The Tour Agency - Privacy Notice

Privacy Notice

In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (the "Law"), the company named "TRASLADOS TURISTICOS RIVIERA NAY SA DE CV" also known as "The Tour Agency," with address located at CARR. ESTATAL TEPIC-PUERTO VALLARTA 68 NTE PLANTA ALTA, MEZCALES, BAHIA DE BANDERAS NAYARIT C.P. 63738, and its website https://thetouragency.com, is responsible for the use and protection of your Personal Data, and we hereby inform you as follows:

Your data will be collected and processed in accordance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility, as provided by the aforementioned Law.

For what purposes will we use your Personal Data?

The Personal Data we collect from you will be used for the following purposes, which are necessary for the development of our services:

PRIMARY PURPOSES:

Contact and identify you.

Provide online sales services for tourist products and services, vacation packages.

Purchase of vacation packages.

To make travel arrangements through our website easily, quickly, conveniently, and securely.

To inform you about the status of your reservations and purchases of vacation packages.

To offer you our tourist services.

Online assistance for our services through the use of online tools or by phone.

To process payment and invoicing for our services.

To evaluate the quality of our services.

To address your opinions, complaints, and suggestions.

To contact you via telephone, email, regular mail, and any other means for informational and promotional purposes of the company.

SECONDARY PURPOSES:

In addition, we will use your personal information for the following purposes that are not necessary for the requested service, but will allow us to provide you with better assistance.

1. To facilitate the use of our website https://thetouragency.com

2. Development of our services.

3. Evaluation of the quality of our services.

4. Promotion and marketing of products and services.

5. Creation of internal statistics.

6. Statistical and internal analysis purposes.

What Personal Data will we use for these purposes?

To carry out the purposes described in this Privacy Notice, the information requested from the user on the website is as follows:

Identification data such as Full Name (Official Identification with Photograph), Date of Birth, Age, Photograph, Fixed or Mobile Phone Number (personal), Address (residential and fiscal), the image of the holder when entering The Tour Agency's premises through video surveillance and security cameras, email address, marital status, Tax Identification Number (RFC), Unique Population Registry Code (CURP), and Interbank Key if applicable.

For the online purchase service, we request credit or debit card information, which includes Full Name, Card Number, Security Code, and Expiration Date, in accordance with Articles 8, 10, and 37 of the Law, these are not considered data that require your explicit consent to be used.

At "The Tour Agency," we do not handle or request sensitive personal data. Sensitive personal data refers to information that affects the most intimate sphere of the individual or whose misuse could lead to discrimination or pose a serious risk to the individual. Specifically, sensitive data includes information that may reveal aspects such as racial or ethnic origin, current and future health status, genetic information, religious, philosophical, and moral beliefs, trade union membership, political opinions, and sexual preferences.

Security Measures and Liability Limits

We are committed to providing security and confidentiality for the data you provide us when contracting an online service. For this purpose, we have a secure server under the SSL (Secure Socket Layer) protocol, ensuring that the information is encrypted for its protection. Once we receive your data transmission, we make reasonable efforts to ensure its security within our systems. However, we cannot guarantee the total security of information transmissions made over the Internet due to external breaches beyond our software servers and firewalls. Therefore, the transmission of data via the Internet will be at your own risk.

Social networks

Social networks such as Facebook®, Facebook Messenger®, YouTube®, Pinterest®, Instagram®, Google+®, Tumblr®, Snapchat®, Reddit®, Vine®, WeChat®, Skype®, Line®, Qzone®, QQ®, Weibo®, Telegram®, Twitter®, LinkedIn®, WhatsApp®, and/or any others that are available constitute a communication and interconnection platform among digital platforms of different users. They are external to "The Tour Agency" and therefore are not under its responsibility.

The information you provide within social networks in which "The Tour Agency" participates as a user does not constitute or form part of the Personal Data subject to the protection of this Privacy Notice. It is the responsibility of the platform company and the individual who publishes it.

Who do we share your personal information with and for what purposes?

