Privacy notice

Last updated: September 2, 2026.

A. IDENTITY AND ADDRESS OF THE DATA CONTROLLER

Autounión Suecia, S.A. de C.V., with Federal Taxpayer Registry number ASU2410111U3, the company operating the lodging establishment commercially known as Máximo México Hotel (hereinafter, interchangeably, "Máximo" or "the Hotel"), with address at Calle Manzanillo número 47, Colonia Roma Sur, Alcaldía Cuauhtémoc, Postal Code 06760, Mexico City, is the controller responsible for the processing of your personal data and is committed to protecting your privacy.

The area responsible for personal data protection is the Marketing and Systems Department, located at the address noted above. You may contact this department through the following means:

• Email: reservations.roma@maximomexico.com
• Phone: +52 55 1078 5928
• In person, at the Hotel's address, Monday through Friday from 9:00 a.m. to 2:00 p.m.

This Privacy Notice applies to the website https://www.maximomexico.com, its reservation engines, the Hotel's guest-service channels, and the establishment's facilities.

Máximo México Hotel is an adults-only establishment. The Hotel does not provide services to minors and does not knowingly process their personal data.

B. PERSONAL DATA SUBJECT TO PROCESSING

B.1 Means of collection

The Hotel obtains your personal data through the following channels:

• Directly, when you provide it in person, in writing, or verbally.
• Through the Hotel's website and its online reservation engine.
• Through the telephone reservations center.
• Through online travel agencies (OTAs) and other distribution intermediaries, which transmit to the Hotel the data necessary to formalize your reservation.
• Through WhatsApp, email, and social-media messaging.
• Through event and group quotation forms.
• During in-person check-in at the Hotel.
• Through use of the Hotel's Wi-Fi network, cookies, and similar tracking technologies.
• Through the facilities' video-surveillance system.

B.2 Categories of data

• Identification and contact data: first and last name, nationality, type and number of official identification document or passport, phone number, email address, handwritten signature.
• Reservation and stay data: arrival and departure dates, room type, number of adult companions, purpose of travel, estimated arrival time, lodging preferences, history of previous stays at the Hotel.
• Tax data (only if you request a tax invoice): RFC (tax ID), legal/business name, tax address, tax regime, and CFDI use.
• Financial and payment data: card brand, the last four digits of your card, and the transaction result.

The Hotel does NOT store your card's full number, expiration date, or security code (CVV/CVC). This data is captured and processed directly within the payment service provider's encrypted environment, without the Hotel having access to it or retaining it.

• Image data: images captured by the video-surveillance system in the Hotel's common areas.
• Browsing data: IP address, device and browser type, operating system, pages visited, time spent on the site, and cookie-related identifiers.

The Hotel collects only the data necessary for the purposes described in this Notice and does not request information about your income level, marital status, or occupation.

C. SENSITIVE PERSONAL DATA

Sensitive personal data are those that affect the most intimate sphere of the data subject, or whose misuse could give rise to discrimination or entail a serious risk to that person. In particular, data that could reveal racial or ethnic origin, present or future health status, genetic information, religious, philosophical, or moral beliefs, union membership, political opinions, or sexual preference.

The Hotel does not require, nor does it condition the provision of its services on, the delivery of sensitive personal data. However, you may voluntarily provide the following information so that the Hotel can properly attend to your stay:

• Food allergies, intolerances, or dietary restrictions, for the preparation of food and beverages.
• Health or mobility conditions relevant to room assignment, to your safety during your stay, or to responding to an emergency.
• Accessibility requirements.

Where you provide this information, the Hotel will process it exclusively for the specific purpose stated, under access restricted to personnel who strictly need it, and will delete it once your stay has concluded, unless a legal retention obligation applies.

Processing this data requires your express consent, which is obtained through the corresponding checkbox on the reservation or registration form, or through your signature on the corresponding consent letter. You may decline to give it without this affecting the provision of the lodging service.

In the event of a health emergency declared by a competent authority, the Hotel may collect health-related data required by applicable rules, solely for the purpose of protecting your health and that of other persons present at the establishment, retaining it only for as long as that purpose requires.

D. PURPOSES OF PROCESSING

D.1 Necessary purposes

The following purposes give rise to, and are necessary for, the legal relationship between you and the Hotel:

• Managing, confirming, modifying, and cancelling your reservation.
• Carrying out check-in and check-out, and maintaining the guest register.
• Processing payment for the services contracted and issuing the corresponding tax invoice.
• Providing lodging, food and beverage, and other services requested during your stay.
• Handling your requests, comments, clarifications, and complaints.
• Organizing events, meetings, and groups that you book.
• Preserving the safety of persons and property within the facilities.
• Complying with legal obligations relating to tax, immigration, civil-protection, and consumer-protection matters, as well as responding to requirements from competent authorities.

