CasaCibeles

1. Identity and Address of the Data Controller.

The company Mexstays Lumina, S.A.P.I. de C.V. (hereinafter "Lumina"), with registered address at HP Diamante, Lomas de Bezares, Miguel Hidalgo, C.P. 11910, Mexico City, CDMX, in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (the "Law"), is the data controller responsible for the processing of personal data (hereinafter Personal Data) collected by itself or through companies with which Lumina maintains a commercial relationship, as listed in Annex A of this document, which shall be referred to solely for purposes of this Privacy Notice collectively as Lumina. The collection of Personal Data shall be carried out through physical forms, social media, one or more digital platforms, smartphone mobile applications, and any other existing or future means (the "Digital Platforms") and/or the websites listed in Annex B of this Privacy Notice (the "Websites"; physical forms, social media, and together with the Digital Platforms, the "Platform") from certain natural persons (hereinafter "Data Subjects") who use the Platform for the purpose of receiving certain services from Lumina, including but not limited to: (i) for Lumina to sublease in favor of Data Subjects the properties leased in its favor; (ii) to provide hospitality and accommodation services to Data Subjects; (iii) any other act derived from or necessary for subleasing or providing hospitality services or any other lawful activity that is convenient and/or necessary to carry out such activities in favor of Data Subjects; and, as applicable, (iv) entering into lease agreements for real estate properties; and (v) entering into property management agreements for real estate properties. (These activities carried out by Lumina shall be referred to collectively and individually as the "Services").

Data Subjects may send an email to the ARCO officer (access, rectification, cancellation, and objection), who shall be responsible for the care and management of their Personal Data, at the following email address: arco@luminastays.com.

2. Purposes of Processing.

Lumina uses the Personal Data collected through the Platform primarily to carry out the following activities, which are necessary in connection with the Services provided to Data Subjects:

Primary Services to Users of the Services

Primary Purposes

• To provide Data Subjects with the Services and other services in accordance with its corporate purpose.
• To fulfill the obligations arising from the Services referred to (i), (ii), and (iii) above.
• To evaluate the quality of the Services.
• To send relevant information related to the Services.
• To evaluate the user's profile.
• To carry out the administrative procedures necessary to provide the corresponding Services.

Secondary Purposes

• To compile and update user records.
• To comply with legal requirements from competent authorities.
• To receive and address inquiries regarding the Services provided by Lumina.
• To create a user directory.

Primary Services to Lessors and Property Owners Related to the Services

Primary Purposes

• To enter into real estate lease agreements and any other legal acts necessary for the execution and formalization of such lease agreements (the "Lease Agreements").
• To enter into property management agreements and any other legal acts necessary for the execution and formalization of such property management agreements (the "Management Agreements").
• To fulfill the obligations arising from the execution of the Lease Agreements.
• To fulfill the obligations arising from the execution of the Management Agreements.
• To comply with legal requirements from competent authorities.
• To evaluate the quality of the Services.
• To receive and address inquiries regarding the Lease Agreements.
• To receive and address inquiries regarding the Management Agreements.

Secondary Purposes

• To compile and update lessor records.
• To send relevant information related to the Lease Agreements.
• To evaluate the lessor's profile.
• To receive and address inquiries regarding the Lease Agreements.
• To create a lessor directory.

Lumina reserves the right to modify the purposes set forth above, informing Data Subjects of such changes through the Platform.

The processing of Personal Data shall be limited to what is necessary, adequate, and relevant in relation to the purposes set forth in this Privacy Notice, as well as any other compatible or complementary purposes related to the Services and the execution of the Lease Agreements and Management Agreements, as applicable.

3. Personal Data Collection Process.

Registration. Upon registration on the Platform for the purpose of receiving the Services, the Data Subject shall provide the following data to create an account with Lumina:

• Full name
• Address
• Date of birth
• Nationality
• Country of residence
• Landline telephone number
• Mobile telephone number
• Email address
• Payment details and banking information

The aforementioned data provided by the Data Subject through the Platform for the purpose of receiving the Services shall be stored by Lumina.

Personal Data may and shall be shared with one or more third parties external to Lumina, who may be engaged in the provision of the Services offered through the Platform, for the sole purpose of fulfilling the Data Subject’s request.

Lumina shall use the information that Data Subjects share through the Platform to carry out and fulfill the applicable processing purposes set forth in Section 2 of this Privacy Notice.

