Last updated: April 28, 2023
In accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, and other current and related regulations ("Personal Data Legislation"), this Privacy Notice is issued.
XCANDALU, S.A. de C.V. (the "Controller" or "We", interchangeably) collects, uses, discloses, and stores (hereinafter, "Processing") personal data ("Personal Data") from you ("You" or the "Data Subject") and has an address for the purpose of receiving notifications regarding this Privacy Notice at Hotel Cocolia, located on Calle sin nombre s/n, municipality of Santa María Tonameca, C.P. 70949 in Mazunte, Oaxaca, Mexico.
For the purposes stated in this Privacy Notice, we will process the following categories of Personal Data: identification and contact information.
We will process the Personal Data for the following primary and necessary purposes: confirming your identity and contact information; addressing any requests or requirements; performing all necessary acts for the execution and fulfillment of the service agreement entered into between the Data Subject and the Controller; executing administrative processes of the Controller; maintaining physical, electronic, and/or procedural safeguards of your Personal Data in accordance with applicable laws and regulations, as well as industry practices; managing, administering, and securing your Personal Data; responding to legal requirements from competent national and international authorities, either to the Controller or its subsidiaries and/or affiliates; fulfilling obligations arising from the legal relationship between you and the Controller; making the transfers mentioned in Section 5; conducting processes related to corporate restructures of the Controller, including mergers, consolidations, sales, liquidations, or asset transfers; complying with any legal, national, or international obligations applicable to the Controller, its subsidiaries and/or affiliates, and managing any legal proceedings; and carrying out complementary and/or analogous activities necessary for the aforementioned purposes.
We will process the Personal Data for the following secondary or ancillary purposes: marketing, advertising, promotions, newsletters, advertising messages, news, event invitations, commercial prospecting, and offering new services.
If you do not wish your personal data to be processed for these secondary or ancillary purposes, you may send an email at any time to hola@cocoliahotel.com following the procedure referred to in Section 6 of this Privacy Notice.
In accordance with the procedure established in Section 6 of this Privacy Notice, you may submit a request to limit the use or disclosure of your Personal Data, unless there are reasons for which such limitation or use is not applicable.
Your Personal Data may be transferred within the national territory or abroad, as follows:
To parent, controlled, or jointly controlled companies of the Controller, operating under the same internal processes and policies, for centralized data storage, service provision, administration, analytical and statistical purposes, client records, commercial prospecting, and other internal processes of the Controller.
To operators or potential operators of the Controller's hotels, when the transfer is necessary for maintaining or fulfilling the relationship between the Controller and the Data Subject.
To authorities, agencies, or governmental entities, in compliance with or related to obligations under applicable legislation for the Controller, its subsidiaries, and/or affiliates, or to comply with requests made to them.
To authorities, agencies, or governmental entities, notaries, and public brokers, when the transfer is required or necessary for the recognition, exercise, or defense of a right of the Controller, its subsidiaries, and/or affiliates in a legal proceeding.
To third-party acquirers, as part of a corporate restructure of the Controller, including mergers, consolidations, sales, liquidations, or asset transfers, when the transfer is necessary for maintaining or fulfilling the relationship between the Controller and the Data Subject.
To advisors, suppliers, and service providers of the Controller, when the transfer is necessary for maintaining or fulfilling the relationship between the Controller and the Data Subject.
Based on other assumptions established in the Personal Data Legislation, which do not require your consent.
The aforementioned transfers do not require your consent under the Personal Data Legislation.
In all legally applicable cases, you may at any time and following the procedure set forth in this section, exercise the following rights concerning your Personal Data: (i) rights of Access, Rectification, Cancellation, or Opposition ("ARCO Rights"); (ii) revoke the consent granted to the Controller for the processing of Personal Data; (iii) limit the use or disclosure of Personal Data; and (iv) express your refusal for the processing of your personal data regarding the aforementioned secondary and ancillary purposes.
To exercise the rights regarding your Personal Data, you must submit the corresponding request in a signed written document delivered to Hotel Cocolia, located on Calle sin nombre s/n, municipality of Santa María Tonameca, C.P. 70949 in Mazunte, Oaxaca, Mexico, or via email to hola@cocoliahotel.com. The request must meet the requirements set forth in the applicable Personal Data Legislation and include the following: your name and address or another means to communicate the response to your request (the Controller may respond to the email address used to submit the request, even if not explicitly mentioned as the communication method); a copy of documents proving your identity (valid official ID with photo); if applicable, the full name of your legal representative, documents proving the identity of both the Data Subject and the representative (valid official ID with photo), and a copy of a power of attorney or a letter signed by two witnesses, showing the representative’s authority in accordance with the terms of the Personal Data Legislation; a clear and precise description of the rights you wish to exercise; in the case of rectification requests, the changes to be made and supporting documentation; and any other element or document that facilitates the location of your Personal Data.
We will process the Data Subjects' requests to exercise their rights regarding Personal Data within a maximum of 20 (twenty) business days from receipt and fulfill the request, if applicable, within 15 (fifteen) business days from our response. The Controller may extend this period by an additional 20 (twenty) business days if warranted, with prior notice to the Data Subject.
You may obtain the requested information or Personal Data through electronic documents in standard formats or any other legitimate means that ensure and verify the effective exercise of the requested right. Our Privacy Officer is responsible for handling requests from Data Subjects regarding the exercise of their rights and may be contacted via email: hola@cocoliahotel.com.
We inform you that our website https://www.cocoliahotel.com/ (the "Site") and, where applicable, our social media pages use cookies and other technologies that may automatically monitor your behavior, offer our services, and provide you with an optimal and personalized experience while using them. The personal data collected through these technologies includes: geographic location, IP address, date and time of access, interaction with content, browsing data, browser features, and the user device’s operating system.
These technologies may be disabled by accessing the Privacy and/or Security option(s) located in the Internet Options, Tools, Internet Preferences, or similar sections of the browser you are using. However, please note that disabling these technologies may prevent full functionality of the Site and social media features. For more information about cookies mentioned in this section, you may visit www.allaboutcookies.org/es.
This Privacy Notice may be modified, changed, or updated due to new legal requirements, our own service needs, our practices, privacy programs or policies, changes in our business model, or other reasons.
We are committed to informing you about any changes to this Privacy Notice via the email address you provided to the Controller for communication purposes and/or through publication on the Site.