D.2 Voluntary purposes

The following purposes are not necessary for the legal relationship and will only be carried out if you consent to them. Declining them does not in any way affect your reservation or the quality of service you receive:

• Sending newsletters, promotions, special rates, and commercial communications from the Hotel.
• Enrollment in and administration of the loyalty program and benefits for returning guests.
• Sending satisfaction and service-quality surveys.
• Targeted advertising and remarketing on digital platforms such as Google and Meta.
• Building travel- and lodging-preference profiles, through data analysis, in order to personalize the communications and offers directed to you.
• Distribution of photographs or audio-visual material captured during events held at the Hotel, on its institutional channels and social media.

D.3 How to withhold consent for voluntary purposes

You may state your refusal at any of the following times and through any of the following means:

• Checking the opt-out box on the reservation, registration, or subscription form, at the time your data is collected.
• Sending an email to reservations.roma@maximomexico.com within five business days of being informed of this Notice.
• At any later time, in accordance with Sections F and H of this Notice.

E. LIMITING THE USE AND DISCLOSURE OF YOUR DATA

To limit the use or disclosure of your personal data for marketing or advertising purposes, the Hotel makes the following means available to you:

• The unsubscribe link included at the bottom of every electronic communication you receive from the Hotel.
• A request sent to reservations.roma@maximomexico.com, specifying the email addresses or phone numbers for which you request the limitation.
• If you reside in the United Mexican States, registering with the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad, REPEP), administered by the Federal Consumer Protection Agency (PROFECO), available through that institution's website.

F. DISCLOSURES, TRANSFERS, AND INTERNATIONAL TRANSFERS

F.1 Disclosures to data processors

The Hotel relies on technology providers who process personal data on the Hotel's behalf and under its instructions, without using it for their own purposes. These disclosures constitute data-processor transmissions and do not require your consent. Current processors fall into the following categories:

• Hotel management system (PMS): Cloudbeds, for managing reservations, guest registration, and billing.
• Payment processing: Cloudbeds Payment.
• Email and marketing platform: Axovia Hospitality Marketing's proprietary platform.
• Analytics and digital advertising: Google (Analytics and Ads) and Meta (Facebook and Instagram), through cookies and advertising identifiers.
• Website hosting and cloud infrastructure.

The Hotel maintains contractual instruments with these providers that impose confidentiality and security obligations equivalent to those set out in this Notice.

F.2 Transfers that do not require your consent

Under applicable law, the Hotel may transfer your personal data, without requiring your consent, in the following cases:

• To the Tax Administration Service (SAT), to comply with tax obligations.
• To the National Immigration Institute (INM), regarding foreign-national guests, in accordance with the registration and reporting obligations set out in the Immigration Law and its Regulations.
• To competent administrative, judicial, or prosecutorial authorities, upon a duly substantiated and reasoned request.
• To the Hotel's external auditors and legal or accounting advisors, subject to confidentiality obligations.

Outside of the cases described above, the Hotel does not market, sell, assign, or transfer your personal data to third parties for their own purposes.

F.3 International transfers

Some of the technology providers referenced in Section F.1 are established outside Mexican territory, principally in the United States of America and the European Union, and your personal data may therefore be stored or processed on servers located in those jurisdictions. In such cases, the Hotel adopts contractual measures requiring those providers to maintain a level of protection equivalent to that required by Mexican law and by this Privacy Notice.

G. ARCO RIGHTS

You, or your duly accredited legal representative, have the right to access your personal data, to rectify it when it is inaccurate or incomplete, to have it cancelled when you consider it is no longer required for any of the stated purposes, and to object to its processing for specific purposes (Access, Rectification, Cancellation, and Objection rights — "ARCO rights" under Mexican law).

The corresponding request must be submitted in writing at the Hotel's address, Monday through Friday from 9:00 a.m. to 2:00 p.m., or sent by email to reservations.roma@maximomexico.com, and must include at least:

• The name of the personal-data subject.
• An email address or mailing address for receiving notifications.
• Documents evidencing your identity or, where applicable, the data subject's legal representation.
• A clear and precise description of the personal data over which you seek to exercise the right, and of the right you intend to exercise.
• Any other element or document that facilitates locating your personal data.

