However, it is important to note that your request will not be applicable in all cases, nor will we always be able to stop using the data immediately, since we may be legally required under Article 25 of the Federal Law on Protection of Personal Data Held by Private Parties to continue processing your personal data. You should consider that for certain purposes, revoking your consent will mean we can no longer provide the service you requested, or that your relationship with us will end.

To revoke your consent, you must submit your request by email to the data protection officer, who will inform you of the procedure and requirements to exercise this right and will address any questions or comments. You may also exercise your right of revocation by requesting and completing the corresponding form at the front desk of Galería Plaza León, titled “ARCO Rights Request”. The data protection officer will then follow up on your request in accordance with applicable regulations.

How can you limit the use or disclosure of your personal information?

In addition to the procedure described in the immediately preceding section, you may limit the use or disclosure of your personal data in the following ways:

• Enroll in the Public Registry to Avoid Advertising of the Federal Consumer Protection Agency (PROFECO). For more information about this option, you may contact PROFECO directly or visit: https://repep.profeco.gob.mx/.
• Send an email to the data protection officer requesting your inclusion in the “Galería Plaza León Advertising Exclusion List,” so that you do not receive promotional information about our products and services.

Which authority is responsible for overseeing the protection of personal data?

The Anti-Corruption and Good Government Secretariat (SACBG) is the authority in charge of overseeing due compliance with legal provisions on personal data protection. For more information, you may visit: www.gob.mx/buengobierno/.

How can you learn about changes to this privacy notice?

This privacy notice may be modified, changed, or updated as a result of new legal requirements; our own needs related to the products or services we offer; our privacy practices; changes in our business model; or other causes.

We undertake to keep you informed of any changes to this privacy notice through our website, which we ask you to visit frequently to learn about any updates.

Notifications of changes or updates to this privacy notice will be made as follows: The current version of the privacy notice will be published on our website, with the date of the most recent update. You may consult this updated version at: https://www.galeriaplazahotels.com.mx/en/leon/privacy-policy/.