It is of much importance to us to maintain your personal information private and confidential.
This Privacy Notice is issued in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, and the General Guidelines for Privacy Notices (hereinafter, the “Law”).
Identity of the Data Controller
Solaya Hospitality Management Group, S. de R.L. de C.V. (hereinafter, the “Controller”), with registered address at Avenida Bonampak, Supermanzana 9, Manzana 2, Ground Floor, Tower N, Floors 7 to 11 and Tower S, Floor 7, Cancún, Quintana Roo, Mexico, C.P. 77503, is responsible for the processing of the personal data of the individuals (hereinafter, the “Individual”).
Means of Collecting Personal Data
We collect your personal data directly through:
We may also collect your personal data indirectly through:
What Personal Data Do We Collect?
The personal data processed by the Controller are grouped into the following categories:
1. Personal data
1.1 Identification and Contact Data
-Full name
-Email address
-Telephone number
-Address
-Billing and/or collection information
1.2 Demographic and General Data
-Date of birth
-Place of birth
-Nationality
-Age
-Height
-Weight
1.3 Official Identification Data
-Official identification number
2. Sensitive Personal Data
2.1 Health Data
-Current health status
-Medical conditions
-Allergies
-Medications
-Dietary habits
-Pregnancy status, where applicable
2.2 Gender Data
-Gender
3. Financial and/or Patrimonial Data
Credit or debit card information
In cases where the Individuals are minors, personal data will be collected with the express authorization of the person holding parental authority, guardianship, or legal representation.
For What Purposes Will We Use Your Personal Data?
The processing of personal information will be carried out in accordance with the principles of legality, quality, consent, information, purpose limitation, loyalty, proportionality, and accountability set forth in the Law.
Primary Purposes
The primary purposes that give rise to the processing of personal data and are necessary for the legal relationship between the Controller and the Individual include:
Secondary Purposes
Additionally, the Controller informs that personal data may be processed for the following secondary purposes:
If the Individual does not wish their personal data to be processed for these additional purposes, they may express their refusal through a written request signed by the Individual or their authorized representative and sent to the following email address: privacy@pamhotels.com. Refusal to allow the processing of personal data for these secondary purposes shall not be grounds for denying the provision of contracted services.
Automated Processing of Personal Data
The Controller informs that personal data are not used in automated decision-making processes, without human intervention, that produce legal effects or significantly affect Individuals. However, for operational and service administration purposes, the Controller may use technological tools or systems to support the management of services provided to the Individual.
With Whom Do We Share Your Personal Information and for What Purposes?
Transfers of personal data, within or outside Mexican territory, may occur as necessary to fulfill the purposes described above, to the following third parties, who may act as data processors, following the direct instructions of the Controller:
Service providers of the Controller
To carry out the contracted services, necessary for the provision of services to the Individual or for the fulfillment of the purposes previously described in this Privacy Notice. The personal data collected may be shared with:
How Can You Access, Rectify or Cancel Your Personal Data, or Object to Its Use?
You have the right to know what personal data we hold about you, what we use it for, and the conditions under which it is used (Access). You also have the right to request the correction of your personal information if it is outdated, inaccurate, or incomplete (Rectification); to request that we delete it from our records or databases when you consider that it is not being used in accordance with the principles, duties, and obligations provided by applicable law (Cancellation); and to object to the use of your personal data for specific purposes (Objection). These rights are known as ARCO rights.
To exercise any of your ARCO rights, the Individual must submit a written request addressed to the Data Protection Office, either by email to privacy@pamhotels.com or in writing to Avenida Bonampak, Supermanzana 9, Manzana 2, Ground Floor, Tower N, Floors 7 to 11 and Tower S, Floor 7, Cancún, Quintana Roo, Mexico, C.P. 77503.
When submitting a request to exercise ARCO rights, the following must be considered:
I. ACCESS: Indicate the personal data to which access is requested and that are believed to be held in our databases.
II. RECTIFICATION: Specify the corrections to be made and attach documentation supporting the request.
III. CANCELLATION: Identify the personal data requested to be deleted.
IV. OBJECTION: Specify the personal data for which processing is opposed and the reasons for the alleged harm caused by such processing.
