Last updated: 26 August 2026

1. Identity and address of the Controller

HOTEL ENSENADA, S.A. DE C.V., trading as Stanza Hotel CDMX (hereinafter, “Stanza Hotel” or “the Controller”), Federal Taxpayer Registry (RFC) HEN710414623, with address at:

Avenida Álvaro Obregón 13, Colonia Roma,
Cuauhtémoc, 06700 Mexico City, Mexico.

is responsible for the processing and use of your personal data in accordance with Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on 20 March 2025, its amendments, the applicable Regulations and other provisions in force.

Privacy contact details:

Email	conecta@stanzahotel.com
Phone	+52 55 5208 0052
Address	As stated above
Responsible area	Personal Data Department

2. Personal data we collect

We collect personal data directly, when you provide it through our website, by phone, email, at the front desk or during your stay; indirectly, through online travel agencies, booking platforms or intermediaries; and through tracking technologies on stanzahotel.com.

a) Identification and contact data

Full name, nationality, date of birth, official identification or passport number and copy, signature, address, email address and telephone number.

b) Stay data

Check-in and check-out dates, room type, number of accompanying guests, accommodation preferences, stay history, charges incurred at the hotel and Maíz & Olivo restaurant, and purpose of travel when necessary for the provision of services.

c) Patrimonial and financial data

Information related to bank cards or payment methods, billing details, RFC and tax regime when you request a tax invoice.

The processing of patrimonial and financial data requires your express consent, except in the cases exempted under applicable law, in particular where such processing is necessary to fulfil obligations arising from the legal relationship between you and Stanza Hotel. Where express consent is required, Stanza Hotel will obtain it through the appropriate mechanism.

Card payments may involve specialized payment platforms and service providers. Stanza Hotel implements measures to limit access to financial data and does not use such information for purposes unrelated to payments, deposits, guarantees, charges, refunds or fraud prevention.

d) Video surveillance images

We operate closed-circuit video surveillance cameras in common areas of the property, including the lobby, front desk, restaurant and corridors. The purpose is to protect the safety of guests, visitors, staff and property.

There are no cameras in guest rooms or bathrooms. Areas under video surveillance are identified with visible notices.

e) Sensitive personal data

Where necessary and when you choose to provide it, we may process information concerning health conditions, allergies, dietary restrictions, accessibility or disability requirements, solely to meet specific needs relating to your stay or requested services.

Where applicable law requires express consent or express written consent for such processing, Stanza Hotel will request that consent through an appropriate mechanism.

f) Data concerning children and adolescents

When a minor stays at the hotel, we may process the data strictly necessary to manage the stay, guest registration and compliance with applicable legal obligations. Such data must be provided by a parent, guardian or other duly authorized representative and will be handled with enhanced safeguards.

3. Purposes of processing

3.1 Primary purposes

These purposes are necessary to provide our services:

1. Managing, confirming, modifying and cancelling your reservation.
2. Registering you as a guest and complying with legal obligations applicable to accommodation services.
3. Assigning your room and providing hotel and restaurant services.
4. Processing payments, deposits, guarantees, charges and refunds, and preventing fraud.
5. Issuing tax invoices when requested.
6. Handling requests, complaints, comments and assistance enquiries.
7. Responding to lawful requests from competent authorities and complying with legal, tax, administrative and security obligations.
8. Protecting people and property through video surveillance in the areas indicated.

If you object to processing that is necessary for these purposes, Stanza Hotel may be unable to provide all or part of the services requested.

3.2 Secondary purposes

These purposes are not necessary for the provision of accommodation services. You may refuse them without affecting your reservation or stay.

1. Sending promotions, offers and commercial communications from Stanza Hotel.
2. Inviting you to complete satisfaction surveys.
3. Producing statistics, market analysis and preference profiles to improve our services.
4. Carrying out targeted advertising on digital platforms, where applicable and in accordance with your cookie and consent preferences.

How to refuse secondary purposes.

You may object to these purposes when you provide your data or at any later time by emailing conecta@stanzahotel.com with the subject line “Limitation of use”, stating your name and the purposes to which you object.

You may also unsubscribe from commercial emails using the unsubscribe mechanism included in those messages.

4. Service providers, processors and transfers

4.1 Providers processing data on behalf of Stanza Hotel

Stanza Hotel uses technology and operational service providers that may process personal data on behalf of and under the instructions of the Controller in order to provide specific services.

We use, among others:

Provider	Main purpose
Cloudbeds	Booking engine and property management system
Hostinger	Website hosting and infrastructure
Other operational providers	Technical services, support and infrastructure required for hotel operations

Where such providers act as processors, they are subject to contractual obligations relating to confidentiality, security, processing under instructions, purpose limitation and other applicable requirements.

4.2 Technology providers and third parties

Stanza Hotel also uses technology services that, depending on their specific configuration and purpose, may act as processors, independent controllers or in another legally applicable capacity under their own terms and applicable law.

We use, among others:

Provider	Purpose
Stripe	Payment processing, fraud prevention and compliance related to payment services
Google	Analytics, measurement, tag management and advertising
Meta	Measurement, advertising, audiences and services connected with Facebook and Instagram

Processing involving cookies, advertising identifiers, analytics or remarketing is also subject to the preferences and consent choices available through the website’s cookie banner.

