PRIVACY POLICY

1. Identity and Address of the Party Responsible for Collecting Your Data.

The company known as Mexstays Lumina, S.A.P.I. de C.V. (hereinafter “Lumina”), with address at HP
Diamante, Lomas de Bezares, Miguel Hidalgo, 11910 Ciudad de México, CDMX, in accordance with
the Federal Law on Protection of Personal Data Held by Private Parties (la “Ley”) is responsible for
processing the personal data (hereinafter Personal Data) collected by itself o a través de sociedades con
las que Lumina cuenta con una relación comercial, las cuales se mencionan en el Anexo A de este
documento y serán referidas únicamente para efectos de este Privacy Notice conjuntamente como
Lumina. La recopilación de Personal Data se realizará mediante formatos físicos, redes sociales, una o
más plataformas digitales, aplicaciones móviles para teléfonos inteligentes y cualquier otro medio
existente o por existir, (las “Digital Platforms”) and/or the websites listed in Annex B of the Privacy
Notice (the “Website”, physical forms, social media, and together with the Digital Platforms,
the “Platform”) to certain individuals (hereinafter “Data Subjects”) who use the Platform to receive
certain services from Lumina, including but not limited to no limitativa: (i) para efectos de que Lumina
subarriende en favor de los Data Subjects los inmuebles arrendados en su favor, (ii) para brindar servicios
de hospedaje en favor de los Data Subjects, (iii) cualquier otro acto derivado o necesario para subarrendar
o prestar los servicios de hospedaje o cualquier otra actividad lícita que resulte conveniente y/o necesaria
para efectos de llevar a cabo dichas actividades en favor de los Data Subjects, y en su caso, (iv) celebrar
contratos de arrendamiento sobre inmuebles y (v) celebrar contratos de administración sobre inmuebles.
(Estas actividades desarrolladas por Lumina se denominarán en su conjunto y en lo individual como
los “Services”).

Data Subjects may send an email to the ARCO officer (access, rectification, cancellation, and opposition),
who will be responsible for the care and management of their data, at the following email address
arco@luminastays.com.

2. Purposes of Processing.
Lumina uses the Personal Data collected through the Platform primarily to carry out the following
activities, which are necessary in connection with the Services provided to Data Subjects:

A. Main Services to Users of the Services:
Primary Purposes:
I. Provide Data Subjects with the Services and other services in accordance with its corporate
purpose.
II. Fulfill the obligations arising from the Services mentioned in items (i), (ii), and (iii) above.
III. Evaluate the quality of the Services.
IV. Send relevant information related to the Services.
V. Evaluate your user profile.
VI. Carry out the administrative procedures necessary to provide the corresponding Services.
Secondary Purposes:
I. Compile and update user records

Página 2 de 8
II. Comply with legal requirements of competent authorities.
III. Address your questions regarding the Services provided by Lumina.
IV. Create a user directory.
B. Main Services to Landlords and Property Owners Related to the Services:
Primary Purposes.
I. Enter into property lease agreements and other legal acts necessary to carry out the
formalization of dichos contratos de arrendamiento de inmuebles (los “Lease Agreements”).
II. Enter into property management agreements and other legal acts necessary to carry out the
formalization oe dichos contratos de administración de inmuebles (los “Management
Agreements”).
III. Fulfill the obligations arising from the execution of the Lease Agreements.
IV. Fulfill the obligations arising from the execution of the Management Agreements.
V. Comply with legal requirements of competent authorities.
VI. Evaluate the quality of the Services.
VII. Address your questions regarding the Lease Agreements.
VIII. Conocer y atender sus dudas respecto de los Management Agreements.
Secondary Purposes.
I. Compile and update landlord records.
II. Send relevant information related to the Lease Agreements.
III. Evaluate your landlord profile.
IV. Address your questions regarding the Lease Agreements.
V. Create a landlord directory.
Lumina reserves the right to modify the aforementioned purposes, informing Data Subjects of such
changes through the Platform.
The processing of Personal Data shall be that which is necessary, adequate, and relevant in relation to the
purposes set forth in this Privacy Notice, as well as other compatible or complementary purposes related
to the Services and the execution of the Lease Agreements and Management Agreements, as applicable.
3. Personal Data Collection Process.
3.1. Personal Identification and Registration Data.
When the Data Subject registers on the Platform in order to receive the Services, based on the primary
purposes, they may choose to provide the following data to create an account with Lumina:

o Full name
o Address
o Date of birth
o Nationality
o Country of residence
o Landline phone

