Skip to Main Content

COMPREHENSIVE PRIVACY NOTICE FOR COLLEAGUES AND/OR APPLICANTS

COMPREHENSIVE PRIVACY NOTICE FOR COLLEAGUES AND/OR APPLICANTS

Club de Descuentos Vacacionales MX S. de R.L. de C.V. ("UVC"), with registered office at Corporativo Cancún UNO, Av. Tulum, SMZ 9, MZ 1, LT 2, Piso 10, Cancún, Quintana Roo, México, C.P. 77504, makes this privacy notice (the “Privacy Notice”) available to you, which contains the policy under which the personal data mentioned below will be collected and processed so that UVC can get to know you as a candidate for a job vacancy and, if applicable, onboard you as a colleague, in accordance with the current Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”), and its Regulations. The Privacy Notice can also be found at https://www.unlimitedvacationclub.com/en/privacy--security/privacy-policy-landing/

CONTROLLER OF YOUR PERSONAL DATA AND CONTACT DETAILS

  • Controller: UVC
  • Address: Corporativo Cancún UNO, Av. Tulum, SMZ 9, MZ 1, LT 2, Piso 10, Cancún, Quintana Roo, México, C.P. 77504.
  • Email: privacy@unlimitedvc.com, info@unlimitedvacationclub.com (the latter address will be used solely for sending automated emails and not for receiving requests or inquiries).

 PERSONAL DATA WE COLLECT

UVC may collect and process the following personal data:

A) Personal Identification Details

Full name, address, date of birth, nationality, marital status, Federal Taxpayer Registry (RFC), Unique Population Registry Key (CURP), Social Security Number (NSS), official ID, signature, photograph, audio and video.

B) Contact Details

Applicant´s email address, telephone number, and address.

C) Employment and Academic Details

Resume, work history, performance, references, certifications.

D) Financial and Asset Details

Salary, bank accounts, AFORE, INFONAVIT.

F) Security and Technology

Access logs, CCTV, system logs, use of digital tools.

G) Biometric Data

Biometric CURP, fingerprint, facial recognition or other authentication mechanisms.

H) Sensitive Personal Data

Data strictly necessary for:

  • Fulfillment of labor and social security obligations
  • Emergency medical care
  • Occupational medical evaluations when legally or materially necessary for the position

 

III. PURPOSES OF DATA PROCESSING

Primary Purposes (Essential)

  • Applicant recruitment, assessment and selection
  • Employment record integration and administration
  • Payroll and benefits payment
  • Compliance with legal and regulatory obligations
  • Identity and reference verification
  • Physical and logical access control. For the purposes of this Privacy Notice, “logical access control” means authentication and authorization mechanisms to access corporate systems, platforms, applications, networks and digital resources.
  • Security of facilities, staff and assets
  • Performance assessment and training
  • Work tool and system management
  • Investigation of violations and misconduct

Work Monitoring (Legitimate Interest)

The following may be monitored in a proportionate, limited and non-intrusive way by UVC:

  • Use of corporate email
  • Electronic and digital devices assigned
  • Access to corporate networks, platforms and systems

Monitoring shall be carried out only:

  • During working days or when using corporate tools; and
  • On work-related communications, archives or activities.

UVC will not monitor personal communications expressly identified as such, except when there is a legal obligation, a request from a relevant authority or a serious risk to information security duly justified.

Any individualized or extraordinary monitoring shall:

  • Be duly justified.
  • Be conducted in accordance with applicable internal policies; and
  • Be previously notified to the colleague, unless prior notification may compromise an internal investigation, legal obligation or security procedure.

The use of corporate tools will also be subject to current internal policies: Information Technology (IT), Information Security, Code of Conduct and Acceptable Use Policy.

Under no circumstances shall disproportionate, intrusive or unrelated surveillance practices be carried out.

Video Surveillance (CCTV)

Our facilities have CCTV for:

  • Safety of people and property
  • Access control

Video recordings will be kept for a limited period (max. 90 days, except as required by law).

Biometric Data

These will be used exclusively for:

  • Identity authentication
  • Controlling access to work site facilities

Biometric data processing will be limited, necessary and subject to enhanced security measures, including encryption, segregated storage, restricted access and secure removal.

Secondary Purposes

  • Issuance of employment references

DATA TRANSFERS

The owner of personal data is informed that, in accordance with Article 36 of the Law, UVC may transfer their personal data without needing to obtain their consent solely and exclusively in the event that any of the following assumptions occur:

  • When the transfer is made to controlling companies, subsidiaries or affiliates under the common control of the controller, or to a parent company or any company of the same group of the controller that operates under the same internal processes and policies.
  • When the transfer is necessary by virtue of a contract entered into or to be entered into in the interest of the data owner, by the data controller and a third party.
  • When the transfer is necessary or legally required for the safeguarding of a public interest, or for the procurement or administration of justice.
  • When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the controller and the data owner.