4.3 Transfers that do not require consent

Applicable law permits certain transfers without consent, including where:

• they are necessary to comply with legal obligations or lawful requests from competent authorities;
• they are necessary for the performance of the legal relationship between Stanza Hotel and the data subject;
• another exemption under applicable law applies.

4.4 Transfers requiring consent

Stanza Hotel does not carry out transfers of personal data that require the data subject’s consent, unless in the future you are expressly informed and such consent is obtained where legally required.

4.5 Infrastructure and processing

Certain technology providers used by Stanza Hotel may process or store information using infrastructure located outside Mexico, including in the United States of America, in all cases subject to applicable contractual and legal obligations.

The use of such infrastructure by a processor does not, in itself, constitute a transfer of personal data under applicable law.

5. Ways to limit the use or disclosure of your data

In addition to objecting to secondary purposes, you may:

• request inclusion in our internal marketing exclusion list by emailing conecta@stanzahotel.com;
• use the unsubscribe mechanisms included in commercial communications;
• register, where applicable, with PROFECO’s Public Registry to Avoid Advertising (REPEP);
• accept, reject or configure cookies through the consent banner on our website.

6. ARCO rights

You have the right to Access your personal data, Rectify it when it is inaccurate or incomplete, Cancel it where legally appropriate and Object to its processing for specific purposes. These rights are commonly referred to in Mexico as ARCO rights.

How to exercise your rights

You may email your request to conecta@stanzahotel.com or submit it in writing at our address, including:

1. your name and an address or email for receiving our response;
2. a copy of your official identification or documentation proving representation;
3. a clear description of the personal data concerned;
4. the ARCO right you wish to exercise;
5. any document that helps us locate your data;
6. for rectification, the exact amendment requested and supporting documents.

Deadlines

Stanza Hotel will communicate its decision within a maximum of 20 business days from receipt of the request.

If the request is granted, it will be implemented within the following 15 business days.

These periods may be extended once, for an equal period, where circumstances justify the extension.

Costs

Exercising ARCO rights is free of charge. Only justified reproduction, delivery or other legally permitted costs may be charged.

Certain data may not be cancelled while a legal obligation requires its retention.

7. Withdrawal of consent

You may withdraw consent at any time using the procedure described above or by emailing conecta@stanzahotel.com.

Withdrawal may not be possible, or may not take immediate effect, where a legal obligation requires the data to be retained or where processing remains necessary for the performance of the legal relationship between you and Stanza Hotel.

8. Data retention

We retain your personal data for as long as the purpose that justified its processing remains, and for the retention periods required by applicable law, in particular tax, commercial, administrative and accommodation-related obligations.

Once those purposes have been fulfilled and the corresponding periods have elapsed, your data will be blocked for the sole purpose of determining any liability arising from its processing and, once that period ends, it will be deleted.

Video surveillance images are retained for the period established in our internal security policies and are deleted in accordance with this section.

9. Information security

Stanza Hotel has implemented administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access or processing, in accordance with applicable law.

Access to your data is limited to staff and providers who need to know it for the purposes described in this notice, all of whom are subject to confidentiality obligations.

Should a security breach occur that significantly affects your economic or moral rights, Stanza Hotel will inform you immediately so that you can take the measures you consider appropriate.

10. Cookies, web beacons and similar technologies

stanzahotel.com uses cookies, web beacons and similar technologies to remember preferences, measure use of the website, improve the browsing experience and, where applicable, display relevant advertising.

Data obtained through these technologies may include browser type, operating system, pages visited, time spent on the site, IP address, device identifiers and approximate location.

You may accept, reject or configure cookies through the website’s consent banner and change your choices later.

Details of the cookies and technologies used are available in our Cookie Policy.

11. Changes to this Privacy Notice

Stanza Hotel may amend this Privacy Notice to reflect legislative, regulatory, operational or service-related changes.

The current version will be available at:

https://stanzahotel.com/en/privacy-notice/

The date of the latest update will appear at the beginning of this document.

Where a change is material and we have an appropriate contact method, we may also notify you by email or another suitable channel.

12. Competent authority

If you believe your right to the protection of personal data has been infringed, you may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno (Secretariat for Anti-Corruption and Good Government), the federal authority responsible for the protection of personal data held by private parties, through its Unidad de Protección de Datos Personales (Personal Data Protection Unit).

For current contact details and available procedures, please consult the institutional websites:

https://www.gob.mx/buengobierno
https://portal-transparencia.buengobierno.gob.mx/proteccion-de-datos-personales/

13. Consent and processing of personal data

Where applicable law permits tacit consent, consent will be deemed given if, after this Privacy Notice has been made available to you, you do not object.

Where applicable law requires express consent or express written consent, Stanza Hotel will obtain that consent through an appropriate mechanism.

14. Language and interpretation

This English-language Privacy Notice is provided for informational purposes as a translation of the Spanish-language Privacy Notice of Hotel Ensenada, S.A. de C.V. The processing of personal data by Stanza Hotel CDMX is governed by applicable Mexican law. In the event of an inconsistency in translation, the Spanish-language version shall prevail to the extent permitted by applicable law.