Payment information. Lumina uses third-party service providers to process payments made through the Platform on behalf of Data Subjects, where applicable based on the obligations assumed by Lumina in their favor. Lumina has access to such payment data and may store it in order to fulfill its obligations to the Data Subject. By accepting this Privacy Notice, the Data Subject must ensure that they have reviewed and accepted the privacy policies and data processing practices of the payment service providers.

The Platform contains links to third-party websites that are not owned or controlled by Lumina; therefore, Lumina assumes no responsibility for the processing of Personal Data carried out by such third parties.

4. Data Transfers.

We hereby inform you that the Personal Data of Data Subjects are shared within and outside the country with the following persons, companies, organizations, and authorities other than Lumina:

• Third-party service providers necessary for the fulfillment of the legal obligations assumed by Lumina with Data Subjects, or by any of its affiliated and subsidiary companies in the same regard.
• Third-party service providers for research and data analytics purposes, as well as for the transmission of information aimed at assessing the suitability of the Data Subject with respect to Lumina’s Services, Lease Agreements, and Management Agreements.
• Competent authorities.

5. Applicable Authorities.

The Data Subject undertakes to use the Platform solely for their own purposes. In the event that another person, whether a natural or legal person, uses the Platform and Personal Data is transferred without Lumina’s consent, Lumina shall not be liable for data transferred without its consent, whether by telephone or email.

Lumina shall only be liable for Personal Data transferred to it through its Platform. In the event that Data Subjects transfer their Personal Data through other platforms or means of communication, this Privacy Notice shall not apply. Additionally, the Data Subject’s data may be transferred by Lumina without the Data Subject’s consent in accordance with the provisions of Article 37 of the Law and other applicable legislation.

6. Rights of Access, Rectification, Cancellation, and Objection.

The Data Subject has the right to know which Personal Data is being processed by Lumina, the purposes for which it is used, and the conditions governing such use ("Access"). The Data Subject also has the right to request the correction of their personal information if it is outdated, inaccurate, or incomplete ("Rectification"); to request the deletion of their personal information from Lumina’s records or databases when the Data Subject considers that it is not being used in accordance with the principles, duties, and obligations set forth in this Privacy Notice and/or the Law ("Cancellation"); and to object to the use of their Personal Data for specific purposes other than the primary services offered by Lumina ("Objection"). These rights are collectively referred to as ARCO rights.

To exercise ARCO rights, the Data Subject must submit the corresponding request to Lumina via email at arco@luminastays.com. Such request must include: (i) the Data Subject’s full name and address for the purpose of communicating the response; (ii) a copy of a document evidencing the Data Subject’s identity or, as applicable, a copy of a document evidencing legal representation duly granted by the Data Subject; (iii) a description of the Personal Data in respect of which the exercise of an ARCO right is sought; (iv) any other element that facilitates the location of the Personal Data; (v) the specific ARCO right being exercised; and (vi) a brief account of the reasons for exercising the relevant ARCO right.

Lumina shall communicate to the Data Subject or their legal representative, within a period of ten (10) business days following submission of the request, the response thereto. The cancellation of data shall be subject to the provisions of Article 26 of the Law.

7. Revocation of Consent to the Processing of Personal Data.

The Data Subject may revoke their consent to the processing of their Personal Data. To do so, the Data Subject must submit the corresponding request via email to arco@luminastays.com, together with the information and documentation referred to in Section 5 of this Privacy Notice. However, it is important to note that, for certain purposes, the revocation of consent may result in Lumina being unable to continue providing the Service or Services requested, or in the termination of the Data Subject’s relationship with Lumina. Furthermore, the Data Subject should be aware that it may not always be possible to accommodate such request or to cease processing immediately, as Lumina may be required by a legal obligation to continue processing the Personal Data for an additional period of time.

8. Limitation on the Use and Disclosure of Personal Data.

The Data Subject may limit the use and disclosure of their Personal Data, including but not limited to, refusing to receive communications and promotions from Lumina by means of: (i) registration in the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad), administered by the Federal Consumer Protection Agency (PROFECO), so that their Personal Data is not used to receive advertising or promotions from companies offering goods or services. For more information about this registry, the Data Subject may consult the PROFECO website or contact PROFECO directly; or (ii) by written request in accordance with the procedure set forth herein.

9. Security Measures.

For the purpose of providing greater protection and confidentiality to the Personal Data of Data Subjects, Lumina shall implement all possible security measures, such as access controls, encryption tools, and various software solutions within the Platform.

