Pursuant to Mexico’s Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP)

Responsible party: Follaje Urbano, S.C.P. · Serena Hotelito Boutique

Website: serenahotelitoboutique.com

Contact: hola@serenahotelitoboutique.com

Address: Calle 15 88A, Mérida, Yucatán, C.P. 97050, México

Last updated: June 27, 2026

1. Welcome & commitment

At Serena Hotelito Boutique, we deeply value your privacy. This Privacy Notice aims to explain, in a clear and accessible way, what personal data we collect, how we use it, and how you can exercise your rights at any time. We want every interaction with us — before, during, and after your stay — to be built on trust.

2. Data controller

Follaje Urbano, S.C.P. (Serena Hotelito Boutique or the Controller), with address at Calle 15 88A, Mérida, Yucatán, C.P. 97050, México and contact email hola@serenahotelitoboutique.com, is the entity responsible for processing your personal data pursuant to Mexico’s LFPDPPP and its Regulations.

Note on territorial scope: This notice governs data processing carried out by Serena Hotelito Boutique from Mexico. It applies to all guests and website visitors, regardless of nationality or country of residence — including citizens of the European Union, the United Kingdom, the United States, or any other country. Mexican law is the applicable framework.

3. Personal data we collect

To deliver the experience Serena promises, we collect the following categories of personal data:

Identification & contact

• Full name, date of birth, nationality
• Official ID number (passport, national ID or equivalent)
• Email address, phone number, postal address

Booking & stay

• Check-in and check-out dates, room number, preferences and special requests
• Payment information processed via PCI-DSS certified platforms; we do not store card data on our own servers

Communication

• Messages received via email, WhatsApp Business or website forms
• Reviews, comments and post-stay feedback

We do not collect sensitive personal data (as defined in Article 3, Section VI of the LFPDPPP), unless you voluntarily share them to address a specific medical need during your stay.

4. Purposes of processing

Primary purposes — necessary for your stay

• Managing your booking, registration and check-in/check-out process
• Issuing electronic tax receipts (CFDI) and processing payments
• Complying with the Guest Registry Book required by Mexican tourism law
• Communicating with you about your stay: confirmations, changes and relevant information

Secondary purposes — optional, you may opt out at any time

• Sending marketing communications, promotions and Serena news
• Satisfaction surveys and continuous service improvement
• Invitations to loyalty programs or special events

If you prefer your data not to be used for secondary purposes, write to us at any time at hola@serenahotelitoboutique.com and we will process your request promptly.

5. Data transfers

Your data may be shared, without requiring your prior consent, with the following categories of recipients pursuant to Article 37 of the LFPDPPP:

• Government or tax authorities upon written request
• PCI-DSS certified payment platforms for transaction processing
• Online travel agencies (OTAs) solely to confirm bookings originating from those platforms

We do not sell, assign or transfer your personal data to third parties for commercial purposes unrelated to your stay.

6. Your ARCO rights

Mexican law grants you the right to Access, Rectify, Cancel or Object (ARCO rights) to the processing of your personal data. To exercise them, send your request to hola@serenahotelitoboutique.com including: full name, copy of official ID, description of the right you wish to exercise and, if applicable, supporting documents.

We will respond to your request within 20 business days of receipt, as required by Article 32 of the LFPDPPP.

7. Withdrawal of consent

You may withdraw your consent for secondary purposes at any time, provided it does not affect obligations arising from your booking. Follow the same procedure described in the ARCO rights section.

8. Cookies

The website serenahotelitoboutique.com uses cookies and similar technologies. Please consult our Cookie Policy — available on the same site — for details and to manage your preferences.

9. Updates to this notice

We may update this notice at any time to reflect legislative changes or updates to our operations. The current version will always be published at serenahotelitoboutique.com with the date of last update.

10. Supervisory authority

If you believe your data is being processed in violation of applicable law, you may file a complaint with Mexico’s National Institute for Transparency, Access to Information and Personal Data Protection (INAI) at www.inai.org.mx.

Last updated: June 27, 2026