Privacy Notice

PRIVACY NOTICE related to personal data, collected by ODIGOO VIAJES S.A. DE C.V

ODIGOO VIAJES S.A. DE C.V. is a company committed and respectful to the rights over personal data of natural persons and any legal entity, recognized in article 16, paragraph II of the Political Constitution of the United Mexican States, as well as the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter the "LFPDPPP" or the "Law", interchangeably). Therefore, it makes this Privacy Notice available to you:

Privacy Statement

Responsible for the protection and treatment of your Personal Data

ODIGOO VIAJES S.A. de C.V. (Hereinafter ODIGOO TRAVEL with electronic address www.odigootravel.com/

How we collect personal information?

The personal data that ODIGOO VIAJES collects from you will be used only for the purposes described in this privacy notice and may be collected by the following channels:

• Directly, by entering your data or using online services through the website www.odigootravel.com/ and our mobile application.
• Directly, through our telephone reservation center ("call center").
• Directly, through our official social media accounts.
• In a personal way, through our reservation’s representatives.
• In a personal way, through the Islands of ODIGOO VIAJES in shopping malls or public squares.

Data collected

When you use our platform, Apps, or associated tools or services, we may collect the following kinds of personal information from you as needed:

• Name, email address, telephone number, and home, business, and billing addressees.
• Payment information such as payment card number, expiration date, and billing address.
• Government issued Identification required for booking or identity verification, such as passport, driver’s license, and government redress numbers, and for vacation property owners, tax identification number.

In addition to this, ODIGOO TRAVEL in special cases will request to collect your physical image (photography and / or video), for which ODIGOO TRAVEL will enable the appropriate means to obtain the consent of the holders in accordance with the provisions of the LFPDPPP and its regulations.

Use of Personal Information

Your personal data will be collected for the following purposes that are necessary for the service you request:

• Processing, monitoring, updating, cancelling and confirming your reservation of any of the products or services offered in ODIGOO TRAVEL. This is done for financial and credit purposes to comply with the obligations contracted with you (our customer) and with our suppliers.
• Furthermore, the data that is collected will be used to stay in contact with you in order to notify any update on your reservation as well as to offer more information about our products and services

In addition, we will also use your personal information for the following purposes that are not necessary for our services, but that allow us to improve our customer experience:

• Measure the quality of our services, conduct surveys on travel habits and preferences, to invite our customer to participate in contests and sweepstakes as well as in loyalty programs; to design, implement and develop advertising campaigns; and to send promotions, offers, services and advertising purposes ( Unique and exclusively for ODIGOO TRAVEL).

Customers can unsubscribe at any time and free of charge of any mailing and advertising services by ODIGOO TRAVEL just clicking on the link "Cancel subscription".

In case you do not want your personal data to be used for these additional purposes, you can submit a letter via email to the following address: contact@odigootravel.com.

Information Transfers (National and International)

By virtue of the provisions of articles 36 and 37 of the LFPDPPP, your personal data may be transferred and / or shared to:

• a) Holding companies, subsidiaries or affiliates under the common control of ODIGOO TRAVEL, or a parent company or any company of the same group of ODIGOO TRAVEL that operates under the same processes and policies;
• b) When the transfer is needed for the maintenance or fulfillment of a legal relationship between the controller and the owner such as suppliers, tourist Service providers, banks and credit institutions among others.
• c) When the transfer is needed for the maintenance or fulfillment of a legal relationship between the controller and the owner such as suppliers, tourist Service providers, banks and credit institutions among others.

It is important to note that the third parties to whom your personal data is transferred will be bound by the same terms of this Privacy Notice and will comply with the corresponding security and confidentiality measures.

By all means, we are committed to not transfer your personal information to third parties without your consent, except in the case of the provisions of article 37 of the Federal Law on Protection of Personal Data Held by Private Parties, as well as to carry out this transfer in the terms established by said Law.

