According to the Federal Law on the Protection of Personal Data Held by Private Parties (hereinafter referred to as the "Law"), companies operating under the trade name H21 CASA DE HUESPEDES ("H21", "we") in Mexico, hereinafter referred to as "The Company", shall be responsible for the processing of personal data of their clients, prospective clients, and users. This data policy applies to the information we collect and use about you when you access or use H21 services, the website, the mobile application, or any other mobile online service linked to or presented with this privacy policy, collectively referred to as the "Services".

PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND HOW WE HANDLE YOUR INFORMATION. IF YOU DO NOT AGREE WITH THIS POLICY, DO NOT USE THE SERVICES.

For the purposes of this notice, the Company jointly designates the address for receiving notifications located at: Higuera, Number 21, Colonia Villa Coyoacán, Postal Code 04000, Delegation Coyoacán, Mexico City, Mexico, and email: reservaciones@h21.mx.

The Company, in compliance with the Law, has developed policies and guidelines for the protection of personal data of its clients, prospective clients, and users. This notice specifies the rights you have as provided by the Law and the use or processing of such Personal Data.

Obtaining and Origin of Personal Data

For the purposes stated in this privacy notice, we may collect your personal data in various ways: when you provide it to us directly; when you visit our website; through our telephone support services or by using our online services, and when we obtain information through other sources permitted by law. Please note that we need certain types of information to provide you with our services. If you do not provide us with this information or request its deletion, you may no longer be able to access or use our services.

The data we obtain and its forms, according to the following description, can be:

1. INFORMATION YOU PROVIDE

We collect a variety of information that you provide to us directly. For example, we collect information from you through:

- THE SERVICES YOU USE OR PROCESS YOUR ORDERS

- REQUESTS OR QUESTIONS YOU SEND US THROUGH ONLINE FORMS, EMAIL, OR OTHERWISE RELATED

- YOUR PARTICIPATION IN SWEEPSTAKES, CONTESTS, OR SURVEYS

- ANY REVIEWS YOU SUBMIT ABOUT THE SERVICES

- UPLOADS OR POSTS REGARDING THE SERVICES

- CUSTOMER SUPPORT AND TECHNICAL ASSISTANCE REQUESTS

Information about you.

While some parts of the Services may not require you to provide information that can directly identify you by your name (for example, if you choose to browse the website without entering any of your data), the specific types of information we collect will depend on the Services you use, how you use them, and the information you decide to provide. The types of data we collect directly from you include:

- Name*, surname* (if you choose to provide it), address, landline or cell phone numbers, email addresses, credit card, debit card, or bank account numbers, verification number, postal code, and expiration date for recurring charge service, card payment at the agency and/or by phone, as well as billing information.

- Information about your reservations or other transactions with us.

- Information about your customer service interactions with us.

- Demographic information such as your gender or other information you provide as part of your interaction with the website.

- User-generated content, for example: when you comment on the quality of the Services, respond to a survey request, etc.

- Your browser type, operating system, and IP address.

- Those data related to the services provided by the Company.

Information about others.

If you request that your reservation be provided to someone other than yourself, we use the information you provide about the other person to complete the reservation.

2. INFORMATION WE COLLECT THROUGH AUTOMATED MEANS

When you use our Services, we collect certain information as described in this section. As mentioned in this notice, we and our service providers (which are third-party companies working on our behalf) may use a variety of technologies, including cookies and similar tools, to help collect this information. These include:

Websites.

When you use our website, we collect and analyze information such as your IP address, types of browser, browser language, operating system, software and hardware attributes (including device IDs), referral and exit pages and URLs, the number of clicks, pages visited, and the order of those pages, date and time of use, content viewed, total minutes viewed, error logs, and other similar information about how the website is used.

Mobile Apps.

When you use a mobile application or software ("app") related to H21, such as booking, Expedia, TripAdvisor, etc., we automatically receive certain information about the mobile phone, tablet, or computer used to access the app, including device identifiers, IP address, operating system, version, internet service provider, browser type, domain name, and similar information, if you update the app and when, date and time of use, content viewed, total minutes viewed, error logs, and other similar information about how you use the app.

