PRIVACY NOTICE

Nayamar Real Estate, S.A. de C.V.

1. Identity and address of the responsible entity:

Legal person Nayamar Real Estate, S.A. de C.V., operator establishments ("Establishments") 'Parrotfish, where land meets sea', “Fonsini Cocktail Bar”, 'Taormina' and “Nick-san Nuevo Vallarta”, all “Establishments” being part of the business group 'Fonsini Restaurant Group', and its real estate agency “Trovare”, with its address in Paseo de los Cocoteros s/n, Local 130, Colonia Nuevo Vallarta, Nuevo Vallarta, municipality of Bahia de Banderas, Nayarit, Mexico, 63735, websites: fonsinirestaurantgroup.com, parrotfishrestaurant.com, nicksanmexico.com, taorminarestaurant.mx, taormina.restaurant, trovarerealestate.com, is responsible for the use and protection of your personal data, pursuant to that we hereby inform you as follows:

2. For what purposes we will use your personal data?

The personal data we collect from you, will be used for the following primary purposes, which are necessary for the service that is being requested.

a) As a Customer, Supplier or Employee:

• Provision of restaurant and reservation services, banquet services and/or event hosting.
• Identification, verification and contact.
• For your security during your stay at the Establishments, we implement security and surveillance measures of the facilities, including monitoring, video cameras, control and surveillance of physical and logical access.
• The performance of contracts and agreements executed between the data subject and the responsible party, for the purpose of brokerage or intermediation in real estate operations (real estate agency).
• Identification and Knowledge of the Client: Integration of identification files and due diligence processes, in accordance with the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin.
• Contractual Management: Negotiation, preparation, signing and execution of purchase-sale, lease, trust, commercial commission or real estate intermediation contracts, among others.
• Patrimonial Verification: Validation of economic capacity, property registration records before the Public Registry and verification of the tax status of the parties.
• Post-Sale Services and Warranties: Management of deed procedures, delivery of physical possession of the properties, attention to construction warranties and latent defects.

b) Particularly as employee or candidate to obtain a job with Nayamar Real Estate, S.A. de C.V., the following primary purposes will apply to you:

• For the analysis, study and processing of your job application and other procedures related to the recruitment, selection, hiring and training of personnel.
• Integration of your employee file.
• For hiring and/or job promotion processes.
• For performing socioeconomic and psychometric studies.
• For identification, verification and contact.
• Integration of your employee file.
• Affiliation and sign-up with union organizations and to handle the processes necessary to fulfill labor legislation.
• For granting labor benefits.
• For making job offers and job opportunities in the establishments to which the company renders its services.
• For the payment of wages and other benefits established in the Federal Labor Law and individual or collective labor agreements.
• For making a database for the prevention of the spread of COVID 19 and / or any other type of future health emergency, whose objective is to identify cases of risk of contagion of this virus, to protect the health of the staff of Nayamar Real Estate, S. A. de C.V.
• For processing registrations, modifications, payment of discounts or the corresponding downsizings before the Mexican Institute of Social Security, Institute of the National Fund for the Consumption of Workers, Institute of the National Fund for Workers’ Housing and contracting of insurance of private medical expenses in favor of its employees.
• Establishing, managing and operating of savings banks where the employees of Nayamar Real Estate, S. A. de C.V. participate,

c) Particularly, as a Supplier of Nayamar Real Estate, S.A. of C.V., the following primary purposes will apply to you:

• For the elaboration of contracts for the provision of services.
• For the fulfillment of contractual obligations.
• For the processes of payment, reception and / or return of goods and services acquired.
• For the processing of orders and integration of administrative files as documentary or other support regarding the existing commercial relationship with you.

Additionally, we will use your personal information for the following secondary purposes that are not necessary for the requested service, but that allow us and facilitate us to provide you a better service:

• Marketing and advertising.
• Commercial prospecting.
• Quality control.
• Definition of consumer behaviors.
• Carrying out feedback campaigns and data updates.

In case you do not wish your personal data to be used for these secondary purposes, we hereby ask you to inform us via whichever option applies:

• If you provide your data directly in person, please inform our staff member at that moment and request that they provide you with the corresponding form to document your negative response.
• If you provide your data through our website or mobile app, you must send an email to the address [email protected] with your negative response.

A negative response for the use of your personal data for these secondary purposes will not be cause for us to deny the services and products you request or hire with us.

