Privacy Policy

This Privacy Policy is a courtesy English translation of the original Spanish-language Aviso de Privacidad. In the event of any discrepancy or conflict between the two versions, the Spanish version shall prevail.

This Privacy Notice applies to individuals who have, or intend to have, a legal, commercial, contractual, employment, professional, or any other type of relationship with the Controller, including: clients, prospects, consumers, visitors, or any other data subject.

1. Identity and address of the Controller

The Controller responsible for the processing of your personal data is Global Resort Transfer, Inc., with address at Calle Xpuhil Sur SM. 19 Mz. 2 Lote 26, Edif. Mayacan 8, Cancún, Quintana Roo, Mexico C.P. 77500.

For any matter related to the processing of your personal data, you may contact the Data Protection Office through the following means:

2. Personal data we collect

In order to fulfill the purposes set out in this Privacy Notice, the Controller may collect and process the following categories of personal data, as applicable to the nature of the relationship it maintains with you:

2.1 Identification and contact data

• First and last name
• Date of birth
• Age
• Marital status
• Nationality
• Occupation
• Address
• Phone number
• Email address

2.2 Official identification data

• Official identification documents
• Unique Population Registry Code (CURP)
• Social Security Number

2.3 Asset-related and/or financial data

• Credit or debit card information

The Controller informs you that, for the fulfillment of the purposes set out in this Privacy Notice, it does not request or process sensitive personal data, in accordance with the provisions of the Mexican Federal Law on the Protection of Personal Data Held by Private Parties.

3. How personal data is obtained

The Controller may obtain your personal data directly, indirectly, or automatically.

3.1 Direct collection

We collect your personal data when you provide it to us directly, whether in physical, verbal, telephone, digital, or electronic form, for example through:

• Physical or electronic forms
• Information requests
• Contracts, agreements, forms, and legal documents
• Emails
• Websites, landing pages, and online forms
• Phone calls, video calls, or contact center
• Instant messaging
• In-person assistance
• Surveys, promotions, events, or commercial activities

3.2 Indirect collection

We may obtain your personal data through authorized third parties or sources permitted by law, for example:

• Affiliated, subsidiary, or related companies
• Business partners
• Suppliers or data processors
• Commercial or personal references
• Commercial prospecting platforms used to attract prospects interested in the services of Global Resort Transfer, Inc.
• Third parties acting on your behalf or for your account
• Business associates or intermediaries

3.3 Automatic collection

When you interact with our systems, portals, or platforms, we may obtain information automatically through technologies such as cookies, web beacons, pixels, scripts, server logs, or other similar tools.

4. Purposes of processing personal data

Your personal data will be processed in accordance with the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and accountability.

4.1 Primary purposes

Primary purposes are those necessary for the existence, maintenance, and fulfillment of the legal relationship between you and the Controller. These may include, as applicable:

• Identifying you and verifying your identity
• Compiling, updating, and safeguarding your file
• Handling requests for information, quotes, or contracting
• Following up on commercial, operational, administrative, or contractual processes
• Formalizing the legal or contractual relationship
• Providing products, services, benefits, memberships, subscriptions, access, or functionalities
• Managing payments, collections, billing, refunds, and clarifications
• Complying with legal, contractual, regulatory, and tax obligations
• Addressing complaints, claims, incidents, or requests
• Providing support, customer service, or after-sales service
• Managing access to facilities, platforms, systems, or events
• Maintaining communication related to the operation, administration, and continuity of services
• Performing security validations, fraud prevention, auditing, internal control, and risk management
• Complying with requirements from competent authorities

4.2 Secondary purposes

Additionally, unless you express your refusal, your personal data may be processed for secondary purposes that are not necessary for the legal relationship, such as:

• Sending advertising, promotions, newsletters, and commercial communications
• Commercial prospecting
• Marketing and advertising
• Building commercial profiles and market segmentation
• Satisfaction, quality, and customer experience surveys
• Statistical analysis, internal reports, business intelligence, and market research
• Invitations to events, campaigns, promotions, or special programs
• Use of image, photography, audio, or video for promotional, advertising, or institutional purposes, where applicable

If you do not wish your personal data to be processed for any or all secondary purposes, you may state so by sending your request to privacidad@globalvacation.trade.

Your refusal to allow the use of your personal data for secondary purposes may not be used as grounds to deny you the products or services you request or contract.

5. Mechanism to refuse processing for secondary purposes

You may refuse your consent to the processing of your personal data for secondary purposes now or at any later time, by sending a request to the email address privacidad@globalvacation.trade, or by means of a written request submitted at Calle Xpuhil Sur SM. 19 Mz. 2 Lote 26, Edif. Mayacan 8, Cancún, Quintana Roo, Mexico C.P. 77500.

