ZATLAS OS, S.A. DE C.V.

Privacy Notice

Last updated: September 25, 2026

In compliance with the Federal Law on Protection of Personal Data Held by Individuals (the “Law”), its Regulations, the Privacy Notice Guidelines, and other applicable parameters and provisions (hereinafter the “Legislation”), ZATLAS OS, S.A. de C.V. (hereinafter “ZATLAS”) makes available to the Commercial Partners (as such term is defined in the Terms and Conditions), users, employees, collaborators, suppliers, distributors, agents, as well as any person who accesses the services and/or has a relationship with ZATLAS (all of the foregoing, hereinafter, the “Users”), this Privacy Notice (hereinafter the “Notice”), prepared to inform you about our practices related to the processing of information that you may provide through our website and/or “ZATLAS” application, social networks or any internet page or means of communication (hereinafter, the “Platforms”). Any undefined term appearing with an initial capital letter shall have the meaning set forth in the Terms and Conditions of use, available on the Platforms.

ZATLAS, with its address at Avenida Paseo de las Palmas No. 830, Suite 402, Colonia Lomas de Chapultepec, Miguel Hidalgo, Mexico City, Postal Code 11000, is the Controller (Responsable) of the personal information collected, and is responsible for protecting and safeguarding your personal data and the use made of it, in order to prevent, among other things, damage, loss, destruction, theft, misplacement, alteration, as well as unauthorized processing.

I. SCOPE OF APPLICATION

This Notice shall apply to all persons who: (i) access or use the ZATLAS application, website or any other ZATLAS platform or interface; and/or, (ii) share or exchange information with ZATLAS by any means and for any reason.

Access to and use of the Platforms constitutes acceptance of these privacy policies and express consent for ZATLAS to process your personal data in accordance with this Notice.

Likewise, this Notice applies to the personal data of guests collected by ZATLAS on behalf of its Commercial Partners, who act as Controllers (Responsables) of the processing pursuant to the Law. In this case, ZATLAS acts as Processor (Encargado), processing such data solely to provide the reservation management services engaged by the Commercial Partner, in accordance with the instructions and authorizations of such Commercial Partners.

In order to register your personal data on the Platforms, the User must be at least 18 years of age and have no legal incapacity of any kind. Where the User is a minor (Minor User), his or her parents or guardians must complete the registration on the Platforms. If a Minor User successfully completes registration on the Platforms, ZATLAS presumes that he or she did so with the consent and authorization of his or her parents or guardians. ZATLAS is not liable for any damage caused or that may be caused to the Minor User if such Minor User provides data without the consent of his or her parents or guardians.

If the User fails to comply with this Notice, the User’s Account may be temporarily suspended or permanently disabled, as applicable.

II. DATA AND PURPOSES

In the collection and processing of personal data voluntarily provided to us through our Platforms or by any other means, we comply with the principles set forth in the Legislation, namely, the principles of lawfulness, quality, consent, information, purpose, loyalty, proportionality and accountability.

The information that ZATLAS may collect from Users, depending on the type of relationship or link they have with ZATLAS, is, without limitation, the following:

First and last name and/or corporate name.
Address.
E-mail.
Tax identification number (RFC, NIF, etc.).
Official identification.
Payment information (such as bank accounts and/or credit card data), which may be provided by its Commercial Partners, it being understood that such Commercial Partners have obtained the corresponding consent or have a valid legal basis for its transfer.
Telephone number.
Reservation data originating from the distribution channels and hotel management systems used by the Commercial Partner, including, among others, check-in and check-out dates, reservation number, amount, type of reservation, type of payment, data of the payment card associated with the reservation, payment status and card verification status, as well as any other information that the Commercial Partner makes available to ZATLAS in accordance with its instructions.

a) Primary Purposes:

ZATLAS will process the personal data described above for the following primary purposes:

Manage reservations in the distribution channels and systems used by the Commercial Partner, on its behalf and in accordance with its instructions, which entails the processing of reservation data, including personal data of guests and payment card data associated with the reservation.
Carry out the activities necessary for the development and performance of the services and purposes arising from the contractual and/or commercial relationship with ZATLAS.
Manage the creation, use, modification and updating of Access Accounts.
Contact and follow up on any process or matter related to the publications on the Platforms.
Provide receipts and/or messages related to reservations.
Prevent potential fraud against the User and ZATLAS.
Manage the charging of virtual cards associated with reservations upon instruction of the Commercial Partners.
Process reservation payments in collaboration with third-party payment processors, ensuring compliance with the PCI-DSS standard.
Verify the cards associated with reservations and carry out validations, pre-authorizations or charges, in accordance with the Commercial Partner’s instructions, in order to guarantee such reservations.
Update reservation information (such as status, dates of stay and amount charged) between the hotel management systems and the distribution channels used by the Commercial Partner.
Manage reservations, including their modification, cancellation or charging, in accordance with the instructions and the configuration established by the Commercial Partner in the ZATLAS system.
Generate reports and statistics for the Commercial Partners related to the managed reservations, preferably in aggregated or de-identified (dissociated) form.
Comply with the obligations arising from the contractual and/or commercial relationship with ZATLAS’s Commercial Partners.

b) Secondary Purposes:

ZATLAS will process the personal data described above for the following secondary purposes:

Send the User commercial information about ZATLAS.
Inform the User of the movements or activity of his or her Account.
Contact the User to inform him or her of special offers and/or promotions.
Carry out evaluations or any other activity aimed at promoting, maintaining, improving and evaluating the services offered by ZATLAS.

