Aimbridge LATAM & All-InclusivePrivacy Policy

PRIVACY NOTICE

AIMBRIDGE LATAM, S.A.P.I. DE C.V.

In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, and all other applicable legal and administrative provisions regarding personal data protection, AIMBRIDGE LATAM, S.A.P.I. DE C.V. (“Aimbridge” or the “Company”), with Federal Taxpayer Registry number GAP1209188M5, located at Calle Benito Juárez number 1102, Piso 48, Colonia Monterrey Centro, C.P. 64000, Monterrey, Nuevo León, Mexico (the “Address”), website https://aimbridgelatam.com/ and email protecciondedatos@aimbridgelatam.com, is responsible for the processing, use, protection, and safeguarding of the personal data collected from data subjects.

Aimbridge is a company engaged, among other activities related to its corporate purpose, in the operation, administration, management, promotion, and provision of services related to hotel establishments, and may act as operator and/or manager of various hotels owned by third parties and operating under different brands, franchises, or commercial schemes (the “Hotel Portfolio”).

1. PERSONAL DATA COLLECTED AND MEANS OF COLLECTION

Aimbridge may collect personal data directly from the data subject, in person or through physical, electronic, digital, telephone, or technological means; as well as indirectly through authorized third parties, publicly available sources, and any other means permitted by applicable law.

Personal data may be incorporated into and stored in contracts, files, applications, forms, computer systems, platforms, databases, physical and/or electronic records, and other media used by Aimbridge for the performance of its activities.

Depending on the relationship with the data subject, Aimbridge may collect the following categories of information:

A. EMPLOYEES

Aimbridge may collect from its employees the personal data necessary to establish, document, administer, maintain, and comply with the employment relationship. Such data may include: a) full name; b) address; c) date and place of birth; d) nationality; e) marital status; f) gender; g) telephone numbers; h) email address; i) Unique Population Registry Code (CURP); j) Federal Taxpayer Registry (RFC); k) social security number; l) academic, professional, and technical information; m) employment background and career history; n) information related to training and professional experience; o) economic, patrimonial, tax, and banking information necessary for the payment of salaries and benefits; p) photographs; q) official identifications; r) emergency contact information; s) information of relatives, beneficiaries, and economic dependents; t) personal and employment references; and u) any other information necessary to administer and comply with the employment relationship and the legal obligations arising therefrom.

B. CANDIDATES

Aimbridge may collect personal data from individuals interested in participating in its recruitment and selection processes, including: a) full name; b) address; c) date and place of birth; d) nationality; e) marital status; f) gender; g) telephone number; h) email address; i) CURP; j) RFC; k) academic information; l) technical training; m) certifications; n) work experience and employment history; o) personal and professional references; p) information contained in the résumé or curriculum vitae; q) photographs; r) professional and economic expectations; and s) any other information related to the professional profile necessary to evaluate the application.

C. SUPPLIERS, SERVICE PROVIDERS, AND CONTRACTORS

Aimbridge may collect from suppliers, service providers, contractors and, where applicable, their representatives, employees, or contact persons, information such as: a) full name; b) nationality; c) date and place of birth; d) address; e) telephone number; f) email address; g) profession or occupation; h) RFC; i) CURP; j) official identification; k) signature; l) tax information; m) banking information necessary to process payments; n) contractual information; and o) contact and representation information.

When the supplier or service provider is a legal entity, Aimbridge will only consider as personal data the information corresponding to individuals related to such entity and subject to protection under applicable law.

D. CLIENTS AND/OR GUESTS

Aimbridge and/or the establishments comprising its Hotel Portfolio may collect personal data from clients and guests for the purpose of managing the provision of hotel services and related services.

Such data may include: a) full name; b) date of birth; c) nationality; d) address; e) email address; f) telephone number; g) official identification; h) information related to reservations and stays; i) accompanying guests’ information, when applicable; j) tax information for invoicing; k) RFC; l) information related to vehicles used to access the facilities; m) preferences related to the stay and requested services; n) information related to loyalty programs, when applicable; and o) any other information necessary to provide the requested services.

Information related to payment methods will be processed exclusively to the extent necessary to process the corresponding transactions and in accordance with applicable security measures and provisions.

2. SENSITIVE PERSONAL DATA

As a result of certain employment relationships, hiring processes, service provision, emergency response, or compliance with legal obligations, Aimbridge may exceptionally collect and process sensitive personal data, including, when strictly necessary, information related to present or future health status, disabilities, medical leaves, medical certificates, medical restrictions, or equivalent information.

Such data will be processed only when necessary for the corresponding purposes and under enhanced security and confidentiality measures, ensuring that its processing is essential and proportionate to the purpose that justifies it.

When applicable law requires the express and/or written consent of the data subject for the processing of such data, Aimbridge will obtain it in advance through legally permitted mechanisms.