We inform you that your Personal Data is shared, within the country, with the following individuals, companies, organizations, and authorities other than ourselves, for the following purposes:

Recipient of personal data

Country (optional)

Purpose of the transfer.

External advisors.

Who?

United Mexican States.

Advice regarding best practices in customer services and optimization of quality controls and internal organization.

Local, state, and federal authorities, as well as public agencies such as the Ministry of Finance and Public Credit, INFONAVIT, IMSS, and those indicated by law.

United Mexican States.

Compliance with tax obligations, notifications, requests, judicial orders, and those indicated by law.

Controlling companies, subsidiary affiliates, namely: Transportes Terrestres Flamingos, S.A de C.V., Turismo Cultural Terrestre S. de R. L. de C.V., Ventura Adventure, S.A de C.V., Traslados Turísticos Rivera Nay., S.A. de C.V., Transportes Turísticos Flamingos, S.A. de C.V., under the common control of Riviera Tours and Transfers or a parent company or any company within the same group as Turismo Cultural Terrestre S. de R.L., operating under the same internal processes and policies.

- When the transfer is necessary for the performance of a contract concluded or to be concluded in the interest of the data subject, between the data controller and a third party.

- When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the data controller and the data subject, such as Suppliers, Tourism Service Providers, Banks and Credit Institutions, among others.

It is important to note that third parties to whom your personal data is transferred will be obligated under the same terms of this Privacy Notice and will comply with the corresponding security and confidentiality measures.

I consent and authorize the processing and transfer of my personal data in accordance with the provisions of this Privacy Notice.

I do not consent and authorize the processing and transfer of my personal data in accordance with the provisions of this Privacy Notice.

If you do not express your refusal for such transfers, we will assume that you have granted us consent. What are the rights of the Data Subject?

What are the rights of the Data Subject?

According to the Federal Law on the Protection of Personal Data Held by Private Parties, starting on January 6, 2012, as the data subject, you have the right to exercise the rights of access, rectification, cancellation, and opposition, known as the "ARCO Rights" (provided they are legally applicable). Additionally, you can revoke the consent you have granted at any time, if it was necessary for the processing of your personal data, or limit the use or disclosure of your data. The corresponding procedure for the user to exercise their ARCO rights and revoke the consent given to "The Tour Agency" for the handling of their personal data is through the following email: websales@thetoyragency.com

The aforementioned rights are exercised by submitting the corresponding request through the mentioned email and including necessary information such as your name, address, or any other means of notification regarding the case.

Within a maximum period of 15 business days, we will address your request and inform you of its outcome. "The Tour Agency" advises the user to update their data whenever any changes occur in order to provide better service.

How can you access, rectify, or cancel your Personal Data, or object to its use?

You have the right to know what Personal Data we have about you, the purpose of its use, and the conditions of its use (Access). Likewise, you have the right to request the correction of your personal information if it is outdated, inaccurate, or incomplete (Rectification); to have it deleted from our records or databases when you consider that it is not being used in accordance with the principles, duties, and obligations provided by the regulations (Cancellation); as well as to object to the use of your Personal Data for specific purposes (Opposition). These rights are known as ARCO rights.

To exercise these rights, it is necessary to submit a written request to "The Tour Agency" at the following address: CARR. ESTATAL TEPIC-PUERTO VALLARTA 68 NTE PLANTA ALTA, MEZCALES, BAHIA DE BANDERAS NAYARIT C.P. 63738, or via email at websales@thetoyragency.com How can you revoke your consent for the use of your Personal Data?

You can revoke the consent you have given us, if applicable, for the processing of your Personal Data. However, please note that we may not be able to address your request or conclude the use immediately in all cases, as we may be required to continue processing your Personal Data due to legal obligations. Additionally, you should consider that for certain purposes, the revocation of your consent may result in us being unable to continue providing the service you requested, or the termination of your relationship with us.