The User may, at any time, object to the processing of his or her personal data for secondary purposes, in which case such personal data will be placed on an exclusion list, to which only persons authorized by ZATLAS will have access.

The secondary purposes do not apply to the personal data of guests that ZATLAS processes in its capacity as Processor. Such data is processed exclusively for the primary purposes instructed by the Commercial Partner and for the time necessary for the management of the corresponding reservation.

If ZATLAS processes personal data of third parties (for example, guests of the hotel that is a Commercial Partner of ZATLAS), it is acknowledged that the processing of such data is carried out under the responsibility of the respective Commercial Partner, in its capacity as Controller (Responsable) of the processing, and that ZATLAS acts solely as Processor (Encargado), in accordance with the instructions received and the provisions of the Law. ZATLAS undertakes not to use such data for purposes other than those instructed by the Controller.

c) Legal Basis for the Processing of Personal Data:

The processing of personal data by ZATLAS is carried out on the basis of the following:

(i) Performance of a Contract: The processing is necessary to comply with our contractual obligations with Users and Commercial Partners (that is, to provide the Services).
(ii) Consent: For secondary purposes (such as marketing) or when consent is given by the data subject (or by the Commercial Partner on behalf of the data subject) pursuant to the Law.
(iii) Legal Obligations: When the processing is necessary to comply with a legal obligation or a requirement of a competent authority.
(iv) Legitimate Interest: For purposes such as fraud prevention, platform security and improvement of our services, provided that they do not override the interests or fundamental rights of the data subject.
(v) Legal Relationship (as Processor): When we act as Processor, our legal basis is the legal relationship with the Commercial Partner (Controller), who is responsible for having its own legal basis (whether consent, contract, etc.) for the processing of guests’ data.

III. SENSITIVE PERSONAL DATA

ZATLAS will not request in any way, and the User shall not provide to ZATLAS at any time, “sensitive personal data,” that is, personal data that is intimate or whose improper use may give rise to discrimination or entail a serious risk for the data subject.

The User undertakes not to provide any kind of information relating to racial or ethnic origin, present or future health status, genetic information, religious, philosophical and/or moral beliefs, union membership, political opinions, and sexual preference. If the User provides sensitive data through documents uploaded to the Platforms or by means of the forms, the User expressly consents to such data being processed in accordance with the Terms and Conditions of ZATLAS and its Privacy Notice, it being the User’s obligation not to provide this type of data in the information uploaded to the Platforms.

IV. COOKIES

The User should be aware that the Platform uses cookies, which, in general terms, are information or files stored in the browsers of devices when accessing a web page or online service.

The Platform or any other website operated by ZATLAS will provide the precise and necessary information regarding cookies, as well as the option to accept or reject their use, in order to obtain the express consent of the User (usually by means of an informative banner). The User’s consent will be renewed at least every 12 (twelve) months, it being understood that the User may at any time change or withdraw his or her consent from our Platform.

Cookies are used to personalize the User’s content and navigation. Some cookies that appear on websites are placed by third-party services, which are not under the control or responsibility of ZATLAS. The categories of cookies are detailed below, together with a description of their use:

Strictly Necessary Cookies: Essential for the operation of the Platform, to maintain security and to comply with applicable regulations.
Functional Cookies: They allow ZATLAS to remember information related to Users’ access and the selections made (such as username, language or region), and provide enhanced and personalized features.
Performance/Analytics Cookies: They collect information about how Users use the Platform, including the most visited pages. They are used to improve the operation and performance of ZATLAS.
Advertising Cookies: They help ZATLAS decide which of its products, services and offers may be relevant to the User, and measure the effectiveness of advertisements.

The User may disable or modify the use of cookies from his or her browser, or otherwise manage his or her consent on the Platform.

V. DATA TRANSFER

ZATLAS will under no circumstances make improper use of Users’ personal data or use it contrary to the provisions of this Privacy Notice, and therefore may only use or transfer such data in order to comply with the activities and obligations arising from the legal relationship with the User, as well as the primary and secondary purposes set forth in this Notice.

ZATLAS may transfer personal data, including payment card data, to third-party payment processors that comply with the PCI-DSS standard and the Law. Such transfers will be made in accordance with the Law and upon instruction of the Commercial Partners, either with the consent of the data subject or on the basis of any of the exceptions provided therein.