International transfers shall be conducted under mechanisms that ensure adequate protection levels in accordance with applicable law.

  DATA OWNER'S RIGHTS

The data owner is informed that they may exercise their rights of access, rectification, cancellation or opposition (“ARCO Rights”) before UVC with regard to the Personal Data of which they are the owner. To do so, the data owner should contact UVC at privacy@unlimitedvc.com, submitting the form ARCO for Colleagues, duly filled out and signed, which is available at www.unlimitedvacationclub.com/siteassets/arcorightspdf/ or found as an attachment at the end of this Privacy Notice.

The form may be sent electronically to the above email or physically presented at the address of the controller.

In accordance with Article 90 of the Regulation under the Federal Law on Protection of Personal Data Held by Private Parties, UVC informs the data owner that the form mentioned in the above paragraph is available to them to simplify and facilitate the exercise of their ARCO rights in accordance with the procedure described below.

UVC will notify the data owner, within a maximum period of 20 (twenty) business days from the date on which the ARCO Right request was received, the decision taken so that, if applicable, it will become effective within 15 (fifteen) business days following the date on which the response is communicated. The deadline may be extended only once per request for up to an additional period of 15 (fifteen) business days, as long as UVC justifies such extension to the data owner, which must be notified before the expiration of the original deadline. To conclude, UVC will note down the respective date of receipt on the acknowledgment of receipt given by the data owner.

The term indicated in the above paragraph will be interrupted if UVC requires additional information from the data owner because the information originally provided was insufficient or incorrect to fulfill the request or because the aforementioned documents were not included. To that end, UVC may require the data owner, once and within 5 (five) business days following the request's receipt, to provide the elements or documents required to process it. On their part, the data owner will have 10 (ten) business days, starting from the day after receipt, to respond to this request. If the data owner does not respond within that period, the respective request will be considered not submitted. On the contrary, if the data owner complies with the request for information, the term for UVC to respond to the request will begin the day after the data owner addressed the request for additional information.

UVC's responses to data owners who exercised their ARCO Rights will be sent via the same method used to submit the request, solely concerning the Personal Data specifically indicated in said request, and must be presented in a legible and understandable format.

When access to the personal data is on a site designated by UVC, the latter will grant the data owner a period of 15 (fifteen) business days to come to review them. If this period elapsed and the data owner did not attend the site, a new request needs to be submitted.

When UVC denies the exercise of any of the ARCO Rights, it must justify its response, informing the data owner of their right to request the initiation of the respective procedure before the decentralized body Transparency for the People of the Secretariat for Anti-Corruption and Good Governance.

The exercise of ARCO Rights will be free of charge; however, the data owner must cover the expenses for shipping, reproduction (non-certified copy) and, if applicable, certification of documents.

DATA RETENTION

Personal data collected will be retained:

  • During the recruitment or hiring process
  • During the employment relationship, when applicable
  • Thereafter, in accordance with legal (labor, tax and social security) obligations

VII. SECURITY MEASURES

UVC implements the following measures for the protection of personal data:

  • Role-based access controls
  • Multi-factor authentication
  • Encryption in transit and at rest
  • Access logs
  • Segmentation of sensitive information
  • Safe destruction
  • Confidentiality agreements
  • Periodic reviews
  • Mandatory training

 VIII. CHANGES TO THE PRIVACY NOTICE

UVC has the right to make modifications or updates to this Privacy Notice at any time due to legislative reforms, internal policies, or new requirements. Said modifications will come into effect upon publication and will be available to data owners at:

 

AUTHORITIES

  • Mexico: Secretariat for Anti-Corruption and Good Governance or the relevant authority in accordance with the applicable legislation.

 

CONSENT

The data owner acknowledges and accepts having read and understood this Privacy Notice, as well as its scope and consequences.

Therefore, the data owner grants their express consent for the following specific processing of personal data:

I consent to the processing of sensitive personal data related to my health, exclusively for:

  • Emergency medical care
  • Compliance with legal obligations in labor, social security and IMSS matters
  • Occupational medical evaluations when required for the position

I consent to the collection and use of biometric data, including fingerprint, facial recognition or other authentication mechanisms, exclusively for:

  • Identity verification
  • Physical and logical access control
  • Authentication in corporate systems

I agree to the monitoring of the use of corporate email, electronic devices, networks and work systems in the terms established in this Privacy Notice and the applicable internal policies.

I agree with the processing of images and video recordings using video surveillance systems (CCTV) for the purposes of:

  • Safety of people and property
  • Access control
  • Prevention and investigation of incidents

Privacy Notice version: 1.0
Effective Date: 06/05/2026