To revoke your consent, you must submit your request at our offices located at: "The Tour Agency" at the following address: CARR. ESTATAL TEPIC-PUERTO VALLARTA 68 NTE PLANTA ALTA, MEZCALES, BAHIA DE BANDERAS NAYARIT C.P. 63738, or via email at websales@thetoyragency.com

The revocation of consent can be made at any time, without retroactive effects. To initiate the revocation process, you must clearly indicate the consent you wish to revoke in writing to the aforementioned addresses or to the email address: https://thetouragency.com. The written and/or electronic request for access, rectification, cancellation, or opposition must contain and include the following:

A) The full name of the data subject and their address or another means to communicate the response to their request.
B) Documents proving the identity or, if applicable, the legal representation of the data subject.
C) A clear and precise description of the Personal Data for which any of the aforementioned rights are sought to be exercised.
D) Any other element or document that facilitates the location of the Personal Data.
E) In the case of requests for rectification, the data subject must indicate the modifications to be made and provide supporting documentation for their request.

"The Tour Agency" will notify the data subject within fifteen business days, counted from the date the request for access, rectification, cancellation, or opposition was received, of the determination made so that, if applicable, it can be effective within fifteen days from the date the response is communicated. In the case of requests for access to Personal Data, delivery will be made, after verifying the identity of the requester or their legal representative, as appropriate. The aforementioned deadlines may be extended once for an equal period, provided that the circumstances justify it.

The obligation to provide access to the information will be considered fulfilled when the Personal Data is made available to the data subject, or through the issuance of simple copies, electronic documents, or any other means provided by "The Tour Agency" to the data subject.

If the data subject requests access to the data from a person they believe is the responsible party and it turns out they are not, it will be sufficient to inform the data subject through any printed (letter of non-proceeding) or electronic means (email, optical media, etc.) to consider the request fulfilled.

"The Tour Agency" may deny access to Personal Data, or refuse to carry out rectification or cancellation, or grant opposition to the processing thereof, in the following cases:

A) When the requester is not the data subject, or the legal representative is not duly accredited for such purposes.
B) When the data subject's Personal Data is not found in its database.
C) When the rights of a third party are infringed.
D) When there is a legal impediment or a resolution from a competent authority that restricts access to Personal Data or does not allow their rectification, cancellation, or opposition.
E) When rectification, cancellation, or opposition has already been carried out.

The aforementioned denial may be partial, in which case "The Tour Agency" will carry out the access, rectification, cancellation, or opposition requested by the data subject.

In all the cases mentioned above, "The Tour Agency" must inform the reason for its decision and communicate it to the data subject, or if applicable, to the legal representative, within the established deadlines, through the same means by which the request was made, and provide, if necessary, the relevant evidence.

"The Tour Agency" is not obliged to cancel Personal Data when:

A) It refers to parts of a Private, Social, or Administrative Contract and is necessary for its development and fulfillment.
B) It must be processed according to a legal provision.
C) It hinders judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the enforcement of administrative sanctions.
D) It is necessary to protect the legally protected interests of the data subject.
E) It is necessary to carry out an action in the public interest.
F) It is necessary to fulfill a legal obligation acquired by the data subject.

If the cancellation is deemed appropriate, "The Tour Agency" will establish a blocking period for the sole purpose of determining possible liabilities related to the processing of the data, until the legal or contractual prescription period, and notify the data subject or their representative in the response to the cancellation request, which will be issued within a period of twenty business days. The blocking will be carried out within fifteen business days, and after the blocking period, the corresponding deletion will be carried out.

The blocking period will be until the corresponding legal or contractual prescription period.

How can you limit the use or disclosure of your personal information?

In order for you to limit the use and disclosure of your personal information, we offer the following means:

Your registration in the Public Registry for Avoiding Advertising, which is managed by the Federal Consumer Protection Agency, with the purpose of preventing your Personal Data from being used to receive advertising or promotions from companies offering goods or services.

These will be sent to you and the registered contacts for this purpose. You can modify this indication at any time by sending an email to https://thetouragency.com.