If the information provided in the request is insufficient or inaccurate, or if the required documents are not attached, the Data Protection Office may request additional information and/or documentation within a period not exceeding five (5) business days. The Individual will then have ten (10) business days from receipt of such request to provide the requested information.
If the request contains sufficient information, the resolution period will be twenty (20) business days from the date the request is received. This period may be extended once for an equal period, when justified by the circumstances of the case, in accordance with applicable law.
If the resolution is favorable, it will be implemented within fifteen (15) business days following notification of the decision. This period may also be extended once for an equal period, when justified by the circumstances, and the Individual will be notified through the previously selected contact method.
The means by which the Individual may obtain the requested personal data through the exercise of the right of access may include simple copies, electronic documents, or any other selected medium.
For questions regarding the procedure and requirements for exercising ARCO rights, the Individual may contact the Data Protection Office, which will process such requests and address any questions regarding the processing of personal data. Contact details are as follows:
How Can You Revoke Your Consent for the Use of Your Personal Data?
The Individual may revoke the consent granted for the processing of their personal data at any time. However, the Individual should be aware that in certain cases it may not be possible to immediately comply with such request or to cease processing, due to legal obligations that require continued processing of personal data. Likewise, the Individual should consider that revoking consent for certain purposes may result in the inability to continue providing the requested services or the termination of the legal relationship with us. To revoke consent, the Individual may follow the same procedure established for the exercise of ARCO rights, by sending an email to privacy@pamhotels.com or submitting a written request to Avenida Bonampak, Supermanzana 9, Manzana 2, Ground Floor, Tower N, Floors 7 to 11 and Tower S, Floor 7, Cancún, Quintana Roo, Mexico, C.P. 77503.
For questions regarding the procedure and requirements for revoking consent, the Individual may contact the Data Protection Office, which will process revocation requests and address any related inquiries. Contact details are as follows:
To submit a consent revocation request, the applicant must be the Individual or their legal representative, and identity must be duly accredited using official documentation (Voter Identification Card, Passport, Military Service Card, or Professional License). If a legal representative exists, their authority must be accredited through the corresponding documents (Public Instrument such as a Power of Attorney, declaration made by the Individual in a personal appearance, or, where applicable, a power of attorney signed before two witnesses). The resolution of a consent revocation request will be issued within twenty (20) business days from the date the request is received.
How Can You Limit the Use or Disclosure of Your Personal Data?
In order to limit the use or disclosure of personal data, the following options are available:
Use of Cookies
The Controller’s website uses cookies and other similar technologies that allow monitoring of user behavior in order to provide a better browsing experience and offer products and services aligned with user interests. Personal data collected through these technologies may include, without limitation: browser type, operating system, IP address, pages visited, browsing time, and usage preferences. The Individual may disable or adjust cookie settings directly through their browser. However, disabling cookies may affect the functionality of certain features of the website. For additional information regarding the use of cookies and similar technologies, the Individual may consult the Cookie Notice available on the Controller’s website.
How Can You Be Informed of Changes to This Privacy Notice?
This Privacy Notice may be modified, updated, or amended due to new legal requirements; changes in the products or services offered; updates to privacy practices; or changes to the business model. The Controller undertakes to keep the Individual informed of any changes through its website at www.pamhotels.com.
Notifications regarding changes or updates to this Privacy Notice will be carried out as follows:
The Individual declares that they have read and understood this Privacy Notice and grants express, informed, and voluntary consent for the processing of their personal data, including sensitive personal data and, where applicable, personal data of minors, in accordance with the purposes described herein, except where otherwise permitted by law. Such consent shall be deemed granted upon acceptance of this Privacy Notice, without prejudice to the Individual’s right to revoke consent at any time in accordance with the procedure described above.
The following Notice (the “Notice”) clearly describes how and for what purposes we intend to manage the personal information (the “Personal Information”) that you provide us (the “Management”). The management of your information is in accordance with the General Data Protection Regulation for the European Union (“RGPD”), and the Guidelines of the Privacy Notice (the “Guidelines”).
