Privacy Notice / Aviso de Privacidad

I. Identity of the Data Controller / Identidad del Responsable

Yucatán Real Estate Group, with address in Mérida, Yucatán, México (hereinafter "the Controller"), in compliance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations, makes this Privacy Notice available to you.

Yucatán Real Estate Group, con domicilio en Mérida, Yucatán, México (en adelante "el Responsable"), en cumplimiento con lo dispuesto por la Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) y su Reglamento, pone a su disposición el presente Aviso de Privacidad.

Legal basis: Articles 15, 16 and 17 of the LFPDPPP

II. Personal Data Collected / Datos Personales Recabados

For the purposes indicated in this Privacy Notice, the Controller may collect the following categories of personal data:

Para las finalidades señaladas en el presente Aviso de Privacidad, el Responsable podrá recabar las siguientes categorías de datos personales:

• Identification data / Datos de identificación: Full name, date of birth, nationality, marital status, CURP, RFC, official ID number (INE/Passport), photograph.
• Contact data / Datos de contacto: Address, landline phone, mobile phone, email.
• Financial data / Datos patrimoniales y financieros: Income information, bank statements, credit history, tax information, source of funds for real estate transactions.
• Immigration data (for foreigners) / Datos migratorios: Passport number, immigration form, residence permit, SRE permit.
• Employment data / Datos laborales: Occupation, employer name, position, seniority.

Note: Sensitive personal data is not collected. If necessary, express written consent will be requested.

III. Purposes of Data Processing / Finalidades del Tratamiento

Primary purposes (necessary for the legal relationship) / Finalidades primarias:

• Provision of real estate advisory services (purchase, sale, rental, intermediation).
• Compliance with obligations established in the LFPIORPI (Anti-Money Laundering Law), including client identification, identity verification, beneficial owner identification, and filing notices with SAT.
• Compliance with obligations established by INSEJUPY (Decree 73/2025) for real estate advisors in Yucatán.
• Integration of the client's unique file in accordance with applicable regulations.
• Verification on blocked persons lists (SAT 69B, CSNU, UIF).
• Preparation of service contracts, purchase promises, and purchase-sale contracts.
• Invoicing and issuance of CFDI.

Secondary purposes (not necessary, but legitimate) / Finalidades secundarias:

• Sending information about new properties, investment opportunities, and related services.
• Conducting satisfaction surveys.
• Internal statistics and service improvement.

If you do not wish your personal data to be processed for secondary purposes, you may indicate so by contacting us at the email address provided above.

IV. Data Transfers / Transferencias de Datos

The Controller may transfer your personal data to the following third parties, without requiring your consent, under the terms of Article 37 of the LFPDPPP:

El Responsable podrá transferir sus datos personales a los siguientes terceros, sin requerir su consentimiento, en los términos del artículo 37 de la LFPDPPP:

• Competent authorities / Autoridades competentes: SAT (Money Laundering Prevention Portal System), UIF (Financial Intelligence Unit), INSEJUPY, PROFECO, when required by law.
• Public notaries / Notarios públicos: For the formalization of purchase-sale transactions.
• Banking institutions / Instituciones bancarias: For the establishment of trusts or mortgage procedures.

Additionally, with your consent, we may transfer your data to:

• Legal, accounting, or valuation service companies associated with the real estate transaction.
• Post-sale concierge service providers.

V. ARCO Rights / Derechos ARCO

You have the right to Access your personal data, Rectify it if inaccurate, Cancel it when you consider it is not required for any of the purposes indicated, or Object to its processing for specific purposes (ARCO Rights).

Usted tiene derecho a Acceder a sus datos personales, Rectificarlos en caso de ser inexactos, Cancelarlos cuando considere que no se requieren para alguna de las finalidades señaladas, u Oponerse al tratamiento de los mismos para fines específicos (Derechos ARCO).

To exercise any of these rights, you must submit a written request addressed to the Controller, which contains:

• Full name of the holder and address or email to communicate the response.
• Documents proving your identity or legal representation of the holder.
• Clear and precise description of the personal data regarding which you seek to exercise any of the ARCO rights.
• Any other element or document that facilitates the location of personal data.

The request can be sent to the email: [email protected]

The Controller will communicate to the holder the determination adopted within a maximum period of 20 business days from the date the request was received.

Legal basis: Articles 28 to 35 of the LFPDPPP

VI. Consent Revocation / Mecanismo para Revocar el Consentimiento

You may revoke the consent you have given us for the processing of your personal data. However, it is important to note that we may not be able to address your request immediately in all cases, as it is possible that due to a legal obligation (such as the LFPIORPI, which requires data retention for 10 years) we are required to continue processing your personal data.

Usted puede revocar el consentimiento que, en su caso, nos haya otorgado para el tratamiento de sus datos personales. Sin embargo, es importante que tenga en cuenta que no en todos los casos podremos atender su solicitud de forma inmediata, ya que es posible que por alguna obligación legal se requiera seguir tratando sus datos personales.

VII. Cookies and Tracking Technologies / Uso de Cookies

Our website may use cookies and other tracking technologies to improve your browsing experience. You can disable these technologies through your browser settings.

Nuestro sitio web puede utilizar cookies y otras tecnologías de rastreo para mejorar su experiencia de navegación. Usted puede deshabilitar estas tecnologías a través de la configuración de su navegador.

VIII. Changes to the Privacy Notice / Cambios al Aviso de Privacidad

The Controller reserves the right to make modifications to this Privacy Notice. Any changes will be notified through our website and/or by email.

El Responsable se reserva el derecho de efectuar modificaciones al presente Aviso de Privacidad. Cualquier cambio será notificado a través de nuestro sitio web y/o por correo electrónico.

IX. Competent Authority / Autoridad Competente

If you consider that your right to the protection of personal data has been violated, you may file a complaint with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI).

Si usted considera que su derecho a la protección de datos personales ha sido lesionado, puede interponer una queja ante el Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI).