VIAJES A LAS TRADICIONES III, S.A. DE C.V., also known as WORLDPASS, in compliance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter, the Law) and other applicable regulations, makes this Privacy Notice available to you, which describes the terms, conditions, and purposes of the processing of your personal data.

The controller of the collected personal data is VIAJES A LAS TRADICIONES III, S.A. DE C.V., also known as "WORLDPASS," with its fiscal address located at Avenida García de la Torre, Block 9, Lot 50, letter “A,” Apartment 1, Super Block 2, Cancun, Quintana Roo, Mexico. WORLDPASS will be responsible for the use, protection, and handling of your personal data as established in this notice. For any inquiries, clarifications, or to exercise rights related to your personal data, please contact us at the following email: info@worldpassmail.com.

For the purposes of this Privacy Notice, the following terms shall have the meaning ascribed to them below:

• Personal data: Any information concerning an identified or identifiable natural person.
• Sensitive Personal Data: Data that affects the most intimate sphere of the data subject, or whose improper use could result in discrimination or pose a serious risk, such as racial origin, health status, religious beliefs, political opinions, or sexual preferences. WORLDPASS does not collect sensitive personal data unless it is indispensable for providing a specific service requested by the data subject.
• Data subject: The individual to whom the personal data belongs.
• Controller: WORLDPASS, as the entity that decides on the processing of personal data.
• ARCO Rights: Rights of access, rectification, cancellation, and opposition to the processing of personal data, which are granted to the data subject under the Law.

WORLDPASS (hereinafter referred to as "the controller") informs that the personal data subject to processing, which includes collection, use, disclosure, storage, handling, utilization, transfer, or disposal, will be those provided directly by the data subject (you) or those to which the controller has legitimate access.

For the purposes set forth in this Privacy Notice, WORLDPASS may obtain and process personal data through the following means:

• Directly provided by you: Via physical or electronic forms or any other means enabled by WORLDPASS.
• Through visits to the controller's websites: Including but not limited to digital platforms and systems related to the services offered by WORLDPASS.
• Through the use of online services provided by WORLDPASS: Including data authorized by the data subject to be shared from their social media platforms (Facebook, Twitter, LinkedIn, Google), as per the permissions granted on such platforms.
• Via other legitimate means: Including but not limited to publicly accessible sources or information provided by third parties authorized by applicable laws.
• Direct communication with WORLDPASS: Where the data subject provides personal data to request services, assistance, or support related to the controller's activities.

Personal data to be processed:
The controller may collect and process the following personal data, in accordance with applicable legislation and as indicated in this Privacy Notice:

1. Identification: First and last names, phone number(s), marital status, email address, age, date of birth, social media accounts, gender, company name, and/or tax ID number (RFC). Preferences related to accommodation services and/or travel needs.
2. Physical location: Residential address, fiscal address; booking and/or stay dates, hotel, flight date and time
3. Authentication: Username and password, handwritten signature, voice recordings.
4. Financial information: Bank card number and expiration date.

These data will be processed in accordance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility as set forth in applicable data protection legislation. WORLDPASS is committed to implementing the necessary measures to protect the confidentiality and security of the personal data it holds.

The purposes for which your personal data are processed include:

1. To fulfill the contracted services, such as reservations, vacation certificate purchases, WORLDPASS membership, or the purchase of tourism-related products and/or services.
2. To identify preferences to personalize service delivery.
3. To inform the data subject that their personal data will be processed by WORLDPASS and/or its affiliates, subsidiaries, or third parties acting on behalf of WORLDPASS, who must comply with this Privacy Notice.
4. To offer promotions, tourism-related products, and commercial services, as well as to send promotions, special services, and surveys.
5. To manage support requests (including complaints or inquiries).
6. To verify the accuracy of any information and personal data provided by you (including your identity).
7. To maintain and store records related to you or your membership.
8. To protect WORLDPASS's rights and interests in legal proceedings, if applicable.

The data subject may limit the use or disclosure of their personal data for purposes other than those necessary for the legal relationship by:

1. Registering with the Public Registry to Avoid Advertising, managed by the Federal Consumer Protection Agency (PROFECO), to prevent personal data from being used for advertising or promotional purposes. For more information, you may visit PROFECO's website or contact them directly
2. Sending a request to the email info@worldpassmail.com, indicating the email(s) and/or phone number(s) to be limited.

When processing member data, website data, and/or member support data based on our legitimate interests, we ensure consideration of any potential impact on you and your data protection rights. We will not use your personal data for activities where our interests are overridden by your rights unless we have your consent or are otherwise required or permitted by applicable law.

The data subject has the right to access, rectify, cancel, or oppose the processing of their personal data. To exercise these rights, the data subject must submit a written request to WORLDPASS via its physical address or email at info@worldpassmail.com, including the following:

1. Name of the data subject.
2. Email address for notifications.
3. Documents proving their identity or legal representation, if applicable.
4. A clear and precise description of the personal data for which they seek to exercise a right and the right to be exercised.
5. Any other element or document that facilitates locating the personal data.

If the request does not meet the above requirements, the Department handling such requests may require additional elements or documents within five days of receiving the request. The data subject will have ten days to respond; otherwise, the request will be considered not submitted.
Response times, unless otherwise provided by applicable regulations, will be a maximum of 30 days from the date the request is received to communicate the determination. If applicable, the request will be fulfilled within 15 days following the issuance of the response. These timeframes may be extended once for an equal period if justified by the circumstances of the case.
To protect confidentiality, WORLDPASS will send the response to the email provided for such purposes and will keep it available at the address mentioned above.

WORLDPASS may transfer personal data only under the following circumstances:

1. To affiliated companies, subsidiaries, or third-party processors for the contracted services.
2. When required by competent authorities or applicable laws

No transfers of personal data will be made without the explicit consent of the data subject, except for the cases provided in Article 37 of the Law.

This Privacy Notice may be modified or updated to reflect changes in our practices or applicable regulations. Such modifications will be communicated via our website. Therefore, we recommend you periodically review this Privacy Notice to stay informed of any updates

If you have any questions, comments, or concerns about how we use or process your personal data, please contact us via email at info@worldpassmail.com.

The Data Subject declares that they have read and understood this Privacy Notice, granting their consent for the processing of their personal data under the terms established herein. In case of disagreement, they may express it through the means indicated in Section V.