Página 3 de 8

o Mobile phone
o Email address
o Payment data and banking information

The Personal Data provided by the Data Subject through the Platform, as well as that collected directly by
Lumina through physical, electronic, digital, or any other means permitted by applicable law, to the extent
necessary for the provision of the Services, shall be stored and processed by Lumina, which shall
implement reasonable administrative, technical, and physical measures to protect it against damage, loss,
alteration, destruction, unauthorized use, access, or processing.
Lumina will use the information that Data Subjects share through the Platform to carry out and fulfill the
applicable processing purposes mentioned in Section 2 above of this Privacy Notice.
Data Subjects' Personal Data may be shared with third parties unaffiliated with Lumina who act as service
providers, processors, suppliers, or any other third party related to the operation of the Platform or the
provision of the Services, solely to the extent necessary to fulfill the purposes described in this Privacy
Notice and to address Data Subjects' requests.
3.2. Payment Information.
Where applicable, Lumina may use specialized third-party providers to process payments, transfers, or
any other financial transaction related to the Services through the Platform. Such providers may collect,
process, store, and safeguard Data Subjects' financial information and payment data in accordance with
their own privacy policies and security measures.
Lumina may have limited access to certain information related to such payments solely to the extent
necessary to verify, manage, and fulfill the obligations arising from the Services contracted by Data
Subjects.
The Data Subject acknowledges and agrees that the processing of their financial data by such third-party
providers shall be governed by each provider's respective terms, conditions, and privacy notices, and it is
recommended to review such documents before providing any financial information.
The Platform may contain links, hyperlinks, or redirections to third-party websites, applications, or
platforms not owned by or under the control of Lumina. Accordingly, Lumina shall not be liable for the
practices, policies, or procedures related to Personal Data processing carried out by such third parties.
4. Data Transfer.
We inform you that the Data Subject's Personal Data may be shared and/or transferred, within and outside
the national territory, with individuals or legal entities, authorities, affiliated companies, subsidiaries,
suppliers, and third parties related to Lumina's operations, solely to fulfill the purposes set forth in this
Privacy Notice and in accordance with applicable law. In particular, Personal Data may be transferred to:
I. Third-party service providers, advisors, consultants, notaries, financial institutions, technology
platforms, payment processing providers, and other providers necessary for the adequate

Página 4 de 8

provision of the Services and fulfillment of Lumina's legal and contractual obligations toward
Data Subjects.
II. Affiliated, subsidiary, parent, or related companies of Lumina, when such transfer is necessary for
administrative, operational, commercial, or Services-related purposes.
III. Third-party providers of information analysis, identity validation, research, data verification,
fraud prevention, risk analysis, and commercial profiling services, for the purpose of evaluating
the feasibility, suitability, and security of operations related to the Services and, where applicable,
the execution of real estate intermediation agreements.
IV. Competent administrative, judicial, or governmental authorities, when the transfer is required by
legal provision, official requirement, court order, or any other applicable legal obligation.
Lumina shall endeavor to ensure that third-party recipients of Personal Data assume confidentiality,
security, and Personal Data protection obligations consistent with those established in this Privacy Notice
and applicable law.
Lumina does not sell your Personal Data.
5. Data Subject Liability and Unauthorized Transfers.
The Data Subject agrees to use the Platform exclusively for their own purposes. If another person,
whether an individual or legal entity, uses the Platform and Personal Data is transferred without Lumina's
consent, Lumina shall not be liable for the data transferred without its consent, whether by telephone or
email.
Lumina shall only be responsible for Personal Data transferred to it through its Platform. If Data Subjects
transfer their Personal Data through other platforms or forms of communication, this Privacy Notice shall
not apply.
6. Rights of Access, Rectification, Cancellation, and Opposition.
El Data Subject tiene derecho a conocer cuáles serán los Personal Data tratados por Lumina, para qué son
utilizados y las condiciones de uso de los mismos (“Acceso”). Asimismo, es su derecho solicitar la
corrección de su información personal en caso en que esté desactualizada, sea inexacta o incompleta
(“Rectification”); solicitar la eliminación de su información personal del registro o base de datos de
Lumina cuando el Data Subject considere que la misma no está siendo utilizada conforme a los
principios, deberes y obligaciones previstas en este Privacy Notice y/o la Ley aplicable (“Cancellation”);
así como oponerse al uso de sus Personal Data para fines específicos que no sean servicios principales
ofertados por Lumina (“Opposition”). These rights are known as ARCO rights.
To exercise ARCO rights, the Data Subject must submit the corresponding request to Lumina via email to
arco@luminastays.com. Such request must include: (i) the Data Subject's full name and address for
response purposes; (ii) a copy of the document proving identity or, where applicable, a copy of the
document evidencing duly granted legal representation on behalf of the Data Subject; (iii) a description of
the Personal Data for which an ARCO right is sought to be exercised; (iv) any other element that may
facilitate the location of the Personal Data; (v) the specific ARCO right intended to be exercised; and (vi)
a brief account of the reasons for seeking to exercise the ARCO right.