3. What personal data will we use for those purposes?

a) Identification data: Name, last name, signature, photograph identification document, Sole Code of the Population Registry (CURP).

b) General data: Full home or work address, personal or work e-mail; home or work telephone number; cellphone number, date of birth, age, marital status and nationality.

c) Tax information: Code of the Federal Taxpayers Registry (RFC), Tax Status Certificate (CSF), as well as tax address and tax regime (when applicable).

d) Bank account data: numbers linked to bank accounts, credit and/or debit cards, name of the owner of the account, account number and bank of origin, CLABE (when applicable), credit card number; expiration date of the card, type of card and security code. All this data will be stored with your express written consent, and in the event that you inform us of your opposition, we could be prevented from providing the services that were contracted, since it could not be possible to process the corresponding payment.

e) Sensitive personal data: Nayamar Real Estate, S.A. de C.V. collects the following sensitive personal data and purposes:

• Personal health data: to provide medical or first aid care and services, for protecting people’s health in emergency situations (including COVID-19 and / or any other type of health emergency), to attend special requirements for customers regarding food allergies or diet restrictions.
• Complementary data to integrate your employment file, which are necessary for the employment relationship and to ensure your safety, well-being and health inside the work establishment. Such data may be the following: biometric data, health data, ideological personal data (only union memberships).

These personal data at no time and under no circumstances will be shared, except for personal health data, which will only be transmitted to medical institutions and other persons involved in emergencies where the owner of the personal data or relatives are at risk.

Employment data: We will require data from your past jobs, such as: position, activities, name of the institution and other data of the institution, number of direct reports, salary, benefits, name of your supervisor and other data that allow us to know your experience and employment history.

Academic data: We will request information about your education, institutions in which you studied, term of your studies and academic degrees received and studies you currently do.

Personal Data from sources of public access and received via consented transfers: resulting from public registers, directories, social networks and other lawful sources available in the market, as well as personal data shared by third parties you previously authorized.

Third-Party Data and Indemnity Clause: Regarding any third-party personal data provided by you (references), you warrant that you possess the necessary legal basis to share such information. You hereby agree to indemnify and hold harmless NAYAMAR REAL ESTATE, S.A. DE C.V. against any claims or proceedings initiated by such third parties arising from a failure to provide notice or obtain the consent that you were responsible for managing. The processing of such data shall be strictly limited to the purposes of labor prospecting and competency validation.

Personal data from Employment Agencies: Nayamar Real Estate, S.A. de C.V., may receive your personal data when you had registered your data in an employment or placement agency to which you have consented to transfer your personal data. In these cases, Nayamar Real Estate, S.A. de C.V., compels itself to treat your personal data in accordance with the privacy notice of said employment or placement agency, always in compliance with the Federal Law on Protection of Personal Data Held by Private Parties, with the understanding that once you authorize Nayamar Real Estate, S.A. de C.V., to treat your personal data, such treatment will be subject to this privacy notice.

Personal data from social media: Nayamar Real Estate, S.A. de C.V. could collect and process personal data and information you shared on social media property of PARROTFISH (such as Facebook®, Instagram ®, Pinterest ®, Foursquare ®, Google ® and Twitter®, among others), particularly that information you shared in the PARROTFISH profile in such social media or in the profile of other companies related to PARROTFISH, including the information you shared as “public”, as established in the terms and conditions of use and policies and recitals of each social media.

The personal data described in the paragraphs listed before in this section, are collected through: i) the use of formats or printed documents; ii) use of e-mails and/or iii) the voluntary provision of information and personal data, (iv) when you visit our facilities, (v) when you request employment at the Nayamar Real Estate, S.A. de C.V. facilities, (vi) when you communicate by phone or thru text messaging applications, with us or with our staff (including the department of customer service); vii) through the websites of the hotels that make up the business group commercially known as Marival Group, as well as its job listings and Human Resources Department, (viii) the use of sources of public access and other sources available in the market, (ix) Job listings and recruitment and hiring agencies to which you voluntarily provide your personal data, and (x) the social media profiles of the hotels or other business ventures that make up the business group commercially known as Marival Group.