In all cases, Aimbridge will presume that personal data provided directly by data subjects is accurate, complete, correct, and up to date, and it will be the responsibility of the data subject to communicate any necessary modification or correction.

3. PURPOSES OF PERSONAL DATA PROCESSING

The personal data collected will be used for the following purposes:

A. EMPLOYEES

Aimbridge may process employees’ personal data to: a) establish, maintain, and administer the employment relationship; b) create and keep the employment file updated; c) comply with obligations arising from the Federal Labor Law, social security, tax, and other applicable provisions; d) manage payroll, salaries, benefits, compensation, and other benefits; e) carry out registrations, terminations, and changes before the corresponding authorities and institutions; f) administer employment benefits; g) provide training and professional development; h) conduct performance evaluations; i) administer access and security measures; j) respond to emergencies; k) conduct audits and internal controls; l) prevent, detect, and investigate possible breaches, misconduct, or acts contrary to internal policies; m) respond to requests from administrative or judicial authorities; n) comply with contractual, legal, and regulatory obligations; and o) administer, document, and, where applicable, terminate the employment relationship.

B. CANDIDATES

Candidates’ personal data may be used to: a) manage employment applications; b) identify and contact the candidate; c) analyze the candidate’s academic, professional, and employment profile; d) verify the information and references provided; e) conduct evaluations related to the requested position; f) conduct, when appropriate and permitted by applicable law, socioeconomic studies and verifications necessary for the process; g) determine hiring feasibility; h) maintain communication during the recruitment process; i) create candidate files; and j) consider the candidate for current or future employment opportunities, when applicable.

C. SUPPLIERS, SERVICE PROVIDERS, AND CONTRACTORS

Personal data relating to suppliers may be used to: a) identify and register the supplier; b) evaluate, select, and contract suppliers and service providers; c) create and update files; d) manage commercial and contractual relationships; e) prepare contracts, purchase orders, and related documentation; f) administer requests and contracted services; g) make and verify payments; h) process invoices and tax documentation; i) make the corresponding tax withholdings; j) verify identity, representation, and documentation; k) administer access and security controls; l) conduct audits; m) prevent and detect fraud or irregularities; n) comply with legal, contractual, tax, civil, commercial, and administrative obligations; and o) respond to requests from competent authorities.

D. CLIENTS AND/OR GUESTS

Personal data relating to clients and guests may be used to: a) manage reservations; b) provide lodging services; c) administer guest registration, stay, and check-out; d) identify the guest and verify their information; e) provide services requested during the stay; f) address requests, inquiries, complaints, and comments; g) administer charges and payments; h) issue invoices and tax receipts; i) administer loyalty programs, when applicable; j) ensure the security of guests, visitors, employees, and facilities; k) respond to emergency situations; l) maintain administrative and operational records; m) prevent and detect possible fraud, unlawful conduct, or security incidents; n) comply with contractual obligations; o) comply with legal, tax, administrative, civil, and commercial obligations; and p) respond to requests and requirements made by legally authorized authorities.

When Aimbridge intends to use personal data for any secondary purpose that is not necessary to maintain the corresponding legal relationship and requires the data subject’s consent under applicable law, the data subject will be informed and provided with the corresponding mechanisms to express refusal.

Once the purposes that justified the processing have been fulfilled, Aimbridge will retain personal data exclusively for the periods necessary to comply with applicable legal, contractual, administrative, tax, labor, or any other obligations.

After such periods have expired, Aimbridge will proceed with the blocking and subsequent deletion of personal data in accordance with applicable law and its internal information retention policies.

4. TRANSFERS OF PERSONAL DATA

For the fulfillment of the purposes set forth in this Privacy Notice, Aimbridge may carry out domestic or international transfers of personal data when such transfers are necessary, legally permitted, or fall within any of the circumstances in which applicable law allows them without requiring the data subject’s consent.

Depending on the relationship with the data subject, data may be transferred, when necessary, to:

A. EMPLOYEES

a) Administrative, tax, labor, and judicial authorities; b) social security institutions; c) banking institutions; d) insurance companies; e) benefit providers; f) occupational health and medical service providers; g) payroll and human resources administration providers; h) controlling, parent, subsidiary, affiliate, or related companies of Aimbridge, when applicable; i) owners of the hotel establishments managed by Aimbridge when necessary; j) franchisors and/or hotel brands when necessary for the operation; k) advisors, auditors, and professional service providers; and l) third parties whose involvement is necessary to administer and comply with the employment relationship.

B. CANDIDATES

Data may be transferred, when legally appropriate, to Aimbridge’s parent, controlling, subsidiary, affiliate, or related companies; providers participating in recruitment and selection processes; evaluation and verification service providers; owners of hotel establishments when necessary for the corresponding position; and legally authorized authorities.

