COMPREHENSIVE PRIVACY NOTICE
In compliance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (the “Law”).
1. Identity and Address of the Data Controller
BB Santiago de Querétaro, S.A. de C.V., operating commercially under the name Avanta Hotel & Villas (hereafter, the “Data Controller”), is responsible for the processing of personal data collected in connection with the provision of its services.
Address of the Data Controller:
Carretera Querétaro-San Luis Potosí 23800, Santa Rosa Jáuregui, Querétaro, 76220, Mexico.
Contact for privacy-related issues:
gerencia@avantahotel.com.mx
Telephone:
+524426287668
Website where this notice will be published:
https://avantahotel.com.mx
2. Personal Data to Be Processed
Depending on the service, service channel, and relationship with the Data Controller, the following categories of data may be processed, solely to the extent that they are necessary, appropriate, and relevant for the stated purposes:
| Category | Examples | Condition |
|---|---|---|
| Identification | Name, surname(s), date of birth, nationality, information contained in an identification document when necessary. | According to the service and applicable obligation. |
| Contact | Telephone number, email address, address, or information necessary for communication. | According to the relationship and purpose. |
| Reservation and Stay | Arrival/departure dates, room or villa, number of guests, requests and service preferences. | Necessary to manage the reservation and stay. |
| Billing | Name or corporate name, Federal Taxpayer Registry number, zip code, tax regime, purpose of the Digital Tax Receipt via Internet and information required to issue the tax receipt. | When the data subject requests, or issuance of the Digital Tax Receipt via Internet is applicable. |
| Payment | Information necessary to process payment and transaction data. | According to the processing model; the Data Controller does not state that it stores complete card details unless expressly confirmed. |
| Customer Service | Contact information and the content of requests, complaints, claims or comments. | When the data subject contacts the Data Controller. |
| Preferences/Services | Room preferences, requested services and consumption records. | When necessary to provide the service. |
| Video Surveillance | Images of persons entering areas subject to camera surveillance. | Only if a video surveillance system exists. |
| Digital Data | IP address, session identifiers, browser, operating system, cookies and browsing data. | Only if the website or app actually collects such data. |
| Marketing/Loyalty | Email address, telephone number, stay history and preferences. | Only for confirmed secondary purposes and with the applicable consent. |
The Data Controller will not request personal data that is not necessary, appropriate, or relevant for the stated purposes.
3. Sensitive Personal Data
Sensitive personal data is personal data that affects the most intimate sphere of the data subject or whose improper use could result in discrimination or serious risk, including, among others, data revealing health information.
If, in connection with food and beverage services, information regarding allergies, illnesses, medically motivated dietary restrictions, or needs related to a person’s health condition is requested, such information will be treated as sensitive personal data when, by its content, it reveals information about the person’s health. It will be processed solely for the specific purpose that justifies it, with access restricted to personnel who need it and subject to prior express written consent, by wet-ink signature, electronic signature, or applicable authentication mechanism, unless a legal exception applies.
Food or service choices will not be considered sensitive merely because they are preferences, when they do not reveal information about health or another category protected by the legal definition.
4. Sources and Means of Obtaining Personal Data
Data may be obtained directly from the data subject through reservation forms, check-in/check-out, billing requests, telephone communications, email, instant messaging, or other channels actually used by the establishment. Data may also be obtained indirectly through agencies, reservation platforms, companies making reservations for third parties, or persons making reservations for accompanying guests, as applicable.
When data has not been obtained directly from the data subject, the Data Controller will comply with provisions of Article 17 of the Law and will make the corresponding information available at the time legally required.
5. Purposes of Processing
Primary Purposes
These are the purposes necessary to establish, maintain, and fulfill the legal relationship and/or comply with applicable legal obligations of the Data Controller. They include, as applicable:
a) Manage, confirm, modify, and cancel reservations.
b) Carry out guest check-in and check-out procedures.
c) Identify the guest when necessary for the provision of the service or to comply with applicable obligations.
d) Register and manage persons staying with or accompanying the guest, to the extent necessary.
e) Manage the stay, assignment of rooms or villas, requested services, consumption, and charges.
f) Provide lodging and any other services actually contracted.
g) Process payments and manage transactions related to the services provided.
h) Issue tax receipts and comply with accounting, administrative, and tax obligations.
i) Handle and follow up on requests, complaints, claims, and comments.
j) Respond to emergencies and protect the integrity of persons and property.
k) Comply with applicable legal obligations, including those applicable to foreign guests.
l) Exercise or defend rights and respond to legally valid requests from competent authorities.
Secondary Purposes
These may include:
a) Sending promotions, offers, discounts, and event information.
b) Sending newsletters or informational communications.
c) Frequent Guest loyalty programs or benefits.
d) Satisfaction surveys for commercial or analytical purposes.
e) Communications regarding new services or experiences offered by the establishment.
Refusal to provide consent for a secondary purpose will not condition the provision of the primary services. The form of consent will be determined in accordance with Article 7 of the Law and the specific circumstances of the processing.
6. Consent
All processing will be subject to the consent of the data subject, except for the exceptions provided by the Law. Consent may be express or implied; as a general rule, implied consent is valid unless a legal provision requires express consent.
Financial or asset-related data requires express consent, except for the exceptions provided under Articles 9 and 36 of the Law. Therefore, when the processing of payment data is necessary to comply with obligations arising from the provision of services, the provisions of the Law shall apply.
Sensitive personal data requires express written consent, unless a legal exception applies.
