Privacy Notice 2022

Fundación Pietro Rizzuto, A.C.

The legal entity Fundación Senador Pietro Rizzuto, Asociación Civil, hereinafter Fundación Pietro Rizzuto, A.C. , with its address at Paseo de los Cocoteros s/n, suite 300, inside hotel Marival Emotions Resort & Suites, Nuevo Vallarta, municipality of Bahía de Banderas, Nayarit, zip code 63732, telephone 322 226 9624, website: www.fundacionsenadorrizzuto.org, is responsible for the use and protection of your personal data, and in this regard we inform you of the following:

The personal data we collect from you will be used for the following purposes that are necessary for the service you are requesting:

a) As a Donor or Associate of the Foundation:

• Identifying, knowing and contacting the associates of the Civil Association itself and third parties with whom it establishes a relationship, including those who show interest in getting to know the activities of the Civil Association, those who provide services to it or who benefit from the activities or programs of the same,

• For your registration as a donor, receipt of donations in cash or in species, goods, products or services that may be offered as non-profit by the Civil Association, processing and integration of files and / or any other purpose derived from the alliances that exist with you,

• For identification, verification and contact

• To assure your safety during your stay in the facilities of Fundación Pietro Rizzuto, A.C., we establish security and surveillance measures of the facilities, including monitoring, video cameras, control and surveillance of physical and logical access.

• To assist you in case of any health or safety incidents.

• Any other form of data processing derived from your status as a donor or associate, such as billing, tracking of donations, integration of administrative files as documentary or other support regarding the existing relationship with you.

b) Particularly in your capacity as an employee or candidate to obtain a job with Fundación Pietro Rizzuto, A.C., the following primary purposes will also apply:

• For the analysis, study and processing of your job application and other procedures related to the recruitment, selection, hiring and training of personnel.

• Integration of your employee file.

• For hiring and/or job promotion processes.

• For performing socioeconomic and psychometric studies.

• For granting labor benefits.

• For making job offers and job opportunities in the establishments to which the company renders its services.

• For the payment of wages and other benefits established in the Federal Labor Law and individual or collective labor agreements.

• For making a database for the prevention of the spread of COVID 19 and / or any other type of future health emergency, whose objective is to identify cases of risk of contagion of this virus, to protect the health of the staff of Fundación Pietro Rizzuto, A.C

• For processing registrations, modifications, payment of discounts or the corresponding downsizings before the Mexican Institute of Social Security, Institute of the National Fund for the Consumption of Workers, Institute of the National Fund for Workers' Housing and contracting of insurance of private medical expenses in favor of its employees.

• Establishing, managing and operating of savings banks where the employees of Fundación Pietro Rizzuto, A.C. participate,

c) In particular, in its capacity as Supplier of Fundación Pietro Rizzuto, A.C., the following primary purposes will also apply:

• For drafting services agreements.

• For fulfilling contractual obligations.

• For processing payments, receipt and / or return of purchased goods and services.

• For processing orders and integrating administrative files as documentary or other kind of support regarding the existing business relationship with you.

Additionally, we will use your personal information for the following secondary purposes which are not necessary for the requested service, but that allow us to provide you a better service:

• Sending general communications and information about programs of community support, invitations to events and activities carried out from time to time by the Civil Association.

• Conducting feedback campaigns and updating data.

In case you provide your data directly, let our collaborator know at that moment and request them to provide you with the corresponding format to document your refusal.

If you provide your data using our website or a mobile application, you must send an e-mail to the following address: [email protected].

Refusing the use your personal data for these secondary purposes will not be a reason for us to deny you the services and products you requested or contracted with us.

• Identification data: Name, last name, signature, photo identification document, Sole Code from the Population Registry (CURP).

• General information: Full address, either from your home or work, personal or work email address; home or work telephone number; cell phone number, Nextel ID (if applicable) and fax number; date of birth; age, marital status and nationality.

