Privacy Notice
1. Identity and address of the Controller
HOTEL ENSENADA, S.A. DE C.V., trading as Stanza Hotel CDMX (hereinafter, “Stanza Hotel” or “the Controller”), Federal Taxpayer Registry (RFC) HEN710414623, with address at:
Avenida Álvaro Obregón 13, Colonia Roma,
Cuauhtémoc, 06700 Mexico City, Mexico.
is responsible for the processing and use of your personal data in accordance with Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on 20 March 2025, its amendments, the applicable Regulations and other provisions in force.
Privacy contact details:
| conecta@stanzahotel.com | |
| Phone | +52 55 5208 0052 |
| Address | As stated above |
| Responsible area | Personal Data Department |
2. Personal data we collect
We collect personal data directly, when you provide it through our website, by phone, email, at the front desk or during your stay; indirectly, through online travel agencies, booking platforms or intermediaries; and through tracking technologies on stanzahotel.com.
a) Identification and contact data
Full name, nationality, date of birth, official identification or passport number and copy, signature, address, email address and telephone number.
b) Stay data
Check-in and check-out dates, room type, number of accompanying guests, accommodation preferences, stay history, charges incurred at the hotel and Maíz & Olivo restaurant, and purpose of travel when necessary for the provision of services.
c) Patrimonial and financial data
Information related to bank cards or payment methods, billing details, RFC and tax regime when you request a tax invoice.
The processing of patrimonial and financial data requires your express consent, except in the cases exempted under applicable law, in particular where such processing is necessary to fulfil obligations arising from the legal relationship between you and Stanza Hotel. Where express consent is required, Stanza Hotel will obtain it through the appropriate mechanism.
Card payments may involve specialized payment platforms and service providers. Stanza Hotel implements measures to limit access to financial data and does not use such information for purposes unrelated to payments, deposits, guarantees, charges, refunds or fraud prevention.
d) Video surveillance images
We operate closed-circuit video surveillance cameras in common areas of the property, including the lobby, front desk, restaurant and corridors. The purpose is to protect the safety of guests, visitors, staff and property.
There are no cameras in guest rooms or bathrooms. The video surveillance system does not capture or record audio. Areas under video surveillance are identified with visible notices.
e) Sensitive personal data
Where necessary and when you choose to provide it, we may process information concerning health conditions, allergies, dietary restrictions, accessibility or disability requirements, solely to meet specific needs relating to your stay or requested services.
Where applicable law requires express consent or express written consent for such processing, Stanza Hotel will request that consent through an appropriate mechanism.
f) Data concerning children and adolescents
When a minor stays at the hotel, we may process the data strictly necessary to manage the stay, guest registration and compliance with applicable legal obligations. Such data must be provided by a parent, guardian or other duly authorized representative and will be handled with enhanced safeguards.
3. Purposes of processing
3.1 Primary purposes
These purposes are necessary to provide our services:
- Managing, confirming, modifying and cancelling your reservation.
- Registering you as a guest and complying with legal obligations applicable to accommodation services.
- Assigning your room and providing hotel and restaurant services.
- Processing payments, deposits, guarantees, charges and refunds, and preventing fraud.
- Issuing tax invoices when requested.
- Handling requests, complaints, comments and assistance enquiries.
- Responding to lawful requests from competent authorities and complying with legal, tax, administrative and security obligations.
- Protecting people and property through video surveillance in the areas indicated.
If you object to processing that is necessary for these purposes, Stanza Hotel may be unable to provide all or part of the services requested.
3.2 Secondary purposes
These purposes are not necessary for the provision of accommodation services. You may refuse them without affecting your reservation or stay.
- Sending promotions, offers and commercial communications from Stanza Hotel.
- Inviting you to complete satisfaction surveys.
- Producing statistics, market analysis and preference profiles to improve our services.
- Carrying out targeted advertising on digital platforms, where applicable and in accordance with your cookie and consent preferences.
How to refuse secondary purposes.
You may object to these purposes when you provide your data or at any later time by emailing conecta@stanzahotel.com with the subject line “Limitation of use”, stating your name and the purposes to which you object.
You may also unsubscribe from commercial emails using the unsubscribe mechanism included in those messages.
4. Service providers, processors and transfers
4.1 Providers processing data on behalf of Stanza Hotel
Stanza Hotel uses technology and operational service providers that may process personal data on behalf of and under the instructions of the Controller in order to provide specific services.
We use, among others:
| Provider | Main purpose |
|---|---|
| Cloudbeds | Booking engine and property management system |
| Hostinger | Website hosting and infrastructure |
| Other operational providers | Technical services, support and infrastructure required for hotel operations |
Where such providers act as processors, they are subject to contractual obligations relating to confidentiality, security, processing under instructions, purpose limitation and other applicable requirements.
4.2 Technology providers and third parties
Stanza Hotel also uses technology services that, depending on their specific configuration and purpose, may act as processors, independent controllers or in another legally applicable capacity under their own terms and applicable law.
We use, among others:
| Provider | Purpose |
|---|---|
| Stripe | Payment processing, fraud prevention and compliance related to payment services |
| Analytics, measurement, tag management and advertising | |
| Meta | Measurement, advertising, audiences and services connected with Facebook and Instagram |
Processing involving cookies, advertising identifiers, analytics or remarketing is also subject to the preferences and consent choices available through the website’s cookie banner.
4.3 Transfers that do not require consent
Applicable law permits certain transfers without consent, including where:
- they are necessary to comply with legal obligations or lawful requests from competent authorities;
- they are necessary for the performance of the legal relationship between Stanza Hotel and the data subject;
- another exemption under applicable law applies.