Realization and rights of ARCO

Article 28 of the LFPDPPP gives you four rights to exercise:

• The data owner (the customer) has the right to access their personal data held by the person in charge and to know the Privacy Notice and its purposes.
• The data owner (the customer) has the right to correct their data if it is inaccurate, incorrect or out of date.
• The data owner (the customer) has the right to cancelhis personal data when he considers that they are not being used for the fulfillment of the purposes established in this Privacy Notice.
• The owner has the right to oppose the processing of their personal data regarding any of the purposes established in this Privacy Notice.

Right to revoke your consent for data processing

Article 8 of the LFPDPPP provides the right of revoking the consent granted for the processing of your personal data. You may request the revocation using the same mechanisms and procedures to exercise the ARCO Rights provided in this notice. However, ODIGOO TRAVEL informs you that keeping your personal data in its database will allow it to have a better understanding of your needs based on your history and, thus, offer you a better service in future reservations.

Mechanisms to exercise ARCO Rights and Revocation of consent for the processing of your data

To exercise your rights of data access, rectification, cancellation and opposition; or your right to revoke consent for the processing of your personal data, you must fill out and send the ARCO RIGHTS EXERCISE FORM, which you can download here. Once it is filled, you must send it to contacto@odigooviajes.com , send it physically to the following address: Avenida Nichupté Mz 05 Lote 08-01 Local 102 Cancun, Quintana Roo CP 77505 to the Data Protection Department. For more information, you can communicate directly to XXXXXXX Data Protection Department through the email account indicated above.

To proceed with the exercise of your ARCO Rights, you must prove the ownership of your ARCO rights or that you are representing them on behalf the data owner (the customer). For this, you will need to deliver either a copy of an identification document as well as to show the original, or any of the legal instruments established in the article 89 of the LFPDPPP regulations.

"Article 29.- The request for access, rectification, cancellation or opposition must contain the following:

• I. The owner's name and address in order to communicate the answer to his / her petition;
• II. The documents that prove the identity or, when needed, the legal representation of the data owner;
• III. A clear and precise description of the personal data in which the customer wants to exercise any of the aforementioned rights, and
• IV. Any other element or document that helps to determine the location of personal data on the process.”

ODIGOO TRAVEL will follow up on your request with the complete documentation within a period of 20 business days from the receipt of said FORM or request to inform you about how it will proceed. In case the request proceeds, ODIGOO TRAVEL will have a maximum period of 15 business days to make the ARCO right effective.

Information Security

Personal Data will be protected under strict confidentiality to prevent its misuse or disclosure. We have implemented physical, technical and administrative security measures in accordance with the Federal Law on Protection of Personal Data Held by Private Parties and other applicable regulations.

In particular, we have a privacy policy, staff training courses, restricted access to personal information, privacy officials, an inventory of personal data (classified by data category), risk analysis and contractual clauses.

In order to limit the use and disclosure of your personal information, we offer you the option of registering in the Public Registry to avoid Advertising (REPEP), which is in charge of the Federal Consumer Protection Agency (PROFECO), with the Purpose that your personal data is not used to receive advertising or promotions from companies of goods or services. For more information on this registry, you can consult the PROFECO website, or you can contact it directly.

Changes to this privacy policy

We still reserve the right, at any time, to change or update this privacy policy. The amendments will be made available to the public through the following media: via our website or via email to the most recent address we have of you personally given by you, or through our representative at the time of going to any of our facilities.

Acceptance of terms

By entering and using the Site, you declare that you are understanding and accepting the terms and conditions contained in this Notice and you grant your acceptance and consent using electronic means for this purpose, in terms of the provisions of article 1803 of the Federal Civil Code.

If you do not fully and fully accept the terms and conditions of this Notice, you must refrain from providing any type of personal data to ODIGOO TRAVEL by any means, including the Site.

In the event that you provide ODIGOO TRAVEL with your personal data and / or continue to use the Site, said action will be considered as your absolute and express acceptance of the Notice in the terms of article 8 of the LFPDPPP, at the time you provide your personal data and / or when you have access or this Notice is made available to you.

Last Updaet on March 22nd 2021.