C. SUPPLIERS

Data may be transferred to parent, subsidiary, affiliate, or related companies; owners of hotel establishments; financial institutions; auditors; advisors; franchisors, when applicable; technology providers; professional service providers; and competent authorities, to the extent necessary to administer and comply with the commercial or contractual relationship.

D. CLIENTS AND/OR GUESTS

Personal data may be transferred, when necessary to provide the requested services, to: a) owners of hotel establishments; b) relevant franchisors and hotel brands; c) reservation platforms and systems; d) service providers related to the stay; e) financial institutions and payment processors; f) insurance companies when necessary; g) parent, subsidiary, affiliate, or related companies; h) technology providers; i) advisors and auditors; and j) legally authorized administrative or judicial authorities.

Aimbridge will adopt the reasonable measures necessary to seek that third-party recipients of personal data process such data in accordance with the corresponding purposes and applicable security and confidentiality obligations.

When a transfer requires the data subject’s consent under applicable law, Aimbridge will obtain such consent in advance.

5. MEANS AND PROCEDURES FOR EXERCISING ARCO RIGHTS

The data subject or, where applicable, their duly accredited legal representative, may exercise at any time the rights of Access, Rectification, Cancellation, and Opposition (“ARCO Rights”), in accordance with applicable law.

The data subject has the right to: a) access the personal data Aimbridge maintains about them, as well as the conditions and general aspects of its processing; b) request the correction or update of personal data when it is inaccurate, incomplete, incorrect, or outdated; c) request that personal data be deleted from Aimbridge’s files, records, systems, and databases when legally appropriate; and d) request the cessation of the processing of personal data for certain purposes, when applicable.

To exercise any of these rights, the data subject must submit a request through the email address indicated in this Privacy Notice or by written notice submitted at Aimbridge’s Address.

The request must contain, at least: a) the full name of the data subject; b) a means to communicate the response; c) documents that allow verification of the data subject’s identity and, where applicable, the authority of their representative; d) a clear and precise description of the personal data with respect to which any ARCO Right is intended to be exercised; e) indication of the right intended to be exercised; f) in the case of rectification requests, the requested changes and supporting documentation when applicable; and g) any other element that facilitates the location of the personal data.

Aimbridge will process and respond to requests within the timeframes and in accordance with the procedure established by applicable law.

6. REVOCATION OF CONSENT AND LIMITATION ON THE USE OR DISCLOSURE OF PERSONAL DATA

The data subject may, at any time and when legally appropriate, revoke the consent previously granted for the processing of their personal data. Revocation will not have retroactive effects and will not apply when processing is necessary to comply with a legal or contractual obligation or any other cause that legitimizes processing under applicable law. Likewise, the data subject may request limitation on the use or disclosure of their personal data.

To exercise these rights, the data subject must submit a request through the email address indicated in this Privacy Notice or by written notice submitted at Aimbridge’s Address, complying with the requirements set forth in the previous section.

When personal data has been lawfully communicated to processors or third parties prior to the corresponding revocation or limitation, Aimbridge will adopt the applicable measures in accordance with applicable law.

7. SECURITY AND CONFIDENTIALITY MEASURES

Aimbridge will implement and maintain reasonable and necessary administrative, technical, and physical security measures to protect personal data against damage, loss, alteration, destruction, unauthorized use, access, or processing. Aimbridge personnel and third parties involved in any stage of processing must keep confidential the personal data to which they have access, and such obligation will continue even after the corresponding relationship ends. Aimbridge will periodically review its security measures considering, among other factors, the existing risk, possible consequences for data subjects, sensitivity of the data, technological development, and other circumstances related to its processing.

8. USE OF TECHNOLOGIES AND ELECTRONIC MEANS

Aimbridge may use systems, platforms, and technologies necessary for the administration of its employment, commercial, contractual, and service relationships. When Aimbridge’s website, applications, platforms, or systems use technologies that allow personal data to be collected automatically and simultaneously while the data subject uses such means, the corresponding information and mechanisms will be provided to inform about their use and, when applicable, allow their disabling.

9. CHANGES TO THE PRIVACY NOTICE

Aimbridge reserves the right to modify, update, or supplement this Privacy Notice at any time as a result of legislative or regulatory changes, changes in its internal processes, new requirements for the provision of its services, changes in its privacy practices, or any other justified cause. Any amendments to this Privacy Notice will be made available to data subjects through the website and/or by the physical or electronic means determined by Aimbridge according to the circumstances and applicable legal provisions. When amendments imply new purposes or processing activities that require renewed consent from the data subject under applicable law, such consent will be obtained in advance.

10. CONSENT

When the processing of personal data requires the data subject’s consent under applicable law, Aimbridge will obtain such consent through legally permitted mechanisms, taking into account the type of information, nature of the processing, and other applicable circumstances. In those cases where the law permits the processing of personal data without the data subject’s consent, Aimbridge may carry out such processing exclusively under the terms and conditions provided by applicable provisions.

Last updated: August 2026.