Maíz & Olivo restaurant. The restaurant located at the hotel is operated by Operadora Avanti, S.A. de C.V., a company under the common control of the Controller. When you ask for your restaurant charges to be posted to your room, Stanza Hotel and Operadora Avanti share the data strictly necessary to identify your stay and apply the charge — your name, room number and the amount consumed. This communication is made under Article 36, section III of the Mexican Federal Law on the Protection of Personal Data Held by Private Parties, which permits transfers to affiliated companies under the common control of the controller, and therefore does not require your consent. Operadora Avanti assumes the same data protection obligations as Stanza Hotel and does not use that information for purposes other than billing. If you prefer not to post restaurant charges to your room, you may pay for them directly at the restaurant.
4.4 Transfers requiring consent
Other than those described in the preceding section, Stanza Hotel does not carry out transfers of personal data that require the data subject’s consent. Should it intend to do so in the future, you will be expressly informed and your consent obtained where legally required, by means of the clause provided for in Article 35 of the Law.
4.5 Infrastructure and processing
Certain technology providers used by Stanza Hotel may process or store information using infrastructure located outside Mexico, including in the United States of America, in all cases subject to applicable contractual and legal obligations.
The use of such infrastructure by a processor does not, in itself, constitute a transfer of personal data under applicable law.
5. Ways to limit the use or disclosure of your data
In addition to objecting to secondary purposes, you may:
- request inclusion in our internal marketing exclusion list by emailing conecta@stanzahotel.com;
- use the unsubscribe mechanisms included in commercial communications;
- register, where applicable, with PROFECO’s Public Registry to Avoid Advertising (REPEP);
- accept, reject or configure cookies through the consent banner on our website.
6. ARCO rights
You have the right to Access your personal data, Rectify it when it is inaccurate or incomplete, Cancel it where legally appropriate and Object to its processing for specific purposes. These rights are commonly referred to in Mexico as ARCO rights.
How to exercise your rights
You may email your request to conecta@stanzahotel.com or submit it in writing at our address, including:
- your name and an address or email for receiving our response;
- a copy of your official identification or documentation proving representation;
- a clear description of the personal data concerned;
- the ARCO right you wish to exercise;
- any document that helps us locate your data;
- for rectification, the exact amendment requested and supporting documents.
Deadlines
Stanza Hotel will communicate its decision within a maximum of 20 business days from receipt of the request.
If the request is granted, it will be implemented within the following 15 business days.
These periods may be extended once, for an equal period, where circumstances justify the extension.
Costs
Exercising ARCO rights is free of charge. Only justified reproduction, delivery or other legally permitted costs may be charged.
Certain data may not be cancelled while a legal obligation requires its retention.
7. Withdrawal of consent
You may withdraw consent at any time using the procedure described above or by emailing conecta@stanzahotel.com.
Withdrawal may not be possible, or may not take immediate effect, where a legal obligation requires the data to be retained or where processing remains necessary for the performance of the legal relationship between you and Stanza Hotel.
8. Data retention
We retain your personal data for as long as the purpose that justified its processing remains, and for the retention periods required by applicable law, in particular tax, commercial, administrative and accommodation-related obligations.
Once those purposes have been fulfilled and the corresponding periods have elapsed, your data will be blocked for the sole purpose of determining any liability arising from its processing and, once that period ends, it will be deleted.
Video surveillance images are retained for 24 hours, after which they are deleted by automatic overwriting. They will be retained for a longer period only where necessary to address a security incident, to comply with a request from a competent authority, or for the recognition, exercise or defence of a right in legal proceedings, and in such case only for as long as that purpose requires.
9. Information security
Stanza Hotel has implemented administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access or processing, in accordance with applicable law.
Access to your data is limited to staff and providers who need to know it for the purposes described in this notice, all of whom are subject to confidentiality obligations.
Should a security breach occur that significantly affects your economic or moral rights, Stanza Hotel will inform you immediately so that you can take the measures you consider appropriate.
10. Cookies, web beacons and similar technologies
stanzahotel.com uses cookies, web beacons and similar technologies to remember preferences, measure use of the website, improve the browsing experience and, where applicable, display relevant advertising.
Data obtained through these technologies may include browser type, operating system, pages visited, time spent on the site, IP address, device identifiers and approximate location.
You may accept, reject or configure cookies through the website’s consent banner and change your choices later.
Details of the cookies and technologies used are available in our Cookie Policy.
11. Changes to this Privacy Notice
Stanza Hotel may amend this Privacy Notice to reflect legislative, regulatory, operational or service-related changes.
The current version will be available at:
https://stanzahotel.com/en/privacy-notice/
The date of the latest update will appear at the beginning of this document.
Where a change is material and we have an appropriate contact method, we may also notify you by email or another suitable channel.
12. Competent authority
If you believe your right to the protection of personal data has been infringed, you may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno (Secretariat for Anti-Corruption and Good Government), the federal authority responsible for the protection of personal data held by private parties, through its Unidad de Protección de Datos Personales (Personal Data Protection Unit).
For current contact details and available procedures, please consult the institutional websites:
https://www.gob.mx/buengobierno
https://portal-transparencia.buengobierno.gob.mx/proteccion-de-datos-personales/
13. Consent and processing of personal data
Where applicable law permits tacit consent, consent will be deemed given if, after this Privacy Notice has been made available to you, you do not object.
Where applicable law requires express consent or express written consent, Stanza Hotel will obtain that consent through an appropriate mechanism.
14. Language and interpretation
This English-language Privacy Notice is provided for informational purposes as a translation of the Spanish-language Privacy Notice of Hotel Ensenada, S.A. de C.V. The processing of personal data by Stanza Hotel CDMX is governed by applicable Mexican law. In the event of an inconsistency in translation, the Spanish-language version shall prevail to the extent permitted by applicable law.