The use of tracking technologies on our website

On our website, we may use cookies, web beacons, and/or similar technological elements to obtain information such as: (a) your browser type and operating system; (b) internet pages you visit; (c) links you follow; (d) IP address; (e) sites you visited before entering ours; (f) user recognition; (g) detection of highlighted information; and (h) measurement of certain traffic parameters. The "help" section found in the toolbar of most browsers will tell you how to prevent accepting new cookies, how to make the browser notify you when you receive a new cookie, or how to disable all cookies.

A cookie is a small file that a web server sends to your computer, which is stored on your computer's hard drive. This allows us to use the information stored in the cookie, such as your preferences, when you revisit our website, making it easier for you to use our website. The cookie does not reveal your personal identity unless you explicitly choose to provide it. Most cookies expire after a certain period of time or can be deleted by you at any time. You can configure your browser to notify you when you receive a cookie, so that you can accept or reject it.

How do we use cookies at "The Tour Agency"?

We use session or temporary cookies that remain in your browser's cookie file during your visit to our website, as well as persistent cookies for repeat visits. The main functions performed by both types are as follows:

- Personalized experience:

Cookies help us differentiate one user from another when they visit the website and allow interaction with various features of our platform. The following points depend on cookies:

• Remembering country and language preferences.
• Selection of tours according to your preference.
• Displaying specific search history and destinations already visited.
• Notifications about tours that may be of interest.

- Analytical projections.

They help in better analysis to optimize our website through anonymous tracking of links and features that are used most frequently. The information is captured to create anonymous statistics that are used to identify areas of opportunity and success on the website. Cookies play an important role in providing an optimal experience on the site.

How can I manage the use of cookies?

You can choose not to allow cookies to be stored in your browser, but please note that some of the primary features of the website may not be available to you. However, basic searches will still function properly.

To avoid the use of cookies, you can modify your browser settings to receive notifications whenever cookies are being used or to completely block storage. You can also choose to delete any cookies that are already stored. The settings depend on the browser you are using. You can easily find this option in the "Help" section.

If cookies are necessary for the functionality of "The Tour Agency" website, your consent is not required for their use. Cookies expire after leaving the main web page of "The Tour Agency". However, persistent or third-party cookies require your consent for the selections and preferences made on the site. By selecting the "Accept cookies" option, you declare your approval to use them.

OUR COOKIES

They are of utmost importance for the user to navigate the site and utilize all functions.

THIRD-PARTY COOKIES

They are imposed by an organization external to the website the user is visiting. They are primarily managed by the marketing or data analytics department.

SESSION COOKIES

They are temporary and stored in the user's browser until they stop using their browser, at which point the cookies are completely deleted.

PERSISTENT COOKIES

Cookies are deleted when the browser is closed. They are necessary to remember the user's preferred settings and provide them automatically.

Disclaimer of website

Our website may contain links to external websites that are not affiliated with "The Tour Agency" and therefore have no relation to us.

The Personal Data provided through these portals or websites that are not covered by this Privacy Notice and their processing are not the responsibility of "The Tour Agency". We recommend reviewing and reading the privacy policies and terms of use of such external websites before using them.

How can you learn about changes to this Privacy Notice?

This Privacy Notice may undergo modifications, changes, or updates due to new legal requirements, our own needs for the products or services we offer, our privacy practices, or changes in our business model.

We reserve the right to change this Privacy Notice at any time at the discretion of its administrators. The latest update on Privacy Policies, as well as any changes to the Privacy Notice, can be found on our website https://thetouragency.com, in the privacy notice section. The modifications or updates that are made will take effect at the moment they are published on the website www.thetouragency.com, on its affiliated sites, or through any means of communication used to publish it, so continuous review is recommended.

If the user uses the services on any of "The Tour Agency" websites, it means that they have read, understood, and agreed to the terms mentioned above. If you do not expressly object to this notice and its updates, it is understood that you have given your implicit consent in terms of Article 8 of the LFPDPPP.