• Tax data: Federal Taxpayers Registry Code (RFC), proof of tax situation, as well as tax domicile and tax regime (if applicable).

• Bank account data: Numbers linked to bank accounts, credit and/or debit cards, name of the account or card holder, account number and bank of origin, CLABE (if applicable), credit or debit card number; card expiration date, card type and security code. All these data are stored with your express consent and if you let us know your opposition, we may be prevented from providing the contracted services because it may not be possible to process the corresponding payment.

• Sensitive personal data: Fundación Pietro Rizzuto, A.C., collects the following sensitive personal data and purposes:

.- Personal health data: provide medical or first aid care and services, for protecting people's health in emergency situations (including COVID-19 and / or any other type of health emergency), for the treatment of the special requirements from our clients focused on food allergies or restrictive diets. In the case of minors who are the foundation's scholarship holders, sensitive personal data is collected, with the aim of providing health and social assistance services, such as: age, full name, data of the parent or legal guardian, current health status, pre-existing diseases, allergies, weight, height; all these data are always obtained with the consent of the parent or legal guardian.

.- Complementary data to integrate your employment file, which are necessary for the employment relationship and to ensure your safety, well-being and health inside the work establishment. Such data may be the following: biometric data, health data, ideological personal data (only union memberships).

.- Complementary data to integrate your beneficiary file, according to the health and hygiene programs, managed by the foundation.

These personal data at no time and under no circumstances will be shared, except for personal health data, which will only be transmitted to medical institutions and other persons involved in emergencies where the owner of the personal data or relatives are at risk, or to provide care of health and hygiene programs of interest that are of interest to the associate.

• Employment data: We will require data from your past jobs, such as: position, activities, name of the institution and other data of the institution, number of direct reports, salary, benefits, name of your supervisor and other data that allow us to know your experience and employment history.

• Academic data: We will request information about your education, institutions in which you studied, term of your studies and academic degrees received and studies you currently do.

• Personal data from sources of public access and received via consented transfers: from public registries, directories, social networks and other lawful sources available in the market, as well as personal data that have been shared with us by third parties to whom you have previously authorized.

• Personal data of third parties: You agree and acknowledge that, to obtain references from you about your work experience, identity and the veracity of the data you provided, we will ask you for personal references. For such purposes you represent and acknowledge that you have the authorization of the owner of the personal data to transfer their personal data as personal references, Fundación Pietro Rizzuto, A.C., will only and exclusively use that data for these purposes and not for any other particular purpose.

• Personal data from Employment Agencies: Fundación Pietro Rizzuto, A.C., may receive your personal data when you had registered your data in an employment or placement agency to which you have consented to transfer your personal data. In these cases, Fundación Pietro Rizzuto, A.C., compels itself to treat your personal data in accordance with the privacy notice of said employment or placement agency, always in compliance with the Federal Law on Protection of Personal Data Held by Private Parties, with the understanding that once you authorize Fundación Pietro Rizzuto, A.C, to treat your personal data, such treatment will be subject to this privacy notice.

• Personal data from social networks: Fundación Pietro Rizzuto, A.C., may collect and process personal data and information that you have shared on the social networks of Fundación Pietro Rizzuto, A.C (such as Facebook®, Instagram ®, Pinterest®, Tiktok®, Google® and / or Twitter®, among others), particularly that which you have shared on the profile of Fundación Pietro Rizzuto, A.C in said social networks or in the profile of other companies related to Fundación Pietro Rizzuto, A.C, including the information you have shared as “public”, as provided in the terms and conditions of use and the policies and statements thereof

The personal data described in the aforementioned paragraphs of this section are collected through: i) the use of printed formats or documents; ii) the use of emails, iii) the voluntary provision of information and personal data, iv) when you visit our facilities and provide your data, v) when you apply for employment within the facilities of Fundación Pietro Rizzuto, A.C., vi) when you communicate by telephone with us or with our collaborators (including the customer service and human resources area); vii) through the websites of the hotels that are part of the business group commercially known as Marival Group, as well as its own Employment Data base and the Human Resources Department of Fundación Senador Rizzuto, A.C. , viii) the use of publicly accessible sources and other sources available on the market, ix) Placement and employment agencies to which you voluntarily provided your personal data, (x), the referrals of personal data from other foundations with which we collaborate, and (x i ) the social networks of hotels or other commercial lines that are part of the business group commercially known as Marival Group.

