The controller of the collected personal data is WORLDPASS TRAVEL SERVICES LLC, also known as WORLDPASS, with its fiscal address located at 800 Brickell Ave Ste 800, Miami, Florida, 33131, United States.

WORLDPASS will be responsible for the use, protection, and handling of your personal data as established in this Privacy Notice.

For any inquiries, clarifications, or to exercise rights related to your personal data, please contact us at the following email: info@worldpassmail.com

For the purposes of this Privacy Notice, the following terms shall have the meaning ascribed to them below:

• Personal Data: Any information concerning an identified or identifiable individual.
• Sensitive Personal Data: Data that affects the most intimate sphere of the data subject, or whose improper use could result in discrimination or pose a serious risk to them, such as racial or ethnic origin, health status, religious beliefs, political opinions, or sexual preferences. WORLDPASS does not collect sensitive personal data unless it is indispensable for providing a specific service requested by the data subject.
• Data Subject: The individual to whom the personal data belongs.
• Controller: WORLDPASS, as the entity that decides on the processing of personal data.
• ARCO Rights: Rights of access, rectification, cancellation, and opposition to the processing of personal data provided for under the Law.

WORLDPASS (hereinafter, the "Controller") informs that the personal data subject to processing, including its collection, use, disclosure, storage, handling, utilization, transfer, or disposal, will be those provided directly by the data subject or those to which the Controller has legitimate access.

For the purposes set forth in this Privacy Notice, WORLDPASS may obtain and process personal data through the following means:

• Directly provided by you: Via physical or electronic forms, or any other means enabled by WORLDPASS.
• Through visits to the Controller's websites: Including digital platforms and systems related to the services offered by WORLDPASS.
• Through the use of the online services provided by WORLDPASS: Including data authorized by the data subject to be shared from their social media platforms (Facebook, Twitter, LinkedIn, Google), as per the permissions granted on such platforms.
• Via other legitimate means: Including but not limited to publicly accessible sources or information provided by third parties authorized by applicable laws.
• Direct communication with WORLDPASS: Where the data subject provides personal data to request services, assistance, or support related to the controller's activities.

Personal data to be processed:

The controller may collect and process the following personal data, in accordance with applicable legislation and as indicated in this Privacy Notice:

1. Identification data: First and last names, phone number(s), marital status, email address, age, date of birth, social media accounts, gender, company name and/or tax ID number (RFC). Preferences related to accommodation services and/or travel needs.
2. Physical location: Residential address, fiscal address; booking and/or stay dates, hotel, flight date and time.
3. Authentication: Username and password, handwritten signature, voice recordings.
4. Financial information: Bank card number and expiration date.

These data will be processed in accordance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility as set forth in application data protection legislation. WORLDPASS is committed to implementing the necessary measures to protect the confidentiality and security of the personal data it holds.

The purposes for which your personal data are processed include:

1. To fulfill the contracted services, such as reservations, vacation certificate purchases, WORLDPASS memberships, or the purchase of tourism-related products and/or services.
2. To identify your preferences in order to personalize service delivery.
3. To inform the data subject that their personal data will be processed by WORLDPASS and/or its affiliates, subsidiaries, or third parties acting on behalf of WORLDPASS, who must comply with this Privacy Notice.
4. To offer promotions, tourism-related products, and commercial services, as well as to send promotions, special services, and surveys.
5. To manage support requests (including complaints or inquiries).
6. To verify the accuracy of any information and personal data provided by you (including your identity).
7. To maintain and store records related to you or your membership.
8. To protect WORLDPASS's rights and interests in legal proceedings, if applicable.

The data subject may limit the use or disclosure of their personal data for purposes other than those necessary for the legal relationship by:

1. Registering with the Public Registry to Avoid Advertising, managed by the Federal Consumer Protection Agency (PROFECO), to prevent personal data from being used for advertising or promotional purposes. For more information, you may visit PROFECO's website or contact them directly.
2. Sending a request to the email info@worldpassmail.com, indicating the email(s) and/or phone number(s) to be limited.

When processing member data, website data, and/or member support data based on our legitimate interests, we ensure consideration of any potential impact on you and your data protection rights. We will not use your personal data for activities where our interests are overridden by your rights unless we have your consent or are otherwise required or permitted by applicable law.