4. How do we protect your personal data?

The personal data collected by Nayamar Real Estate, S.A. de C.V. is protected by adequate security, administrative and physical measures against damage, loss, alteration, destruction, use, unauthorized or illegal access or treatment, disclosure, and against loss, damage or alterations or accidental destruction, in accordance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (“LFPDPPP”) and its Regulations. To learn more about our security measures we ask you to contact us via email at [email protected].

We strive to store your personal data in secure operating environments that are not accessible to the general public, and to implement physical, technical and administrative security measures in our physical facilities and informational technology to protect against the loss, misuse or alteration of your personal data by our employees or third parties.

However, it is not possible to guarantee 100% the security of any data transmission over the Internet or any data storage environment, so we cannot assure you in absolute terms that the personal data you provide to us is protected at all times. Nayamar Real Estate, S.A. de C.V. asks you to inform us if you experience any unusual event that may indicate a security breach of your information; In the same way, you will be notified in case of any incident or vulnerability detected by Nayamar Real Estate, S.A. de C.V., within the established deadlines and means designated by the applicable regulations. In that case, we will endeavor to investigate whether this fact was related to the transmission of data whose origin or destination is websites related to Establishments, and we will inform you about the measures you can take and that have been taken to help correct the problem.

5. Information relating to minors:

Our websites or our Social Media profiles, are for the general public and does not offer services directed to minors.

In the event that Nayamar Real Estate, S.A. de C.V. is informed, or detects, that a person under the age of 13 has sent us personal information, we will delete or destroy such information as soon as reasonably possible.

6. With whom will we share your personal information and for what purposes?

We inform you that your personal data can be transferred to third parties inside and outside the national territory in case it is necessary to carry out the purposes set forth in this privacy notice.

Also, we inform you that Nayamar Real Estate, S.A. de C.V., is part of a corporate group commercially known as “MARIVAL® GROUP” and is possible that it transfers your personal data with other companies of the same group, in terms of the provisions set forth on Article 37 of the LFPDPPP regarding the related parties. The companies that are part of the group are:

• Desarrollo Transimar, S.A. de C.V.,
• Destiladeras Resort Operations, S.A. de C.V.
• Rinoval de México, S.A. de C.V.,
• Operador Hotelero Emotions Resort & Suites, S. de R.L. de C.V.,
• Administraciones Profesionales de Vallarta, S.A. de C.V.,
• Operador Hotelero Distinct Luxury Residences, S. de R.L. de C.V.,
• Vacation Club Services, S.A. de C.V.,
• Travel Marketing 500, S. de R.L. de C.V.
• Fundacion Senador Pietro Rizzuto, A.C.,
• Nayamar Real Estate, S.A. de C.V.,
• Tecnología de Viajes y Aventuras, S.A. de C.V.,
• Constructores y Desarrolladores Inmobiliarios de la Bahía, S.A. de C.V.,
• Comercializadora Access del Puerto, S.A. de C.V.,
• Serviventas de México, S.A. de C.V.,
• Servicios Terrestres del Nayar, S.A. de C.V.

We will also share your personal data with independent third parties with which we are required to interact in order to perform the purposes set forth herein. Said independent third parties, especially include bank institutions that process your payments. This transfer in some cases will be optional and you will be able to oppose it at any moment.

The third parties with which we will share your personal data can be:

Finally, we point out that we will transfer your data nationally or internationally, in the cases contemplated by article 37 of the LFPDPPP, in force in Mexico, which expressly establishes the possibility of sharing your data with competent authorities and controlling companies, subsidiaries or affiliates under the common control of the responsible party, or to a parent company or any company thereof, in the following cases:

• When the transfer is provided for in a law or treaty to which Mexico is a party;
• Where the transfer is necessary for medical prevention or diagnosis, providing health assistance, medical treatment or the management of health services;
• When the transfer is made to holding companies, subsidiaries or affiliates under the common control of the responsible party, or to a parent company or any company of the same group of the responsible party that operates under the same internal processes and policies;
• When the transfer is necessary by virtue of a contract in force or to be entered into in the interest of the owner of the personal data, by the responsible party and a third party;
• When the transfer is necessary or legally required for safeguarding a public interest, or for the prosecution or administration of justice;
• When the transfer is necessary for the recognition, enforcement or defense of a right in a judicial process, and
• When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the responsible party and the owner of the personal data.