The personal data collected by Fundación Pietro Rizzuto, A.C., is protected by adequate security, administrative and physical measures against damage, loss, alteration, destruction, use, unauthorized or illegal access or treatment, disclosure, and against loss, damage or alterations or accidental destruction, in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (“LFPDPPP”) and its Regulations. To learn more about our security measures we ask you to contact us via email at [email protected].

We strive to store your personal data in secure operating environments that are not accessible to the general public, and to implement security measures in our physical facilities to protect against the loss, misuse or alteration of your personal data by our employees or third parties.

However, it is not possible to guarantee 100% the security of any data transmission over the Internet or any data storage environment, so we cannot assure you in absolute terms that the personal data you provide to us is protected at all times. Fundación Pietro Rizzuto, A.C., asks you to inform us if you experience any unusual event that may indicate a security breach of your information; In the same way, you will be notified in case of any incident or vulnerability detected by Fundación Pietro Rizzuto, A.C., within the established deadlines and means, which the applicable regulations designate. In that case, we will endeavor to investigate whether this fact was related to the transmission of data whose origin or destination is www.fundacionsenadorrizzuto.org, and we will inform you about the measures you can take and that have been taken to help correct the problem.

www.fundacionsenadorrizzuto.org is a site for the general public and may collect information from minors, as long as it is provided by their parent or legal guardian. In the event that Fundación Pietro Rizzuto, A.C., is informed, or detects, that a person under the age of 13 has sent us personal information, we will delete or destroy such information as soon as reasonably possible.

• We inform you that your personal data may be transferred to third parties inside and outside the national territory if necessary to carry out the purposes set forth in this privacy notice.

• We also inform you that Fundación Pietro Rizzuto, A.C. is part of a business group commercially known as “MARIVAL® GROUP” and it may transfer your personal data with other companies of the same group, in terms of the provisions of article 37 of the Federal Law on Protection of Personal Data Held by Private Parties with respect to related parties. The companies that are part of the group are:

.- Rinoval de México, S.A. de C.V.,

.- Administraciones Profesionales de Vallarta, S.A. de C.V.,

.- Vacation Club Services, S.A. de C.V.,

.- Operadora y Comercializadora Turística, S.A. de C.V.,

.- Destiladeras Resort Operations, S.A. de C.V.,

.- Constructores y Desarrolladores Inmobiliarios de la Bahía, S.A. de C.V.,

.- Comercializadora Access del Puerto, S.A. de C.V.,

.- Serviventas de México, S.A. de C.V., y

.- Servicios Terrestres del Nayar, S.A. de C.V.

.- Travel Marketing 500, S. de R.L. de C.V.

.- Mobile Sail Technologies, S.A. de C.V.

.- Delicias Narezushi, S. de R.L. de C.V.

• We will share your personal data, with other non-profit associations, that provide services related to Fundación Pietro Rizzuto, A.C.; For example, the granting of free health and hygiene services, donations or support in goods, products or services, as non-profit contributions.