Página 5 de 8

Lumina se comunicará con el Data Subject o con quien sus derechos representen, dentro de un plazo de
10 (diez) días hábiles siguientes a la presentación de su solicitud, la respuesta a la misma. The
cancellation of your data shall be subject to the provisions of Article 26 of the Law.
7. Revocation of Consent for Processing of Personal Data.
The Data Subject may revoke consent for the processing of their Personal Data, for which the Data
Subject must send the corresponding request via email to arco@luminastays.com, accompanied by the
information and documentation mentioned in Section 6 above of this Privacy Notice.
However, please note that for certain purposes, revoking your consent may mean that Lumina is no longer
able to continue providing the Service(s) you requested, or may result in termination of your relationship
with Lumina. You should also consider that we may not always be able to fulfill your request or cease
processing immediately, as we may be legally required to continue processing your Personal Data for an
additional period.
8. Limitation on Use and Disclosure of Personal Data.
The Data Subject may limit the use and disclosure of their Personal Data, including but not limited to
refusing to receive communications and promotions from Lumina by: (i) registering with the Public
Registry to Avoid Advertising, managed by the Federal Consumer Protection Agency (PROFECO), so
that their Personal Data is not used to receive advertising or promotions from goods or services
companies. For more information, please visit the PROFECO website or contact them directly; or (ii) by
submitting a written request.
9. Security Measures
In order to provide greater protection and confidentiality of the Data Subject's Personal Data, Lumina will
implement all possible security measures, such as access controls, encryption tools, and various software
solutions on the Platform.
10. Use of “cookies”, “web beacons” or any similar or analogous technology on the Platform.
a. Sites for Collecting Personal Data.
Lumina utiliza diversas Platforms y el Website para recopilar información que usan “cookies”, que son
archivos de texto que se colocan en su computadora, para ayudar al sitio a analizar cómo los Data
Subjects los usan.
b. Personal Data Collected Through “cookies” and Similar Technologies.
Lumina y sus proveedores de servicios utilizan “cookies”, “web beacons” y otras tecnologías para recibir
y almacenar ciertos tipos de información cada vez que los Data Subjects interactúan con la Platform a
través de su dispositivo. Una “cookie” es un pequeño archivo que contiene una cadena de caracteres que
se envía a su dispositivo cuando visita un sitio web. Cuando vuelve a visitar la Platform o los sitios de los
proveedores de servicios, la “cookie” les permite a los sitios de los proveedores de servicios reconocer su
navegador. Las “cookies” pueden almacenar identificadores únicos, preferencias del Data Subject y otra
información. Puede reiniciar su navegador para rechazar todas las “cookies” o para indicar cuándo se está
enviando una “cookie”. Sin embargo, es posible que algunas funciones o servicios de la Platform o los