Location Information.

When you use the Services, we and our service providers may automatically collect general location information (for example, IP address, city/state and/or postal code associated with an IP address, city/state) from your computer or mobile device.

INFORMATION WE COLLECT FROM SOCIAL NETWORKS AND OTHER CONTENT PLATFORMS

If you access the Services through a third-party connection or log in (for example, through a social network like Facebook or Twitter), you may allow us to access and store certain information from your social network profile. This may include your name, gender, profile picture, your likes and posts, and your list of friends, depending on the settings of such services. If you do not wish for this information to be shared, do not use a social network connection to access the Services. For a description of how social networks and/or sites handle your information, please refer to their privacy policies and terms of use, which may allow you to modify your privacy settings. You may also have the option to post activities from your contracted Services (reservations) on social network services when accessing content through the Services (for example, you may post on Facebook that you are staying at H21); you acknowledge that if you choose to use this feature, your friends, followers, and subscribers on any social network service you have enabled may see such activity.

INFORMATION WE COLLECT FROM OTHERS

We may receive additional information, such as demographic and statistical information, from third parties such as business partners, marketers, researchers, analysts, and other parties that we may attribute to you based on your assignment to certain statistical groups. We use this information to supplement the information we collect directly from you in order to derive your potential interests and provide you with more relevant experiences and to improve our products, analytics, and advertising.

HOW WE USE YOUR INFORMATION

We or our service providers use your information for various purposes, depending on the types of information we have collected from you and about you, including:

- Completing a reservation or providing the Services you have requested, including billing and accounting;

- Responding to your request for information and providing you with more effective and efficient customer service;

- Providing updates and information about the place where you have stayed;

- Contacting you by email, postal mail, or phone regarding H21, products, services, third-party surveys and research, studies, promotions, special events, and other topics we think may be of interest to you;

- Personalizing the advertising and content you see on the Services;

- Helping us better understand your interests and needs, improving the Services through research and reports, and testing and creating new products, features, and services;

- Protecting our websites and applications, as well as resolving application crashes and other reported issues;

- Complying with all procedures, laws, and regulations that apply to us when necessary for our legitimate interests or the legitimate interests of others;

- Establishing, exercising, or defending our legal rights when necessary for our legitimate interests or the legitimate interests of others;

- Providing the services and products required by the client, user, or prospective client;

- Reporting changes or new products or services related to those contracted or acquired by the client;

- Fulfilling obligations contracted with our clients;

- Evaluating service quality; and

- Complying with regulatory obligations and preparing reports required by competent authorities.

.

Combined Information:

For the purposes described in this Privacy Policy, we may combine the information we collect through the Services with information we receive from other sources, both online and offline, and use such combined information in accordance with this Privacy Policy.

Aggregated/Anonymous Data:

We may aggregate and/or anonymize any information collected through the Services so that such information can no longer be linked to you or your device. We may use such information for any purpose, including but not limited to research and marketing purposes, and we may also share such data with third parties, including advertisers, promotional partners, and sponsors.

The Company will implement security measures, both technical and administrative, necessary to protect your personal data, as well as to prevent unauthorized use, access, or processing. The Company will only use your personal data for the purposes established in this Privacy Notice.

Service Providers: We provide access to your information or share it with selected third parties who provide services on our behalf. They have access to perform these services but are prohibited from using your information for other purposes. They provide us with a variety of services, including billing, sales, marketing, product content and features, advertising, analytics, research, customer service, data storage, security, fraud prevention, payment processing, and legal services.

Protection of H21 and Others: By using the Services, you acknowledge and agree that we may access, retain, and disclose the information we collect and maintain about you if required by law or if we believe in good faith that such access, retention, or disclosure is reasonably necessary to: (a) comply with legal process (e.g., a subpoena or court order); (b) enforce our Terms of Service, this Privacy Policy, or other contracts with you, including investigating potential violations thereof; (c) respond to claims that any content violates the rights of third parties; (d) respond to your customer service requests; and/or (e) protect the rights, property, or personal safety of H21, its agents and affiliates, its users, and/or the public. This includes exchanging information with other companies and organizations for fraud protection and spam/malware prevention.