• We will also share your personal data with independent third parties with whom we need to interact to carry out the purposes set out herein. Such independent third parties especially include banking institutions that process your payments. This transfer will always be optional and you can object at any time. The third parties with whom we will share your personal data may be:

Finally, we point out that we will transfer your data nationally or internationally, in the cases contemplated by article 37 of the LFPDPPP, in force in Mexico, which expressly establishes the possibility of sharing your data with competent authorities and controlling companies, subsidiaries or affiliates under the common control of the responsible party, or to a parent company or any company thereof, in the following cases:

• When the transfer is provided for in a law or treaty to which Mexico is a party;

• Where the transfer is necessary for the medical prevention or diagnosis, providing healthcare, medical treatment or the management of health services;

• When the transfer is made to holding companies, subsidiaries or affiliates under the common control of the responsible party, or to a parent company or any company of the same group of the responsible party that operates under the same internal processes and policies;

• When the transfer is necessary by virtue of a contract in force or to be entered into in the interest of the owner of the personal data, by the responsible party and a third party;

• When the transfer is necessary or legally required for safeguarding a public interest, or for the prosecution or administration of justice;

• When the transfer is necessary for the recognition, enforcement or defense of a right in a judicial process, and When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the responsible party and the owner of the personal data.

Fundación Pietro Rizzuto, A.C., will keep personal data for as long as necessary to fulfill the purposes for which it has collected the information, including the purposes to satisfy any legal, accounting and reporting requirements, in accordance with the provisions of article 37, of the LFPDPPP Regulations, in force in Mexico.

For the purpose of determining the appropriate retention period, we take into account the amount, nature and degree of confidentiality of the personal data, the potential risk of harm arising from the unauthorized use or disclosure of your personal data, the purposes for which we processed such data and whether we can achieve those purposes by other means, as well as the legal provisions in force.

You have the right to know what personal data we have about you, why we use it for and the conditions of use we give them (Right of Access). Likewise, it is your right to request the correction of your personal information in case it is outdated, inaccurate or incomplete (Right of Rectification); that we delete it from our records or databases when you considers that it is not being used properly (Right of Cancellation); as well as to oppose to the use of your personal data for specific purposes (Right of Opposition). These rights are known as ARCO rights.

As for the general requirements that the application must cover, there are the following:

• Name of the owner of the personal data.

• Documents evidencing the identity of the owner of the personal data (passport, voting card issued by the National Electoral Institute, state or federal professional card or driver's license, birth certificate).

• Where applicable, name of the representative of the owner of the personal data and documents to prove their identity and personality. In the case of minors, the representative is the person the parent or legal guardian. In the case of agents or representatives of natural persons, the representation will be accredited by the following 3 options: a) public instrument (document signed by a Notary Public), b) power of attorney signed before two witnesses (attaching a simple copy of your official identifications), c) personally appearing with your representative to testify presenting your official identification (passport, vote credential issued by the National Electoral Institute, state or federal professional card or driver's license).

• Address or any other means to receive notifications.

• Clear and precise description of the personal data and the right you want to exercise or what is requested.

• The data or documents that facilitate the identification of the information subject to the request (for example, campaigns in which the minor participated, association to which he belongs, or any other information that may facilitate his identification within our databases).

Likewise, in relation to the type of request, we require to please indicate the following additional information, so that your request can be processed more efficiently:

• Access Request: Indicate the modality in which you prefer the personal data that was requested, to be reproduced.

• Rectification Request: Specify the modifications to the personal data that you are requesting, as well as to provide the documents that support the request.

• Cancellation Request: Indicate the causes that motivate the request to delete the data from the files, records or databases of the responsible party.

• Opposition Request: If the request refers to a particular treatment, the specific purposes for which the exercise of the right is requested must be indicated.

• Revocation of consent: You can revoke the consent that, where appropriate, you granted us for processing your personal data. However, it is important that you bear in mind that not in all cases we will be able to comply with your request or stop its use immediately, since it is possible that due to some legal obligation we are required to continue processing your personal data. Likewise, you should consider that, for certain purposes, the revocation of your consent will mean that we can no longer provide the service you requested, or the conclusion of your relationship with us.

