Privacy Notice

If you are reading this, it means that you are a responsible user who takes care of your personal data.

In this privacy notice we will explain to you why we request your information, under what circumstances and how we take care of it.

The first obligation we have with you is to inform you of the identity of the person responsible for this site:

Commercial name: Experiencias Xcaret Web S.A.P.I de C.V. (hereinafter Grupo Xcaret).

Commercial address: Tulum Avenue, Number 290 Manzana 3, Lote 2, Colonia SM 8, Cancún, Benito Juarez, Quintana Roo, C.P. 77500.

Our activity: We are a business group that has cultural, natural, ecological, adventure parks with unique hotels, which offers our visitors and guests different ecological, cultural, and fun experiences.

Our phone number: +52 (998) 884-9422 Ext. 11469.

Responsible one for the protection of your data: The Department of Information Protection is responsible for ensuring the security of your information.

Email of the responsible one: privacidad@xcaret.com

Now, we will describe the different situations where your data may be required in this site:

- When you register to become a canoeist candidate, we ask for your first and last name, email address, phone number, state, country of origin. We will also ask you some questions about your health status (family medical history, non-pathological personal history, pathological personal history, ailments and/or physical condition, blood type, recent surgical procedures, pregnancy status in the case of women, and cardiovascular or pulmonary conditions).

- When you sign a liability waiver to participate in the event, we request your first name, last name, and signature.

- When you make the payment to become a canoeist, we will require your first and last name, email address, phone number, state, country of origin. Additionally, we will ask for your banking information and address to process the purchase.

- When you take part in the event, images and videos will be captured of the participants, as well as the attendees of the event.

- We will never request any information from you over the phone or via email.

- We never ask for credit or debit card information unless you are making a payment for the registration.

One of our responsibilities is to explain the purposes for which we use, store, and process your personal data:

When you complete the Registration Form, we will use your first and last name, email address, phone number, state, and country of origin to generate your participation record for the event.

Similarly, in this form, we need to know about your health status, such as family medical history, non-pathological personal history, pathological personal history, ailments and/or physical condition, blood type, recent surgical procedures, pregnancy status in the case of women, and cardiovascular or pulmonary conditions. This information helps us determine whether your participation is advisable, allows us to have clinical history to take necessary measures during your training, and enables us to provide prompt attention in case of any incidents.

To process your registration payment through the Payment Form, we need to know your first and last name, email address, phone number, state, and country of origin. Additionally, we will ask for your banking information and address to facilitate the purchase. This is done to carry out and monitor the proper fulfillment of the contract and to comply with Grupo Xcaret's legal obligations.

When you sign the Participation Waiver Form, we will request your full name with last name and your signature. This form is essential for your participation.

In addition to the above, there are other purposes:

The processing is subject to your consent, and your data will NEVER be used for a purpose other than what is mentioned in this notice, and we will NEVER sell your information.

We retrieve personal data to conduct internal and statistical studies, understand the interests of our users, enhance the services we provide, and evaluate the quality of our service.

We require a participant database to facilitate communication regarding significant changes, dates, training sessions, and tests. This enables us to offer event promotions and extend invitations for your participation in upcoming events.

During the event, photographs and videos will be taken for advertising purposes related to the event. By participating, you give your consent for this use. If you prefer that your

information, not be used for this purpose, you can request the exercise of your rights as mentioned in this notice.

What are cookies and how are they used?

Cookies are text files that are automatically downloaded and stored in the computer's hard drive while navigating in a specific web page, allowing the Web server to recall some facts about the user, including preferences for the display of pages on that server, username, and password. In some sections of our site, we require that the client have cookies enabled since the functionality requires them to work correctly.

In the case of the use of cookies, the 'help' button found in the toolbar of most browsers will tell you how to avoid accepting new cookies, how to have the browser notify you when it receives a new cookie or how to disable all cookies.

The information provided by the user is secured by a personal identification number to which only the user can access and of which only he has knowledge.

We recommend that you do not share the information with anyone. On this issue, the Grupo Xcaret team has focused its efforts to offer the most modern and updated technology to offer you the greatest possible security.

The rights you have when you provide us with your data.

- To request the access to your personal data.

- To request a correction.

- To request the cancellation.

- To request the limitation of treatment (use and disclosure).

- To oppose to the data processing, we are giving.

- The portability of your data.

- Revocation of consent to the processing of data.

The exercise of these rights is personal, which means that the interested party must request it from the person responsible for the protection of their data, that is, the Department of Information Protection.

To exercise any right of the above, you can download and fill the following form and send it along with the copy of your identification, through:

Email of the responsible person: privacidad@xcaret.com

Our phone number: +52 (998) 884-9422 Ext. 11469.

Business hours: From Monday to Friday from 9:00 a.m. to 7 p.m.

We will assist you quickly, within a period no longer than 15 business days. We advise you to keep your data updated so that we can provide a more personalized service.

The information we collect will be securely retained for a maximum of one year from the date of collection unless you request its deletion or there is a legal obligation to retain it for a longer period. After that timeframe, we will securely delete the data, your sensitive personal data will be deleted using best practices once your participation in the event has ended.

It is important to note that we do not share, transfer, or sell your information with any company.

The protection of your information

We have implemented security measures to take care of your data:

- Use of SSL (Secure Socket Layer) certificates on our sites.

- Security procedures with our staff.

- Limitation of access to the databases where the data is stored.

- Implementation of best practices on servers to keep your information safe.

- Implementation of controls to comply with the LFPDPPP and the RGPD.

Use of images and sounds collected through our internal video surveillance systems

We are concerned for the safety of our visitors, guests, and collaborators, as well for our administrative facilities, hotels, and parks, it's necessary to communicate that we have internal systems and video recording circuits, which can capture images and, in some cases, sounds which are consider as personal data, which will be treated and protected in the terms provided in this privacy notice.

- The LFPDPPP (Regulation of the Federal Law on Protection of Personal Data Held by Private Individuals) which is the law that is responsible for protecting personal data in Mexico.

- The GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27th, on the protection of natural persons) which is the new regulation of the European Union regarding the regulation of processing the personal data.

If you believe that your rights have been violated regarding the protection of personal data, you have the right to go to the appropriate authority to defend its exercise. The authority is the National Institute of Transparence, Access to Information and Personal Data Protection (INAI), through their website: www.inai.org.mx/

When you provide us with your information and check the consent box, it means that you agree to have your information processed in the terms.

We recommend that you check this PRIVACY NOTICE periodically, since we make updates and changes to adapt it to the laws that apply in terms of the protection of personal data and internal policies.

In case of entering your personal data in any of our purchase forms check the acceptance checkbox, you will be notified about the update.

Last updated on 08/07/2023 (August 7th, 2023).