Business Transfers: As we continue to develop our business, we may buy, merge, or partner with other companies. In such transactions (including in contemplation of such transactions), user information may be among the transferred assets. If all or part of our assets are sold or transferred to a third party, customer information (including your email address) would likely be one of the transferred business assets. If such transfer is subject to additional mandatory restrictions under applicable laws, we will comply with such restrictions.

Public Forums: Certain features of our Services allow you to publicly share comments with other users. Any information you submit through such features is not confidential and we may use it for any purpose (including in testimonials or other marketing materials). Any information you openly post in this manner will be available to the general public and potentially accessible through third-party search engines. Accordingly, please exercise caution when using these features.

Aggregated/Anonymous Information: Occasionally, we may share aggregated/anonymous information about the use of the Services, for example, by publishing a report on usage trends. The sharing of such data is not restricted.

Service Providers:

We provide access to your information or share it with selected third parties who provide services on our behalf. They have access to perform these services but are prohibited from using your information for other purposes. They provide us with a variety of services, including billing, sales, marketing, product content and features, advertising, analytics, research, customer service, data storage, security, fraud prevention, payment processing, and legal services.

Protection of H21 and Others:

By using the Services, you acknowledge and agree that we may access, retain, and disclose the information we collect and maintain about you if required by law or if we believe in good faith that such access, retention, or disclosure is reasonably necessary to: (a) comply with legal process (e.g., a subpoena or court order); (b) enforce our Terms of Service, this Privacy Policy, or other contracts with you, including investigating potential violations thereof; (c) respond to claims that any content violates the rights of third parties; (d) respond to your customer service requests; and/or (e) protect the rights, property, or personal safety of H21, its agents and affiliates, its users, and/or the public. This includes exchanging information with other companies and organizations for fraud protection and spam/malware prevention.

Business Transfers:

As we continue to develop our business, we may buy, merge, or partner with other companies. In such transactions (including in contemplation of such transactions), user information may be among the transferred assets. If all or part of our assets are sold or transferred to a third party, customer information (including your email address) would likely be one of the transferred business assets. If such transfer is subject to additional mandatory restrictions under applicable laws, we will comply with such restrictions.

Public Forums:

Certain features of our Services allow you to publicly share comments with other users. Any information you submit through such features is not confidential and we may use it for any purpose (including in testimonials or other marketing materials). Any information you openly post in this manner will be available to the general public and potentially accessible through third-party search engines. Accordingly, please exercise caution when using these features.

Aggregated/Anonymous Information:

Occasionally, we may share aggregated/anonymous information about the use of the Services, for example, by publishing a report on usage trends. The sharing of such data is not restricted.

Retention of Your Information

We retain your information no longer than necessary for the purposes for which it is processed. The period of time during which we retain the information depends on the purposes for which we collect and use it and/or as required to comply with applicable laws.

How We Protect Your Information

H21 takes technical and organizational security measures to protect the information provided through the Services from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet transmission or email is completely secure or error-free. Please keep this in mind when disclosing any information to H21 via the Internet.

Third-Party Links and Features

The Services contain links to third-party websites, such as social media sites, and also contain third-party plugins (such as Facebook's "Like" button and Twitter's "Follow" button). If you choose to use these sites or features, you may disclose your information not only to those third parties but also to their users and the general public, depending on how their services operate. We are not responsible for the content or practices of these websites or services. The collection, use, and disclosure of your information will be subject to the privacy policies of the third-party websites or services, not this Privacy Policy. We recommend that you read the privacy and security policies of these third parties.

Children's Privacy

The Services are intended for a general audience and not for children and/or minors. If we become aware that we have inadvertently collected "personal information" (as defined by the respective law) from children and/or minors without valid parental consent, we will take reasonable steps to delete it as soon as possible.

Rights and Options of the Data Subject as well as the Limitation of Use or Disclosure of Your Personal Data

You can opt out of receiving promotional messages by landline or cell phone; likewise, you can opt out of receiving postal advertising mail and you can also opt out of receiving promotional emails through the following request: