PROCEDURE FOR ACCESS, RECTIFICATION, CANCELLATION, AND OPPOSITION OF DATA. (A.R.C.O. RIGHTS) In accordance with Chapter IV of the Federal Law on the Protection of Personal Data Held by Private Parties, the procedure for access, rectification, cancellation, or opposition of personal data is made available to the general public. A. The data subject may request from this company at any time Access, Rectification, Cancellation, or Opposition (“ARCO rights”) with respect to their data, by means of a written request that must contain and be accompanied by at least the following: I. Name of the data subject and address or other means to respond to their request (email, fax, etc.); II. Documents that prove identity (INE [National Electoral Institute ID], Passport, military service card, driver's license), and, if applicable, proof of the data subject's legal representation; III. A clear and precise description of the personal data for which the exercise of any of the ARCO rights is sought, and IV. Any other element or document that facilitates the location of the personal data. B. In the case of requests for rectification of personal data, the data subject must indicate, in addition to the above, the modifications to be made and provide the documentation that supports their request. C. The company will notify the data subject, within a maximum period of twenty business days from the date the request for access, rectification, cancellation, or opposition was received, of the decision adopted, so that, if applicable, it may be implemented within fifteen calendar days following the date the response is communicated. In the case of requests for access to personal data, the data will be delivered upon verification of the identity of the requester or legal representative, as appropriate. The aforementioned time periods may be extended once for an equal period, provided that the circumstances of the case justify it. D. The obligation to provide access to information will be considered fulfilled when the personal data is made available to the data subject; or through the issuance of simple copies, electronic documents, or any other means determined by the company in the privacy notice. If the data subject requests access to information from the company they presume to be the data controller, and the company turns out not to be, it will suffice to inform the data subject of this fact by any of the means referred to in the preceding paragraph for the request to be considered fulfilled. E. The company may deny access to personal data, or refuse to rectify, cancel, or grant the right to object to the processing thereof, in the following cases: I. When the requester is not the data subject, or the legal representative is not duly authorized; II. When the requester's personal data is not found in the database; III. When the rights of a third party are infringed; IV. When there is a legal impediment, or a ruling from a competent authority, that restricts access to personal data, or does not allow its rectification, cancellation, or objection; and V. When the rectification, cancellation, or objection has already been carried out. The refusal referred to in this section may be partial, in which case the company will carry out the access, rectification, cancellation, or objection requested by the data subject, as appropriate. In all the above cases, the company will inform the data subject, or their legal representative if applicable, of the reason for its decision within the established timeframes, using the same means by which the request was made, attaching, where appropriate, any relevant evidence. F. The provision of personal data will be free of charge; the data subject will only be responsible for covering the justified shipping costs or the cost of reproduction in copies or other formats. This right may be exercised by the data subject free of charge, upon prior verification of their identity with the company. However, if the same person submits a request again within a period of less than twelve months, the costs will not exceed three (3) days of the current General Minimum Wage for the "rest of the country" geographic area, unless there are substantial modifications to the privacy notice that warrant new consultations. The data subject may file a data protection request regarding the response received. To address any questions, comments, suggestions, or opinions regarding our privacy notice and the procedure for accessing, rectifying, canceling, or opposing the processing of your personal data, please contact us at privacidad@grand-club.com, where we are happy to assist you. Thank you for your attention and preference