The data subject has the right to access, rectify, cancel, or oppose the processing of their personal data. To exercise these rights, the data subject must submit a written request to WORLDPASS via its physical address or email at info@worldpassmail.com, including the following:

1. Name of the data subject.
2. Email address for notifications.
3. Documents proving their identity or legal representation , if applicable.
4. A clear and precise description of the personal data for which they seek to exercise a right and the right to be exercised.
5. Any other element or document that facilitates locating the personal data.

If the request does not meet the above requirements, the Department handling such requests may require additional elements or documents within five days of receiving the request. The data subject will have ten days to respond; otherwise, the request will be considered not submitted.

Response times, unless otherwise provided by applicable regulations, will be a maximum of 30 days from the date the request is received to communicate the determination. If applicable, the request will be fulfilled within 15 days following the issuance of the response. These timeframes may be extended once for an equal period if justified by the circumstances of the case.

To protect confidentiality, WORLDPASS will send the response to the email provided for such purposes and will keep it available at the address mentioned above.

WORLDPASS may transfer personal data only under the following circumstances:

1. To affiliated companies, subsidiaries, or third-party processors for the contracted services.
2. When required by competent authorities or applicable laws.

No transfers of personal data will be made without the explicit consent of the data subject, except for the cases provided in Article 37 of the Law.

This Privacy Notice may be modified or updated to reflect changes in our practices or in applicable legislation. Such modifications will be communicated via our website.

Therefore, we recommend you periodically review this Privacy Notice to stay informed of any updates.

If you have any questions, comments, or concerns about how we use or process your personal data, please contact us via email at info@worldpassmail.com.

As part of its communications with you, WORLDPASS may send text messages (SMS) related to your appointments, services, and account activity. This section describes the purpose, scope, and management of these SMS notifications, in addition to the general provisions set out in this Privacy Notice.

1. Purpose of SMS Notifications

Our SMS notifications are intended to:

• Remind you of your scheduled appointments.
• Notify you about upcoming services, payment reminders, and other important notifications related to WORLDPASS.

2. Opt-In and Consent

By providing your phone number and opting in to receive SMS notifications, you confirm that you are the owner or authorized user of the phone number provided.

You consent to receive recurring automated text messages (SMS and MMS) from us regarding your scheduled appointments, service updates, promotional offers, and other important notifications. Your consent to receive these messages is not a condition of purchasing any products or services from us.

Message frequency may vary; however, you can generally expect to receive between one (1) and five (5) messages per week.

3. Opt-out Instructions

Your consent to receive automated text messages is completely voluntary. You may opt out at any time by:

• Replying "STOP," "END," "CANCEL," "UNSUBSCRIBE," or "QUIT" to any SMS message you receive from us.
• Sending an email with your opt-out request to unsubscribe@worldpassmail.com

After you opt out, you will receive a final confirmation message. No additional SMS messages will be sent to your phone number unless you choose to opt in again.

4. Help and Support

If you experience any issues with our SMS notifications or require assistance, you may:

• Reply "HELP" to any SMS message you receive from us.
• Contact us by email at support@worldpassmail.com.

5. Message and Data Rates

Standard message and data rates may apply to messages sent to you from us and to messages sent by you to us. Please contact your mobile service provider for information regarding your text messaging or data plan charges.

6. Privacy and Data Security

We value your privacy and are committed to protecting your personal information. Your personal data related to SMS notifications will be used solely for the purposes described in this section, including managing your service appointments, processing payments, and facilitating communications related to the services we provide, consistent with the principles set out in Section IV (Purposes of Data Processing).

We do not sell, rent, or share your personal information with third parties for marketing purposes. We may disclose your information to third parties only when required by law, for billing and payment processing, or as necessary to fulfill our contractual obligations, as further described in Section VII (Transfer of Personal Data).

7. Data retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including compliance with applicable legal, accounting, and reporting obligations. Once the applicable retention period has expired, your personal information will be securely deleted or anonymized.

The Data Subject declares that they have read and understood this Privacy Notice, granting their consent for the processing of their personal data under the terms established herein. In case of disagreement, they may express it through the means indicated in Section V.