AVISO DE PRIVACIDAD INTEGRAL CLIENTES Y USUARIOS

Who is responsible for their

data?

Lotax, S.A. de C.V., (hereinafter and indistinctly Grupo Ultra or the Responsible Party) is the

responsible for the processing of your personal data and in compliance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (the LFPD) and the rest of the applicable provisions, we provide you with this Privacy Notice.

Our address to hear and receive notifications is located at Boulevard Kukulkán, KM 12.5, Local 83, Sótano, Zona Hotelera, Cancún, Benito Juárez, Quintana Roo, C.P. 77500.

What data do we collect?

For the fulfilment of the purposes that will be indicated, we may request and collect the following categories of personal data:

3. Identification and contact details;

4. Commercial information data.

Sensitive data?

In order to comply with the purposes indicated in this Privacy Notice, Grupo Ultra does not collect sensitive data.

What do we use your personal data for?

We may process your data for the following purposes:

Primary purposes:

3. Security of visitors, collaborators, suppliers' personnel and other persons entering Grupo Ultra's facilities.

4. Access control of visitors and, where appropriate, of computer equipment entering Grupo Ultra's facilities.

Additional purposes: None.

With whom can we share your data?

Grupo Ultra does not transfer personal data for the purposes described in this Privacy Notice.

Your personal data will not be transferred to third parties without your consent, subject to the exceptions provided for in article 37 of the LFPD and in any case in compliance with the conditions provided for in article 17 of the LFPD Regulation.

How can you exercise your ARCO rights?

You may at any time exercise your rights of Access, Rectification, Cancellation and Opposition (ARCO) through the procedures we have implemented.

Your request must comply with all the requirements established in the legislation in force, by writing to our Personal Data Department through the following account arco@grupoultra.com, stating "ARCO Rights" and/or "Revocation of Consent" as the subject of the communication.

Your application must contain the following:

e) Your name and address, or other means of communicating the response to your request.

f) Copy of the document accrediting their identity or, where applicable, legal representation.

(g) A clear and precise description of the ARCO Rights you wish to exercise; and

h) Where applicable, any other element or document that facilitates the location of their personal data.

Grupo Ultra will communicate, within a maximum period of twenty working days, the decision taken on your request. If the request is accepted, it will become effective within fifteen working days following the date on which Grupo Ultra communicates its response. In the event that the information provided in your request is erroneous or insufficient, or if the necessary documents are not provided to prove your identity or legal representation.

Grupo Ultra will request that the deficiencies be rectified within five days.

working days following receipt of your original request. In such cases, you will have ten working days

The relevant application shall be deemed not to have been submitted if the error or deficiency is not remedied within that period. The relevant application shall be deemed not to have been submitted if the error or deficiency is not remedied within that period.

You may obtain the information or personal data requested through simple copies, electronic documents in conventional formats (Word, PDF, etc.), or through any other legitimate means that guarantees and accredits the effective exercise of the right requested.

The Controller wishes to keep your personal data updated at all times. Therefore, we request your cooperation in communicating to us in a timely manner any changes that we should take into account, in order to incorporate them into our databases. You guarantee and are responsible, in any case, for the truthfulness, accuracy, validity and authenticity of the personal data provided for your personal attention, or that of any third party under your custody or legal representation.

Can you revoke your consent?

You may revoke your consent to the processing of your personal data, without retroactive effect, in all those cases in which such revocation does not imply the impossibility of fulfilling obligations arising from a legal relationship in force between you and the Controller or imply non-compliance with general provisions of public order that establish the obligation to maintain the processing of your personal data for a certain period of time.

The procedure for the revocation of consent, where applicable, will be the same as that established in the immediately preceding section for the exercise of ARCO rights.

Limitations on the use and disclosure of your personal data

You may limit the use or disclosure of your personal data by addressing the corresponding request to our Personal Data Department. The requirements for proving your identity, as well as the procedure for dealing with your request will be the same as those indicated in the section "How can you exercise your ARCO rights".

The Data Controller has the means and procedures to ensure the inclusion of some of your data in its own exclusion lists, when you expressly request their inclusion in them. The Data Controller will provide registered data subjects with the corresponding proof of registration.

Changes or updates to this Privacy Notice

The Controller may modify, update, extend or otherwise change the content and scope of this Privacy Notice, at any time and at its sole discretion. In such cases, we will post such changes in the website https://luxuryavenue.com/ section "Privacy Notices".

Changes to this Privacy Notice will be communicated through our website. https://luxuryavenue.com/. We recommend that you check this website from time to time for the latest version of this Privacy Notice. Updates and/or modifications to this document will become effective once they are posted on the aforementioned website.

site.