Corporación Inmobiliaria KTRC, S.A. de C.V., its subsidiaries and its hotels (collectively “us”, “we” or “our”) understand that our guests, clients, users and/or visitors (jointly, the “guests and clients”) place their trust in us, and we are committed to protecting all personal data that we collect through the websites that we operate (the "Websites"), applications that we make available on or through mobile devices or computers (the "Apps"), through wireless connectivity and Wi-fi that may be offered on our properties (the "Wi-Fi Connection"), and through social media channels that we control (the "Social Network Channels") (collectively the "Services"). This Notice describes our global practices regarding the collection, use, and sharing of Personal Data about identified or identifiable individuals through the Services.
By using the Services, you acknowledge, understand and accept all policies and practices stated herein.
The entity responsible for the management of your Personal Information is Corporación Inmobiliaria KTRC, S.A. de C.V. with the following address: Boulevard Kukulcán, Kilómetro 14.5, Zona Hotelera, Código Postal 77500, in Cancún, Benito Juárez, Quintana Roo, Estados Unidos Mexicanos.
We collect your Personal Information through the Services, so the Responsible Party will process that identifying information necessary to enable the User to consult information related to the services that can be contracted, as well as to manage requests for information or requests for services. Including, but not limited to, the Responsible Party will obtain from the User Personal Information such as name and surname, date of birth, country of residence, email, telephone, in order that the Responsible Party can manage the User’s requests. This information will allow the Responsible Party to give a satisfactory answer and make available to the User options that suit their needs.
We do not gather information that could result in discrimination, such as race or ethnicity, health status, genetic information, religion, philosophical and moral beliefs, union membership, political affiliation, or sexual orientation (“Sensitive Personal Information”).
Some of the Personal Information is automatically gathered by using the Services, while other is gathered through the data that you provide us personally. As a result, you have a choice over the data we gathered. When you are asked to provide any data, you may refuse that request; but if you don’t provide any information needed for the provision of the Services, you won´t be able to receive said Services. For example, you can create an account when you book a room through our Services, providing some extra information, which will lead to a simple booking process in the future. Also, you can use your personal social network accounts to share digital content through our Services, but be aware we can collect some information associated to that account, such as nickname, full name, the digital content shared and any comment or reaction regarding said content.
Furthermore, the Responsible Party will collect the following Personal Information through the Services:
Finally, we may collect data that is not Personal Information. We may use and distribute such data at our discretion, unless it is combined with Personal Information, in which case we will treat it as Personal Information under the privacy policy of this Notice.
The obtained Personal Information shall be used for the following purposes (the "Purposes"):
The Responsible Party will have the full consent of the User to process the Personal Information and provide an answer to the User in the aforementioned cases, from the moment the User sent any request to the Responsible Party.
This processing is based on the legitimate interest of the Responsible Party.
As long as this processing is carried out by electronic means and refers to products and services offered by the Responsible Party, it will be legitimized in the satisfaction of the legitimate interests of the Responsible Party.
At any time, the User may object to their Personal Information being processed for this purpose by following the instructions set out in section VI of this Notice.
The Responsible Party will have the full consent of the User to process the Personal Information and provide an answer to the User in the aforementioned cases, from the moment the User sent any request to the Responsible Party.
This processing is based on the legitimate interest of the Responsible Party.
The Personal Information collected by the Responsible Party will be managed for the time required to fulfill the purposes for which it was collected and established in the Notice, and where appropriate, until the limitation period of the actions related to the legal relationship that gave rise to the collection and management of your Personal Data.
The Responsible Party will not share any personal information with unaffiliated third parties, except in the following circumstances:
Likewise, some of the aforementioned Purposes involve sharing Personal Information collected with third parties. We share Personal Information with your consent, as necessary to complete any transaction or required to provide any service that the User has requested or authorized, or as permitted or required by the RGPD. We share Personal Information for a variety of purposes, including to provide our services such as reservations, guest communications and concierge services, marketing of our products and services, payment processing and other financial services, fraud prevention, and risk mitigation/reduction. We also share Personal Information with vendors who need the information to provide services to the User or to us, but only to the extent that the information is necessary to provide such services. This includes: software and web developers, payment processors, online travel agencies and channel managers, reservations managers, maintenance companies, guest and customer benefit providers, email and other marketing vendors, vendors of technology and vendors that we have maintained to help secure our systems. We also use analytics and software providers to help us understand how our customers and guests use the services and our systems.