7. Storage periods:

Nayamar Real Estate, S.A. de C.V., will keep personal data for as long as necessary to fulfill the purposes for which it has collected the information, including the purposes to satisfy any legal, accounting and reporting requirements, in accordance with the provisions of article 37, of the LFPDPPP Regulations, in force in Mexico.

In the case of personal data related to the primary purpose “For the fulfillment of contracts and agreements entered into between the data subject and the responsible party, regarding real estate operations (purchase, sale, lease of real estate),” and in compliance with Mexican legislation, including the Commercial Code, the Federal Tax Code, and the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin, its Regulations and/or general rules, such data will be retained for a period of 5 to 10 years.

For the purpose of determining the appropriate retention period, we take into account the amount, nature and degree of confidentiality of the personal data, the potential risk of harm arising from the unauthorized use or disclosure of your personal data, the purposes for which we processed such data and whether we can achieve those purposes by other means, as well as the legal provisions in force.

8. How can you access, rectify or cancel your personal data or oppose its use?

You have the right to know what personal data we have from you, for what purposes we will use it (primary and secondary purposes) and the use conditions that we give to it (Right to Access). Likewise, is your right to request the correction of your personal information in case it is not updated, is inaccurate or incomplete (Right to Rectification); for us to eliminate from our records or data bases when you considerer that such information is not being used adequately (Right to Cancellation); as well as to oppose to the use of your personal data for specific purposes (Right to Opposition). These rights are known as ARCO rights.

With regards to the procedure and requirements to exercise your ARCO rights, we hereby inform you as follows:

a) What information, documentation and requirements will the application have to include?

Regarding the general requirements that must be contained in the application, these are as follows:

• Name of the owner of the personal data.
• Documents that prove the identity of the owner (passport, voting credential issued by the National Electoral Institute, professional state or federal credential or driver’s license).
• When applicable, name of the owner’s representative and documents to prove his/her identity and capacity. Pursuant to the agents of individuals, the representation will be proven through the following 3 options: a) public deed (document issued by a Notary Public), b) proxy signed before two witnesses (attaching a simple copy of their official identification documents), c) appearing yourself and your representative to declare before the responsible, presenting your official identification (passport, voting credential issued by the National Electoral Institute, professional state or federal credential or driver’s license).
• Address or any means to receive notifications.
• Clear and precise description of the personal data and the right that is intended to exercise or of what is being requested.
• The documents or information that help us to identify the information subject matter of the request (for example, contract number, date of stay, reservation number, etc.).

Likewise, pursuant to the type of request, we require you please to indicate the following additional information, in order for your request to be processed in a more efficient manner:

• Access request: Indicate the method in which you prefer the requested personal data to be reproduced.
• Rectification request: Specify the modifications that are requested for the personal data, as well as providing the documents that support such request.
• Cancellation request: To appoint the causes that motivate the request of eliminating the data from the files, registries or data bases of the responsible party.
• Opposition request: In the event that the request is regarding a particular handling, the specific purposes to which the exercise of the right is being requested, must be indicated.
• Revocation of consent: You can revoke the consent that, where appropriate, you granted us for processing your personal data. However, it is important that you bear in mind that not in all cases we will be able to comply with your request or stop its use immediately, since it is possible that due to some legal obligation we are required to continue processing your personal data. Likewise, you should considerer that, for certain purposes, the revocation of your consent will mean that we can no longer provide the service you requested, or the conclusion of your relationship with us.

b) Through what means can the owner prove his or her identity and, when applicable, his or her representative, as well as the capacity of the latter?:

To exercise any of the ARCO rights, you must file the corresponding request through the following means:

By e-mail to the address [email protected] or also you can contact our Personal Data Department for it to process your request, provide you orientation and provide you the corresponding form. The address of our Personal Data Department is Paseo de los Cocoteros s/n, hotel Marival Emotions Resort & Suites, Nuevo Vallarta, municipality of Bahía de Banderas, Nayarit, zip code 63735, telephone number 322-2268200 (extension 4493).

