Privacy Policy
PRIVACY NOTICE AND PERSONAL DATA PROCESSING REPORT
INNA RESORT & SPA
Effective Date: 12/01/2025
Corporate Name: NARAN PROYECTO 2
Tax ID (RFC): NPD21015QB8
Trade Name: INNA Resort & Spa
Address: Puerto Morelos, Quintana Roo, Mexico
1. DATA CONTROLLER
The entity responsible for processing your personal data is NARAN PROYECTO 2, operating commercially as INNA Resort & Spa, located at the physical address described above.
For any matters regarding the privacy and protection of your data, we make available the following contact channels:
Email for Privacy Matters and Reservations: reservation@innaresorts.com
Customer Support Line: +52 998 100 8022
2. PURPOSE AND APPLICABLE LAW
This Privacy Notice is issued in full compliance with the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares - LFPDPPP) currently in force in the United Mexican States.
Its purpose is to guarantee the right of all individuals to access, update, rectify, and oppose the handling of information collected in our databases or files, ensuring the privacy, confidentiality, and security of our guests, clients, vendors, and associates.
3. PERSONAL DATA COLLECTED
To fulfill the purposes outlined in this document, INNA Resort & Spa may collect the following categories of data:
• Identification Data: Full name, official signature, official photo ID, nationality, and date of birth.
• Contact Data: Physical address, email address, landline, and mobile phone number.
• Financial Data: Credit or debit card details (to guarantee or process reservation payments), and tax information for corporate billing.
• Sensitive Data: In compliance with Mexican law, data that may reveal intimate aspects or lead to discrimination is considered sensitive. INNA Resort & Spa will only collect basic health data when voluntarily provided by the guest for specific accessibility requirements, food allergies, or medical emergencies during their stay.
4. PURPOSES OF DATA PROCESSING
The collected personal data will be used for the following necessary purposes to provide the service:
• Management, confirmation, modification, and administration of room reservations, packages, and resort services.
• Guest check-in and check-out processes.
• Payment processing, room charges, and applicable tax invoicing.
• Customer support and follow-up on service requests, feedback, or complaints.
• Ensuring property security through CCTV surveillance systems in common areas.
Secondary Purposes (Marketing):
• Sending offers, promotions, rate updates, and exclusive hotel advertising.
Note: The data owner may object at any time to the use of their personal data for these secondary purposes by contacting us via reservation@innaresorts.com.
5. DATA TRANSFERS
INNA Resort & Spa may transfer your personal data to third-party technology service providers (such as hotel management systems and secure payment processors) essential for the execution of the contracted service. Likewise, data may be transferred to competent authorities in cases established by current Mexican legislation (security matters, tax requirements, or health emergencies).
6. ARCO RIGHTS (Access, Rectification, Cancellation, and Opposition)
In accordance with Mexican law, data owners have the right to exercise their ARCO rights at any time:
Access
Know what personal data we hold about you and what we use it for.
Rectification
Request the correction of your information if it is outdated, inaccurate, or incomplete.
Cancellation
Request the removal of your data from our records or databases when you consider it is not being used properly (unless a legal or contractual retention obligation exists).
Opposition
Oppose the use of your personal data for specific purposes (such as advertising).
7. PROCEDURE FOR EXERCISING ARCO RIGHTS
To exercise any of the ARCO rights, the data owner or their legal representative must send a written request to reservation@innaresorts.com, which must include:
- Full name of the data owner and contact details (email or physical address) to deliver the response.
- Official identification documents proving identity (or power of attorney in the case of a legal representative).
- Clear and precise description of the personal data regarding which you seek to exercise any ARCO rights.
- Any other element or document that facilitates locating the personal data.
Response Times:
The data controller will inform the owner, within a maximum period of 20 business days from the date the request was received, of the determination made. If deemed appropriate, it will become effective within 15 business days following the date the response is communicated.
8. SECURITY MEASURES
INNA Resort & Spa will implement reasonable and necessary administrative, technical, and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing. Database access is strictly restricted to authorized personnel under rigorous confidentiality agreements.
9. AMENDMENTS TO THE PRIVACY NOTICE
This Privacy Notice may be modified, changed, or updated as a result of new legal requirements or our own operational needs. Any modifications will be published in a timely manner on our official website for user review.