Furthermore, if it is necessary to transfer Personal Information to third countries or international organizations, the Responsible Party guarantees that such transfers will be made in accordance with the principles and conditions established in the RGPD.
Users may exercise, if they wish, the rights of access, rectification and removal of data. They may also request that the processing of their Personal Information be limited, or even oppose it, request the portability of their data, as well as reject being subjects of automated decisions, through the following:
The request must contain and comply with the following:
The Responsible Party will notify the user the determination adopted in relation to their request, within a period of one month from the date we receive the request. Exceptionally, the Responsible Party may extend this period for up to two months, considering the complexity and number of requests submitted. In case of considering that a request is inadmissible, the Responsible Party will inform the user the reasons for its determination, within the month following the receipt of said request.
If the information provided in the request turns out to be erroneous or insufficient, or the necessary documents to prove identity or the corresponding legal representation are not attached, the Responsible Party will require the correction of the deficiencies to process the request.
The User may withdraw their consent for the processing of their personal data, without retroactive effects, in all those cases in which said revocation does not imply the impossibility of complying with obligations derived from a current legal relationship between the User and the Responsible Party; the User may also limit the processing of personal information in the cases expressly provided for by the RGPD.
The User will be responsible for keeping their personal information up to date. Therefore, the User guarantees and responds, in any case, to the veracity, accuracy, validity and authenticity of the Personal Information provided, and undertakes to keep them duly updated, communicating any changes to the Responsible Party.
The User has the right to revoke their consent to the processing of their Personal Information. The procedure, requirements, and contact information to revoke your consent will be the same as the procedure established in the section VI of this Notice.
If you have not expressly disapproved the terms stated herein, it shall be understood as given consent to the management of your Information.
The website's cookie notice will provide you with the option to reject the Responsible Party’s use of cookies while visiting the website. However, if you decide to decline cookies, some features and functions of the website may be affected, including the personalization features associated with creating a user profile. If you have established a user profile, you can adjust your preferences so that we can provide you with more appropriate recommendations. We may use the information that you provide to your user profile to populate other databases maintained by us and our service providers, as appropriate. By creating a user profile, you agree that we may use the personal information that you provide for these purposes. You can view, update or delete any personal information that you have provided to us for inclusion in your user profile by modifying your user profile online or by sending an email to privacy@rcdhotels.com. If you subsequently choose to delete your user profile, we will have the right to use any personal information previously provided by you for inclusion in your user profile for record keeping and quality assurance purposes. Even if you decide not to create a user profile, you can still use our websites to find and purchase services.
Services do not respond to Do Not Track (DNT) signals. We use a number of vendor technologies that can track guests and customers across sites, including, but not limited to, Google products and services, Google DoubleClick, Saber (synxis), Facebook, Adara, the hotel network, TripTease, Sojern, TripCraft, Cendyn and TRAVELCLICK.
The Services may contain links to third-party services, content, or products that are not affiliated with us. We are not responsible for examining or evaluating the content or accuracy of such third-party websites, and we do not warrant and will not have any liability or responsibility for any third-party materials or websites, or for any other third-party materials, products, or services. Please, refer to the privacy statements of those third-party services for information about what they collect and how they use your data.
We are not responsible for any damages or losses related to the purchase or use of goods, services, resources, content or any other transaction made regarding any third-party website. Please carefully review the policies and practices of third parties and make sure you understand them before engaging in any transaction. Complaints, claims, concerns or questions regarding third party products should be directed to the third party.
From time to time and in compliance with the RGPD, the Responsible Party may modify or update this Notice. In which case, you may check any updates through this page on our website.
Should be any questions or concerns about this Notice, the management of your Personal Information or your rights, please, feel free to email to privacy@rcdhotels.com, or send a communication to:
Boulevard Kukulcán km 14.5, Zona Hotelera, Cancún, Quintana Roo, 77500, México, directed to our IT Department.
Telephone: 011-52 (998) 881 3600
Fax: 011-52 (998) 881 3601