Likewise, ZATLAS may transfer data to persons or companies related to ZATLAS (such as parent companies, subsidiaries or affiliates), who will assume the same obligations as ZATLAS under the Legislation, being obliged to maintain the confidentiality of the information and not to use it in a manner other than that established in this Notice.

ZATLAS shall be entitled, without incurring any liability, to disclose the data required of it by administrative or judicial resolutions or orders of competent authorities, always under the applicable rules, treaties or laws.

If ZATLAS carries out international transfers of personal data (for example, to servers or service providers located outside Mexico), it will ensure that the receiving third party assumes the same obligations set forth in this Notice and in the Legislation, by signing Standard Contractual Clauses (SCCs) or other adequate legal instruments, pursuant to Article 36 of the Law and the requirements of the GDPR, if applicable.

VI. SECURITY MEASURES FOR THE PROCESSING OF PERSONAL DATA

ZATLAS implements administrative, technical and physical security measures, including, among others, data encryption, strict access controls and system monitoring, to protect the personal data of Users against damage, loss, alteration, destruction or unauthorized use, access or processing. We require that these measures be equally complied with by the service providers we engage.

Personal data will be retained only for the time necessary to fulfill the purposes of the processing, or during the statutory limitation periods applicable to the legal relationship with the data subject, after which it will be deleted or blocked in accordance with the Legislation.

In particular, for payment card data, ZATLAS implements security measures in accordance with the PCI-DSS standard, ensuring protection against unauthorized access, loss or alteration.

VII. LIMITATION OF USE OR DISCLOSURE OF PERSONAL DATA

If the User wishes to limit the use or disclosure of his or her personal data (for example, to stop receiving information or advertising), he or she may contact us at the e-mail address set forth in Section XII “Contact”.

VIII. EXTERNAL LINKS

The Platforms may contain links that redirect the User to third-party websites. This Notice does not regulate the way in which such third parties process Users’ personal data. We urge Users to read the privacy notices of such websites, mobile platforms or mobile applications.

IX. ARCO RIGHTS (AND OTHER RIGHTS)

As the data subject of his or her personal data, the User may exercise his or her Rights of Access, Rectification, Cancellation and Opposition (ARCO), or revoke the consent granted to ZATLAS, by sending his or her request to the following e-mail address: privacy@zatlas.com.

Access: To know which personal data is held by ZATLAS and, where applicable, to obtain a copy.
Rectification: To request the correction of inaccurate or incomplete personal data.
Cancellation: To request the deletion of data when it is no longer necessary. Cancellation will proceed in the cases and in accordance with the periods provided in the Law.
Opposition: To request that data not be processed for specific purposes.

To submit a request to exercise ARCO Rights, Users must complete the “Form for the Exercise of ARCO Rights” (available upon request), or may send a free-form written request to the address of ZATLAS or to the e-mail indicated, which must contain, at least, the following elements:

Name, address and e-mail address to which the response may be sent.
Documents proving the identity of the User.
A clear and precise description of the personal data with respect to which the exercise of any ARCO Right is requested.
Any other element that facilitates the location of the personal data.

ZATLAS will respond to requests to exercise rights within the periods provided by applicable legislation. For requests submitted by data subjects located in Mexico, the periods established in the Federal Law on Protection of Personal Data Held by Individuals will apply.

Important Note (Guest Data): For guests’ personal data collected by the Commercial Partners, requests to exercise ARCO Rights must be addressed directly to the corresponding Commercial Partner, which acts as the sole Controller of the processing. ZATLAS, as Processor, will cooperate with the Commercial Partner to address such requests in accordance with the Law.

Additional Rights (GDPR): If the applicable local legislation (such as the GDPR in the EU) so provides, Users may have additional rights, such as the right to data portability, the right to restriction of processing and the right to lodge a complaint with the local data protection authority.

ZATLAS may deny the exercise of ARCO Rights in the cases permitted by the Law (e.g., when the applicant is not the data subject, when the data cannot be found, or when there is a legal impediment).

X. AMENDMENTS

ZATLAS shall be entitled to change, modify, add to or delete, in whole or in part, this Notice at any time. In such case, ZATLAS will publish such amendments on the Platforms and will indicate the date of the latest version of the Notice. It is advisable to visit the Platforms periodically in order to be informed of any change to this Notice.

XI. AUTHORITIES

In Mexico, the supervisory and regulatory authority in matters of personal data protection is the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno). If you consider that your rights regarding the protection of personal data have been infringed, you have the right to go before such Ministry. If you are in the European Union, you have the right to lodge a complaint with your local Data Protection Authority.

XII. CONTACT

For any questions related to this Privacy Notice, ZATLAS has designated the personal data protection area as responsible for its handling and response. Such area may be contacted through the following means:

Name: ZATLAS OS, S.A. de C.V.
E-mail: privacy@zatlas.com
Address: Avenida Paseo de las Palmas No. 830, Suite 402, Colonia Lomas de Chapultepec, Miguel Hidalgo, Mexico City, Postal Code 11000