PRIVACY NOTICE Airport Travel Advisors, S.A. de C.V., located at Carretera Cancún - Aeropuerto Km. 12.5, Edificio DIA 3er Piso, Lote 3, Oficina 1, Alfredo V. Bonfil, C.P. 77560, in the city of Cancún, Quintana Roo, is responsible for the processing of your personal data. Your personal information will be used to provide the services we offer; inform you about changes or new products or services; and evaluate the quality of the service. For the aforementioned purposes, we require the following personal data: Name, place of lodging, airline, arrival date, departure time, and date; considering that we will not request personal data categorized as sensitive under the Federal Law on Protection of Personal Data Held by Private Parties. At any time, you may exercise your right to access, rectify, and cancel your personal data, as well as oppose the processing thereof or revoke the consent granted to us for such purpose, through our established procedures and requirements. To do so, you may contact our personal data department via email at: avisos@airport-ta.com. Furthermore, we inform you that your data may be transferred and processed both within and outside the country by parties other than this company. In this regard, your information may be shared with various service providers, such as individuals or legal entities with whom we have a legal or business relationship, in order to provide the services requested by you. If you do not express your opposition to the transfer of your personal data, it shall be understood that you have granted us your consent. PROCEDURE FOR ACCESS, RECTIFICATION, CANCELLATION, AND OPPOSITION OF DATA (ARCO RIGHTS) In accordance with Chapter IV of the Federal Law on Protection of Personal Data Held by Private Parties, the procedure for the access, rectification, cancellation, or opposition of personal data is made available to the general public. A. The owner of the personal data may request from this company at any time the access, rectification, cancellation, or opposition regarding the data concerning them, through a written request that must contain and be accompanied by, at least, the following: I. The name of the owner and address or other means to communicate the response to the request (email, fax, etc.). II. Documents proving identity or, where appropriate, the legal representation of the owner. III. A clear and precise description of the personal data regarding which one seeks to exercise any of the aforementioned rights. IV. Any other element or document that facilitates the location of the personal data. B. In the case of requests for rectification of personal data, the owner must indicate, in addition to the above, the modifications to be made and provide the documentation supporting the petition. C. The company will communicate to the owner, within a maximum period of twenty days, counted from the date the request was received, the determination adopted so that, if appropriate, it becomes effective within fifteen days following the date the response is communicated. In the case of requests for access to personal data, delivery will proceed upon prior accreditation of the identity of the applicant or legal representative. The aforementioned periods may be extended only once for an equal period, provided that the circumstances of the case justify it. D. The obligation of access to information shall be deemed fulfilled when the personal data are made available to the owner; or through the issuance of simple copies, electronic documents, or any other means determined by the company in the privacy notice. E. The company may deny access to personal data, or the rectification, cancellation, or opposition to the processing thereof, in the following cases: I. When the applicant is not the owner of the personal data, or the legal representative is not duly accredited. II. When the applicant's personal data are not found in the database. III. When the rights of a third party are injured. IV. When there is a legal impediment or a resolution from a competent authority that restricts access or does not allow for rectification, cancellation, or opposition. V. When the rectification, cancellation, or opposition has been previously carried out. F. The delivery of personal data shall be free of charge, and the owner shall only cover the justified shipping costs or the cost of reproduction in copies or other formats. However, if the same person repeats their request within a period of less than twelve months, the costs shall not exceed three days of the General Minimum Wage in force in the Federal District (Mexico City), unless there are substantial modifications to the privacy notice that motivate new inquiries. CHANGES TO THE PRIVACY NOTICE This privacy notice may undergo modifications, changes, or updates derived from new legal requirements; our own needs for the products or services we offer; our privacy practices; changes in our business model; or other causes. For any questions, comments, or suggestions regarding our privacy notice and the ARCO procedure, please contact us at: avisos@airport-ta.com. Last updated: May 14, 2021