If the request does not meet any of the requirements above, the Hotel may, within five business days of receiving it, ask you to provide the missing elements or documents. You will then have ten business days to respond to that request; failing to do so, the request will be deemed not submitted.

The Hotel will communicate its determination within twenty business days of receiving the request and, if applicable, will give effect to it within fifteen business days following that response. These periods may be extended once, for an equal period, when the circumstances of the case justify it. The response will be sent to the email address you provided and will also be made available at the Hotel's address.

Exercising these rights is free of charge. You will only need to cover, where applicable, the justified costs of shipping or of reproduction in copies or other formats.

H. WITHDRAWAL OF CONSENT

You may withdraw, at any time, the consent you have given for the processing of your personal data, following the same procedure and through the same means indicated in Section G.

Please note that, in certain cases, the Hotel may not be able to fulfill your request immediately or in full, due to legal obligations that require it to continue processing certain data. Likewise, withdrawing consent for the necessary purposes may make it impossible for the Hotel to continue providing the contracted service.

I. VIDEO SURVEILLANCE

When you visit the Hotel's facilities, as a guest, visitor, supplier, or staff member, your image may be captured by the closed-circuit television system installed at the property located at Calle Manzanillo número 47, Colonia Roma Sur, Alcaldía Cuauhtémoc, Postal Code 06760, Mexico City.

The cameras are located at entrances, hallways, and common areas, and are duly marked with signage. There are no cameras inside guest rooms, restrooms, changing rooms, or any other area intended for personal privacy.

The system captures images only and does not capture or record audio. The images are used exclusively for the safety of persons and property, and for clarifying incidents. They are retained for a period of 30 calendar days, after which they are automatically deleted, unless a given recording must be retained because it relates to an incident under investigation or to a request from a competent authority.

J. COOKIES AND TRACKING TECHNOLOGIES

The Hotel's website uses cookies and similar technologies, which are small information files stored on your device. The Hotel uses the following categories:

• Strictly necessary: enable the website and reservation engine to function. These cannot be disabled.
• Preference: remember the language, currency, and settings you have selected.
• Analytics: allow the Hotel to measure traffic and understand how the site is used, through tools such as Google Analytics.
• Advertising: allow the Hotel to show you advertising on third-party platforms and measure its effectiveness, through tools such as Google Ads and the Meta pixel.

When you enter the site, you are shown a settings panel that lets you accept or reject the non-necessary categories. You may change your choice at any time from that panel, as well as configure your browser to block or delete cookies. Disabling non-necessary cookies does not prevent you from using the site or making reservations.

K. RETENTION PERIODS

Your personal data will be retained for the time strictly necessary to fulfill the purposes for which it was obtained, according to the following criteria:

• Reservation and stay data: for the duration of the legal relationship and, thereafter, for the period necessary to address clarifications, claims, or liabilities arising from it.
• Tax data and invoices: for the period established by applicable tax law for the retention of accounting records.
• Foreign-guest registration records: for the period set out in immigration regulations.
• Data processed for marketing purposes: until you withdraw your consent or request removal.
• Video-surveillance recordings: in accordance with the period stated in Section I.
• Sensitive data provided voluntarily: until the end of your stay.

Once the applicable periods have elapsed, the data will be blocked for the period during which it may be necessary to address legal liabilities and will thereafter be deleted through measures that ensure its secure destruction.

L. SECURITY MEASURES

The Hotel has implemented administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing. These include access controls to the hotel management system through individual credentials, storage in data centers with restricted access, encryption of communications through a secure protocol (TLS/SSL), and training for staff who have access to guest information.

Notwithstanding the foregoing, no security or information-transmission system that relies on the internet can guarantee absolute security. Should a security breach occur that significantly affects your property or moral rights, the Hotel will notify you without delay, so that you may take appropriate action.

M. CHANGES TO THIS PRIVACY NOTICE

The Hotel may modify or update this Privacy Notice at any time, to address legislative developments, internal policies, or new requirements for providing its services. Any material change will be communicated through the website referenced in Section A, indicating the date of the last update. We recommend that you review it periodically.

N. COMPETENT AUTHORITY

If you believe that your right to personal data protection has been violated by any act or omission of the Hotel, or you suspect any violation of the applicable provisions on this matter, you may file a complaint with the competent authority for the protection of personal data held by private parties, which is currently the Secretaría Anticorrupción y Buen Gobierno, through its Dirección General de Datos Personales en el Sector Privado. For further information, you may consult that agency's official website.