10. Use of "Cookies", "Web Beacons", or any Other Similar or Analogous Technology on the Platform.

Sites for Collecting Personal Data

Lumina uses various Platforms and websites to collect information using "cookies," which are text files placed on your computer to help the website analyze how Data Subjects use it.

Personal Data Collected Through "Cookies" and Similar Technologies

Lumina and its service providers use "cookies," "web beacons," and other technologies to receive and store certain types of information each time Data Subjects interact with the Platform through their devices. A "cookie" is a small file containing a string of characters that is sent to your device when you visit a website. When you revisit the Platform or the websites of service providers, the "cookie" allows those sites to recognize your browser. "Cookies" may store unique identifiers, Data Subject preferences, and other information. You may reset your browser to reject all "cookies" or to indicate when a "cookie" is being sent. However, certain features or services of the Platform or service provider websites may not function properly without "cookies." We use "cookies" to improve the quality of our Service, including to store Data Subjects’ preferences and track their usage trends.

"Web beacons," for their part, are images embedded in a web page or email that may be used to monitor a visitor’s behavior, such as storing information about the Data Subject’s IP address, the duration of interaction on a given page, and the type of browser used, among others.

We hereby inform you that we use "cookies" and "web beacons" to obtain the following personal information from Data Subjects:

• The Data Subject’s browser type and operating system.
• Websites visited.
• Links followed.
• IP address.
• The website visited by the Data Subject prior to accessing the Platform.

These "cookies" and other technologies may be disabled. There are various sections of the Platform that may connect to other websites that do not operate under the Platform’s privacy policies. When the Data Subject connects to other websites, the Platform’s privacy practices and this Privacy Notice are no longer applicable. Data Subjects are encouraged to review the privacy policies and corresponding privacy notice of each website before disclosing any Personal Data or personal identification information. All Personal Data collected through the Platform must be kept up to date for the purposes for which it was collected in accordance with this Privacy Notice, and in the event that Personal Data is no longer necessary for the purposes established by Lumina, it shall be deleted.

11. Amendments to the Privacy Notice.

This Privacy Notice may be subject to modifications, changes, or updates arising from new legal requirements, from Lumina’s needs in connection with the provision of its Services, from its privacy practices, from changes to its business model, or for other reasons.

Such modifications shall be made available to the public and to Data Subjects through the following means:

• Visible announcements on the website (Privacy Notice section).
• Notification within the Platform.

12. Consent.

Consent of Data Subjects

In accordance with Article 9 of the Law, we require the consent of Data Subjects for the processing of their Personal Data. Accordingly, Data Subjects understand and expressly, unconditionally, and irrevocably accept, for all applicable purposes, the scope and content of this Privacy Notice, thereby consenting to the processing of their Personal Data upon use of the Platform.

Any questions or comments regarding this Privacy Notice, as well as the exercise of any other rights granted under the Law, must be directed to Lumina’s privacy notice officer at arco@luminastays.com.

Without prejudice to the foregoing, in the event that the Data Subject considers that the processing of their Personal Data constitutes a violation of the provisions of the Law, they may file a complaint with the Transparency For The People (Transparencia para el Pueblo) in order to seek clarification or exercise their rights under the Law.

13. Language.

Lumina and the Data Subject agree that this Privacy Notice is executed in both English and Spanish, and that in the event of any discrepancy between the two languages, the Spanish version shall prevail.

Annex A. Commercial Relationships

• Notto
• Cholula Condesa
• Boga
• Casa Cibeles
• Nomu
• Casa Tala
• OR Cabo
• Casa Nima
• Puerta Cortés
• District Polanco
• Santolivo
• Urban Reforma
• Namora Stay
• Corasol
• Casa Izel
• Conchita
• Xuna
• El Bar

Annex B. Commercial Relationship Websites

• https://notto.mx/en/
• https://cholulacondesa.com/
• https://bogastay.com/
• https://casacibeles.com.mx/
• https://nomustay.com/
• https://casatalapuerto.com/
• https://orcabobylumina.com/
• https://www.casanima.com.mx/
• https://puertacortes.com/es/
• https://districtpolanco.com/
• https://santolivo.mx/
• https://urbanreforma.com/
• https://namorastay.com/
• https://corasol.mx/es/
• https://casaizelhotel.com/
• https://conchitaclamont.com/
• https://xunarestaurante.com.mx/
• https://elbardexuna.com/