The Data Controller will not use the expression “legitimate interest” as an autonomous legal basis for processing, since the current Law does not establish it as a general exception to the consent requirement. When security-related processing is carried out without consent, the specific exception under Article 9 of the Law that applies must be identified; in all other cases, the general consent regime shall apply.
7. Options to Limit the Use or Disclosure of Personal Data
The data subject may limit the use or disclosure of their data, particularly in regard to secondary purposes, through the mechanisms made available by the Data Controller:
- Decline consent for secondary purposes when consent is requested.
- Request in writing that promotional communications cease.
- Use, when available, the unsubscribe mechanism included in electronic communications.
- Exercise the right to object when legally applicable.
Email for these requests: gerencia@avantahotel.com.mx
8. Withdrawal of Consent
The data subject may withdraw consent when processing is based on such consent. Withdrawal will not have retroactive effect and will not prevent processing that must continue by law or pursuant to any of the exceptions provided by the Law.
The request must be sent to gerencia@avantahotel.com.mx, indicating the name, the means by which a response may be received, and the processing activity or purpose for which consent is to be withdrawn, as well as proof of identity when applicable.
9. Transfers and Communications of Personal Data
The Data Controller distinguishes between communications to data processors and transfers to third parties. A data processor processes data on behalf of the Data Controller and in accordance with its instructions; a transfer is the communication of data to a person other than the data subject, the Data Controller, or the data processor.
Transfers to third parties, whether domestic or foreign, shall be subject to Articles 35 and 36 of the Law. When a transfer requires consent, such consent will be requested in accordance with applicable law. When an exception under Article 36 of the Law applies, the transfer may be made without consent.
| Recipient/Category | Nature | Purpose | Consent |
|---|---|---|---|
| Tax authorities | Third party/authority | Compliance with tax obligations | No, when the transfer is provided for or required by applicable law. |
| Immigration authorities | Third party/authority | Compliance with legal obligations applicable to foreign guests | No, when a legal obligation applies. |
| Judicial, prosecutorial, or security authorities | Third party/authority | Responding to legally valid requests | No, when the corresponding legal exception applies. |
| Payment processors | Third party/provider | Payment processing | Depends on the legal nature and applicable exception. |
| Platforms/Online Travel Agencies | Third party/provider | Reservation management | Depends on the contract and operating model. |
| Technology providers | Data processors, when acting on behalf of the Data Controller | Hosting, PMS, CRM, billing, email marketing, or other services | They do not, by themselves, constitute transfers when acting as data processors. |
| Related companies/group | Third party/provider | Loyalty, corporate administration, or marketing | Only when there is a legal basis or consent, as applicable. |
10. Tracking Technologies, Cookies, and Similar Technologies
The Data Controller must identify the technologies actually used, their purpose, the data they generate, and the mechanisms available to manage them. The use of analytical or advertising cookies, geolocation, pixels, or other technologies that have not been confirmed is not declared.
11. VIDEO SURVEILLANCE
The Data Controller places visible notices at entrances and in monitored areas and maintains an internal policy subject to this Privacy Notice.
Video surveillance will be used exclusively for security purposes and the protection of individuals and property, the prevention and handling of incidents, and compliance with applicable legal obligations, to the extent applicable.
Images will be retained for the minimum period necessary to fulfill the stated purposes.
12. Access, Rectification, Cancellation, and Opposition Rights
The data subject or their legal representative may exercise, at any time, the rights of Access, Rectification, Cancellation, and Objection (ARCO Rights) with respect to their personal data.
To submit an ARCO request, the applicant must provide, at a minimum: name and address or means for receiving notices; documents proving identity or legal representation; a clear and precise description of the data regarding which the right is being exercised, except in the case of access; the right being exercised; and any information that facilitates the location of the data.
For rectification, the applicant must specify the requested modifications and provide supporting documentation.
Requests must be sent to:
gerencia@avantahotel.com.mx
The Data Controller will communicate its determination within a maximum period of twenty days and, if the request is granted, will make it effective within the following fifteen days from the date on which the response is communicated. These periods may be extended once for an equal period when circumstances justify such extension.
13. Right to Object and Automated Processing
The data subject may object to processing on legitimate grounds when their specific situation justifies it and the continuation of the processing could cause them harm or prejudice. Likewise, the data subject may exercise the right to object in cases of automated processing that produces unwanted legal effects or significantly affects their interests, rights, or freedoms, pursuant to Article 26 of the Law.
14. Security Measures and Data Breaches
The Data Controller will establish and maintain administrative, technical, and physical measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, taking into consideration the risk, possible consequences, sensitivity of the data, and technological developments.
Individuals involved in any stage of the processing will be subject to confidentiality obligations that shall survive the termination of their relationship with the Data Controller.
When a security breach significantly affects the property or moral rights of data subjects, the Data Controller will inform them immediately in accordance with Article 19 of the Law.
15. Retention, Blocking, and Deletion
Data will be retained only for the time necessary to fulfill the stated purposes and applicable legal obligations. Once it is no longer required, it will be deleted following blocking, when applicable, after the retention period has expired.
16. Changes to the Privacy Notice
The Data Controller may modify or update this notice to reflect legal, operational, or data-processing changes. Modifications will be communicated through the website https://avantahotel.com.mx
17. CONTACT
For questions, comments, requests to limit use, withdrawal of consent, or exercise of Access, Rectification, Cancellation, and Opposition Rights:
Address:
Carretera Querétaro-San Luis Potosí 23800, Santa Rosa Jáuregui, Querétaro, 76220, Mexico.
Email:
gerencia@avantahotel.com.mx
Telephone:
+524426287668