By email to the address [email protected] or you can also contact our Personal Data Department to process your request, provide guidance and provide the corresponding form. The address of our Personal Data Department is Paseo de los Cocoteros s/n, Marival® Emotions Resort & Suites hotel, Nuevo Vallarta, municipality of Bahía de Banderas, Nayarit, zip code 63732, telephone number 322-2268200 (extension 4493). The official ARCO rights request form, for Fundación Pietro Rizzuto, A.C., please request it in the address [email protected]

The official ARCO rights request form, for Fundación Pietro Rizzuto, A.C., please request it in the address [email protected] or you can download it directly from here.

20 business days.

By email or by postal service.

In the same way that it had been provided by the client.

The corresponding forms or systems and guidance on the exercise of ARCO rights can be obtained by contacting our Personal Data Department at the email address: [email protected], or at your physical address located at Paseo de los Cocoteros s / n, Marival® Emotions Resort & Suites Hotel, Nuevo Vallarta subdivision, municipality of Bahía de Banderas, Nayarit, zip code 63732, telephone number 322-2268200 (extension 4493). You can also download the format directly from here.

The exercise of the ARCO rights is free of charge. However, you may be required to cover only justified shipping costs or the cost of reproduction in copies or other formats. Likewise, if the same person reiterates their request in a period of less than twelve months, the costs will not exceed three days of the General Minimum Wage in force in the Distrito Federal (today Mexico City), unless there are substantial modifications to the privacy notice that motivate new consultations.

In the event that your request does not have the information described in section 4 Requirements (paragraphs a and b), or is not clear, is erroneous or incomplete, Fundación Pietro Rizzuto, A.C., may request the owner of the personal data to provide the missing information, to respond to your request within 5 business days following the receipt of our request for information, if the request is not answered, it will be considered as not presented.

The owner of the personal data will have 10 working days to respond the request made by Fundación Pietro Rizzuto, A.C., counted from the day after receiving it. In the event that the owner answers the request for information, the deadline for the responsible party to respond will begin running the day after the owner of the personal information has responded to the request.

• Email: [email protected]

• Contacting our data protection department, which is in charge of processing ARCO rights requests, in the following address:

• Name of the person or department of personal data: DEPARTMENT OF PERSONAL DATA GRUPO MARIVAL.

• Address: Paseo de los Cocoteros s/n, inside Marival® Emotions Resort & Suites Hotel, Nuevo Vallarta, C.P. 63732, municipality of Bahía de Banderas, Nayarit, México

• Email: [email protected]

• Telephone: 322-2268200

In order for you to limit the use and disclosure of your personal information, we offer you the following means: The customer can limit the use or disclosure of their personal data by sending an email where they make the specific approach to the email address [email protected]. Additionally, we inform you that we have the following exclusion lists, in which you can register or unsubscribe on our distribution platforms, so that your personal data is not processed for certain purposes (mainly secondary):

We inform you that on our website we use cookies, or other technologies, through which it is possible to monitor your behavior as an internet user, as well as provide you with a better service and experience when browsing our page. The personal data we collect through these technologies will be used for the following purposes:

To monitor and prevent misuse of digital platforms; to improve our digital tools and update them as technology evolves; and to deliver personalized content.

The personal data we obtain from these tracking technologies is as follows:

• Identifiers, username, and passwords for a session.

• User's preferred language.

• The region in which the user is located.

• Type of browser used by the user.

• The type of operating system the user has.

• Websites visited by the user.

• Searches performed by the user.

• User-reviewed advertising.

For more information it is suggested to consult our Cookies Policy

This privacy notice may undergo modifications, changes or updates derived from new legal requirements; of our own needs for the products or services we offer; of our privacy practices; of changes in our business model, or for other reasons.

We are committed to keeping you informed about the changes that may occur to this privacy notice, by: sending you an email and publishing it on the website: www.fundacionsenadorrizzuto.org

The procedure through which the notifications about the changes or updates made to this privacy notice will be made in the following manner:

Changes or updates to the privacy notice will be announced by the means described in this policy and will take effect 1 week later. In case of doubts or comments, customers should contact [email protected]