Página 6 de 8

sitios de los proveedores de servicios no funcionen correctamente sin “cookies”. Utilizamos “cookies”
para mejorar la calidad de nuestro Servicio, incluso para almacenar las preferencias de los Data Subjects,
y hacer un seguimiento de las tendencias de los Data Subjects.
"Web beacons" are images embedded in a webpage or email that can be used to monitorear el
comportamiento de un visitante, como almacenar información sobre la dirección IP del Data Subject,
duración del tiempo de interacción en dicha página y el tipo de navegador utilizado, entre otros.
We inform you that we use "cookies" and "web beacons" to obtain personal information about the Data
Subject, such as the followinte:
o The Data Subject's browser type and operating system.
o The websites visited.
o The links followed.
o The IP address.
o The site the Data Subject visited before entering the Platform.
Estas “cookies” y otras tecnologías pueden ser deshabilitadas. Existen diversos sitios en la Platform que
pueden conectarse con otros sitios web que no funcionan bajo las políticas de privacidad de la Platform.
Cuando el Data Subject se conecta a otros sitios web, las prácticas de privacidad de la Platform, así como
el presente Privacy Notice ya no tienen validez. Invitamos a los Data Subjects a revisar las políticas de
privacidad, así como el aviso de privacidad correspondiente de cada sitio antes de revelar cualquier Dato
Personal o de identificación personal. Todos los Personal Data que se recopilen en la Platform deberán
ser actualizados para los fines que fueron recabados de acuerdo con este Privacy Notice y en caso de que
los Personal Data dejen de ser necesarios para las finalidades previstas por Lumina, estos deberán ser
cancelados.
11. Amendments to the Privacy Notice.
This Privacy Notice may be subject to modifications, changes, or updates arising from new legal
requirements; the needs of Lumina in providing its Services; changes to its privacy practices; changes to
its business model; or other causes.
These modifications will be available to the public and Data Subjects through the following means:
o Visible announcements on the Website https://luminastays.com (Privacy Notice section);
o It may appear as a notification within the Platform.

12. Consent of Data Subjects.
In accordance with Article 7 of the Law, we require the consent of Data Subjects for the processing of
their Personal Data. Accordingly, Data Subjects understand and agree, for all applicable purposes and in
an express, unconditional, and irrevocable manner, to the scope and content of this Privacy Notice,
thereby consenting to the processing of their Personal Data when using the Platform.

Página 7 de 8

Cualquier duda o comentario respecto al presente Privacy Notice, así como el ejercicio de cualesquiera
otros derechos que por la Ley y el Reglamento le corresponden, deberán dirigirse al encargado de Avisos
de Privacidad de Lumina al correo electrónico arco@luminastays.com.
Without prejudice to the foregoing, if the Data Subject considers that the processing of their Personal
Data constitutes a violation of the Law and its Regulations, they may contact the Secretaría
Anticorrupción y Buen Gobierno and/or Transparencia para el Pueblo to seek any clarification or exercise
their rights under the Law and its Regulations.
13. Language.
Lumina and the Data Subject agree that this Privacy Notice is agreed upon in English and Spanish, and
that in the event of any discrepancy between the two languages, the Spanish version shall prevail.

[INTENTIONALLY LEFT BLANK]

Página 8 de 8
Annex A
Business Relationships

– Notto
– Cholula Condesa
– Boga
– Casa Cibeles
– Nomu
– Casa Tala
– OR Cabo
– Casa Nima
– Puerta Cortés
– District Polanco
– Santolivo
– Urban Reforma
– Namora Stay
– Corasol
– Casa Izel
– Conchita
– Xuna
– El Bar

Página 9 de 8
Annex B
List of Websites

– https://notto.mx/en/
– https://cholulacondesa.com/
– https://bogastay.com/
– https://casacibeles.com.mx/
– https://nomustay.com/
– https://casatalapuerto.com/
– https://orcabobylumina.com/
– https://www.casanima.com.mx/
– https://puertacortes.com/es/
– https://districtpolanco.com/
– https://santolivo.mx/
– https://urbanreforma.com/
– https://namorastay.com/
– https://corasol.mx/es/
– https://casaizelhotel.com/
– https://conchitaclamont.com/
– https://xunarestaurante.com.mx/
– https://elbardexuna.com/