The request must contain at least:

• Full name of the data subject
• A means to communicate the response to you
• A clear description of the secondary purposes for which you wish to express your refusal
• Documents proving your identity and, where applicable, legal representation

6. Transfers of personal data

We inform you that your personal data may be transferred within or outside the national territory, in the cases provided by law or where necessary to fulfill the purposes described in this Privacy Notice.

6.1 Transfers that do not require consent

The Controller may transfer your personal data without requiring your consent in the cases permitted by applicable law, including those set out in Article 37 of the Mexican Federal Law on the Protection of Personal Data Held by Private Parties and other applicable provisions.

6.2 Transfers that do require consent

Where transfers requiring your consent are made, such consent will be obtained expressly in accordance with applicable regulations.

6.3 Third-party recipients of the data

7. Means and procedure to exercise ARCO rights

You have the right to Access, Rectify, Cancel, or Object to the processing of your personal data, as well as to revoke any consent you may have granted for its processing.

To exercise your ARCO rights, you must submit a request through any of the following means:

7.1 Requirements of the request

The request must contain at least:

• Full name of the data subject
• Address or means to communicate the response to you
• Documents proving the identity of the data subject or, where applicable, legal representation
• A clear and precise description of the personal data in respect of which an ARCO right is sought to be exercised
• Any element or document that facilitates locating the personal data
• In the case of rectification, documentation supporting the requested modification

7.2 Proof of identity and representation

The data subject must prove their identity with a valid official document. In the case of legal representation, legal standing must additionally be evidenced through the corresponding legal document.

7.3 Response timelines

The Controller will communicate the determination adopted regarding your request within a maximum of 20 business days from the date the complete request is received. If found to be applicable, it will be made effective within the following 15 business days.

The timelines indicated above may be extended once for an equal period when the circumstances of the case justify it.

If the request does not meet the legal requirements or is insufficient, the Controller may request additional information within the timelines established by applicable regulations.

8. Revocation of consent

You may revoke any consent you have granted for the processing of your personal data by means of a request submitted through the means indicated in the preceding section.

However, please note that in certain cases it will not be possible to address your revocation request immediately or in full, since we may be required to continue processing your personal data due to a legal obligation. Likewise, the revocation of consent may mean that we can no longer provide you with certain services or maintain the corresponding legal relationship.

9. Use of cookies, tracking technologies, and remote means

We inform you that on our website, applications, platforms, or systems we may use cookies, web beacons, pixels, SDKs, scripts, and other technologies that allow us to monitor your behavior as an internet user, provide you with a better experience, improve our services, remember preferences, perform statistical analysis, and, where applicable, offer you personalized content or advertising.

9.1 Data that may be collected by these technologies

• IP address
• Session identifiers
• Browser type
• Operating system
• Preferred language
• Date and time of browsing
• Sections visited
• Time spent
• Referring sites
• Consumption or browsing patterns
• Device identifiers

9.2 Purposes of using these technologies

• Statistical analysis and traffic measurement

9.3 Mechanisms to disable them

You may disable or adjust the use of these technologies through your browser settings, operating system, or through the consent management tools that the Controller may make available to you. However, please note that if you disable them, some website functionalities may be affected.

10. Processing of personal data of minors and persons under guardianship or incapacity

Our services are not directed at minors or persons under legal guardianship or incapacity. Consequently, we do not knowingly collect, request, or process the personal data of such individuals.

11. Retention and security of personal data

The Controller will retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Notice and/or in accordance with applicable legal, contractual, accounting, tax, administrative, or regulatory timelines.

Likewise, the Controller implements and maintains reasonable and appropriate administrative, technical, and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing.

12. Automated processing and profiling

The Controller states that it does not carry out automated decision-making processes without human intervention that produce legal effects or significantly affect the data subject.

13. Changes or updates to the privacy notice

This Privacy Notice may be modified, updated, or adjusted as a result of:

• Legal or regulatory reforms
• New requirements from authorities
• Changes in services, products, or business model
• Implementation of new technologies or processes
• Changes in internal privacy practices

Any change to this Privacy Notice will be made available through the website: globalvacation.trade/privacy.

14. Consent of the data subject

The data subject declares that they have read, understood, and accepted the terms of this Privacy Notice, and that they grant their free, express, and informed consent to the processing of their personal data in accordance with the purposes set out in this document, except in the cases of exception provided by applicable law. This consent will be deemed granted once this Privacy Notice is accepted, without prejudice to the data subject's right to revoke it at any time through the procedure established for that purpose.

Last updated: April 7, 2026.