The official form for processing ARCO requests for Nayamar Real Estate, S.A. de C.V. can be requested by emailing [email protected] downloaded directly from here.

c) In how many days will we respond to your request?
20 business days.

d) Through which means will we communicate the response to your request?
Through email or postal service.

e) Through which means can the personal data I request be reproduced (when applicable)?
In the same manner in which it had been provided by the customer.

f) We hereby place at your disposal the following forms or systems to facilitate the exercise of your ARCO rights:

The corresponding forms or systems and orientation about the exercise of the ARCO rights can be obtained contacting our Department of Personal Data at the email address [email protected] and physical address in Paseo de los Cocoteros s/n, hotel Marival Emotions Resort & Suites, Nuevo Vallarta, municipality of Bahía de Banderas, Nayarit, zip code 63735, telephone number 322-2268200 (extension 4493), or you could download the form directly from here.

g) Is there any cost for exercising my ARCO rights?

The exercise of ARCO rights is free of charge. However, you may be required to cover only justified shipping expenses or the cost of reproduction in copies or other formats. Likewise, if the same person repeats their request within a period of less than twelve months, the costs shall not exceed three times the current UMA (Unit of Measure and Update), unless there are substantial modifications to the privacy notice that justify new inquiries.

h) What happens if a request is incomplete or all the data that is included in the procedure is not attached?

In the event that your request does not have the information described on section 8 Requirements (paragraph a and b), or is not clear, is incorrect, or is incomplete, Nayamar Real Estate, S.A. de C.V. will be able to request the owner to provide the missing information, through notification of deficiency “prevention”, which will have to be issued in the maximum term of 5 business days starting the day after the request was filed.

The owner will have 10 business days to comply with the requirement of Nayamar Real Estate, S.A. de C.V., starting on the day after it was received. In the event that the owner complies with the information requirement, the timeframe for the responsible party to reply will begin on the day after the day on which the owner complied with the requirement.

For more information about the procedure, we place to your disposal the following means:
Email address: [email protected]

Contacting our data protection department, which is in charge of processing the requests of ARCO rights, as follows:

1. a) Name of the person or department of personal data: Department of Protection of Personal Data, Marival®
2. b) Address: Paseo de los Cocoteros s/n, inside Marival Emotions Resort & Suites, Nuevo Vallarta, municipality of Bahía de Banderas, Nayarit, Mexico, 63735
3. c) Email: [email protected]
4. d) Telephone number: 322-2268200

9. How can you limit the use or disclosure of your personal information?

With the purpose of you being able to limit the use and disclosure of your personal information, we hereby offer you the following means:

The customer can limit the use and release of his or her personal data, by sending an email making the concrete description to the following email address [email protected].

Additionally, we inform you that we have the following exclusion listings, in which you will be able to subscribe or unsubscribe in our dispatch platforms, for your personal data not to be treated for certain purposes (mainly secondary):

Additionally, we provide the following communication lists, which are essential for the management of your membership as they relate to the primary purposes of administration, operation, and service reservation, as well as providing security alerts and fraud prevention measures. Unsubscribing from these channels may prevent us from providing timely and relevant information regarding your services.

10. The use of tracking technologies in our Internet website:

We inform you that in our website we use cookies and other technologies through which it is possible to monitor your behavior as an internet user, as well as to provide you a better service and experience while browsing our website. The personal data we acquire through these technologies will be used for the following purposes:

To monitor and prevent the unauthorized use of the digital platforms; to improve our digital tools and update them as the technology evolves; and to offer personalized content.

The personal data that we obtained from these tracking technologies are the following:

• Identification data form one session.
• Identifiers, username and passwords from one session.
• Preferred language chosen by the user
• Region in which the user is located
• User’s type of browser
• User’s type of the operating system.
• Websites visited by a user
• Searches made by a user.
• Advertising reviewed by a user.

11. How can you know about changes to this privacy notice?

This privacy notice can be amended, modified or updated due to new legal requirements; of our own needs due to the products or services we offer; of our privacy practices; of changes in our business model, or due to other causes.

We are committed to keep you informed about the changes that this privacy notice might undergo, by: sending an e-mail and posting it on the Establishment Websites:

• Parrotfishrestaurant.com.mx
• Taormina.restaurant
• https://nicksanmexico.com.mx/
• Trovarerealestate.com
• Fonsinirestaurantgroup.com.

The procedure through which the notifications about the changes or updates to this privacy notice will be made, is the following:

The changes or updates to the privacy notice will be informed by the means described herein and will be effective 1 week afterwards. In case of any doubts or comments, the clients must address them to [email protected]

DISCLAIMER.- This is a courtesy English translation. Should any conflict or controversy result between the Spanish and the English version, the Spanish version shall prevail.

Last Update: 22/04/2026