Privacy Notice

1. Who is responsible for your personal data

Hotel Bellas Artes (the “Hotel”, “we”) is responsible for the processing of your personal data. Our address for all matters related to this notice is Av. 5 de Mayo 10, Col. Centro, Alcaldía Cuauhtémoc, C.P. 06000, Ciudad de México, México.

Privacy contact: reservaciones@hotelbellasartes.com · +52 55 5488 6600. Please write “Personal data” in the subject line so your message reaches the person in charge of privacy requests.

Legal entity: A.T. RENTA

2. Personal data we process

Depending on how you interact with us, we may process the following categories of personal data:

• Identification and contact data: name, surname, email address, telephone and WhatsApp number, postal address, nationality and language.
• Guest registration data: the information on your official identification or passport, as required to register guests at a lodging establishment.
• Reservation and stay data: dates, room type, number and names of guests, arrival time, preferences, special requests, and the services you use during your stay (such as the restaurant and room service).
• Billing data: taxpayer identification (RFC) and tax address when you request an electronic invoice (CFDI), and the amounts charged.
• Payment data: card details are captured and processed by our booking engine and payment providers, which operate under the PCI DSS standard. The Hotel does not store full card numbers on this website.
• Communications: the content of messages you send us through the contact form, email, telephone or WhatsApp, and the inquiry type you select.
• Website data: IP address, browser and device type, approximate location derived from the IP address, pages visited and interactions, collected through cookies and similar technologies (see section 6), and signals used by Google reCAPTCHA to protect our forms from spam.
• Data of companions and minors: if you book for other people, including minors, you confirm that you are authorized to provide their data. Data of minors are processed only as needed for the stay and with the consent of their parent or legal guardian.

Sensitive personal data

We do not ask for sensitive personal data. If you choose to tell us about a health condition, disability, allergy or dietary requirement so that we can accommodate you, we will process that information only for that purpose, with your express consent, and share it only with the staff who need it to serve you.

3. Why we use your data

Necessary purposes — required for the relationship you have with us:

• Managing your reservation, including confirmations, changes, cancellations, guarantees and deposits.
• Registering you at check-in and check-out, as required by applicable regulations.
• Providing the services you request during your stay, including restaurant, room service and concierge.
• Processing payments, refunds and incidentals, and issuing invoices (CFDI).
• Answering questions, requests and complaints received through any channel.
• Protecting the safety of guests, staff and property, and preventing fraud and misuse of our website.
• Complying with legal obligations and with lawful requests from competent authorities.

Voluntary purposes

With your consent, we may also use your data to:

• Send you offers, news and promotions from the Hotel and Patio Bellas Artes.
• Invite you to answer satisfaction surveys or to share a review of your stay.
• Analyze how our website is used, in aggregate, to improve its content and performance.

You may refuse these voluntary purposes at any time — when you give us your data, or later by writing to reservaciones@hotelbellasartes.com with the subject “Personal data – voluntary purposes”. Refusing them will never affect your reservation or the services you receive.

4. Who we share your data with

We do not sell or rent your personal data. We share it only as described below.

• Service providers acting on our behalf (processors), bound by contract to confidentiality and to use your data only to provide their service: our reservation and property-management platform (Cloudbeds), payment processors, email delivery (Resend), website hosting (Vercel), analytics and anti-spam services (Google Analytics and Google reCAPTCHA), and WhatsApp (Meta) when you choose to contact us through it.
• Competent authorities, when required by law or by a lawful order, and to establish, exercise or defend legal claims.
• Companies you have chosen to book through, such as online travel agencies or travel agents, to the extent needed to manage the reservation they made on your behalf. Their own privacy policies also apply.

Some of these providers store data on servers outside Mexico, mainly in the United States. In those cases we require them to protect your data at a level equivalent to that required by Mexican law and, where applicable, by the GDPR.

Transfers to authorities and to providers that act on our behalf do not require your consent under the LFPDPPP. We will ask for your consent before any other transfer.

5. How long we keep your data

We keep personal data only for as long as needed for the purposes described in this notice and to comply with our legal obligations. Accounting and tax records, including invoices, are kept for the periods required by tax law (generally five years). Contact-form messages are kept for as long as needed to answer and follow up on your inquiry and for no longer than 24 months. When data are no longer needed, they are blocked and then securely deleted or anonymized.

6. Cookies and similar technologies

Our website uses cookies and similar technologies that are necessary for it to work and for security (such as Google reCAPTCHA on our forms), and Google Analytics to measure visits and page use in aggregate. Google Analytics sets cookies (for example, “_ga”) that record an identifier, pages visited and approximate location.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google’s browser add-on (tools.google.com/dlpage/gaoptout). Blocking necessary cookies may prevent the contact form from working.

7. How we protect your data

We apply administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction and unauthorized access or use. Our website uses encrypted connections (HTTPS), and access to guest data is limited to staff and providers who need it. If a security breach significantly affects your rights, we will inform you without undue delay, as required by law.

8. Your ARCO rights

You have the right to Access your personal data, to Rectify them if they are inaccurate or incomplete, to Cancel them when you consider they are not being used in accordance with the law, and to Oppose their use for specific purposes (ARCO rights).

To exercise them, send a request to reservaciones@hotelbellasartes.com with the subject “ARCO rights”, or deliver it to our address. Your request should include:

• Your full name and an email or address where we can reply.
• A copy of your official identification or, if acting through a representative, the document that proves their authority.
• A clear description of the data concerned and the right you wish to exercise.
• Any document or information that helps us locate your data (for example, reservation number and dates of stay).

We will respond within 20 business days from receipt of a complete request. If your request is granted, we will carry it out within the following 15 business days. These periods may be extended once for an equal period when justified. Exercising your ARCO rights is free of charge; you may only be asked to cover reasonable shipping or reproduction costs.

9. Revoking consent and limiting the use of your data

You may revoke the consent you have given us, or ask us to limit the use or disclosure of your data, by writing to reservaciones@hotelbellasartes.com with the subject “Revoke consent” and the information listed in section 8. Revocation does not have retroactive effect, and we may not be able to grant it where we must keep your data to fulfil a legal obligation or to complete a reservation already in progress.

To stop receiving promotional messages, you can also use the unsubscribe link in any of our emails. In Mexico you may also register your telephone number in the Public Registry to Avoid Advertising (REPEP) of the Federal Consumer Protection Agency (PROFECO).

10. Guests in the European Economic Area and the United Kingdom

If you are in the EEA or the UK when you use our website or book with us, the General Data Protection Regulation (GDPR) or the UK GDPR may apply. We rely on the following legal bases: performance of a contract or steps before entering into one (reservations and your stay); compliance with legal obligations (guest registration, tax and accounting); our legitimate interests (security, fraud prevention and improving our services), which we balance against your rights; and your consent (marketing, non-essential cookies and sensitive data you choose to share).

In addition to the ARCO rights, you have the right to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interests or for direct marketing, and to withdraw your consent at any time. You may also lodge a complaint with the data protection authority of your country of residence. Transfers of your data outside the EEA or the UK are protected by the safeguards our providers offer, such as standard contractual clauses.

11. Residents of other jurisdictions

If you live in a country or state that grants you additional privacy rights, contact us at reservaciones@hotelbellasartes.com and we will respond in accordance with the law that applies to you. We do not sell personal data or share it for cross-context behavioral advertising.

12. Supervisory authority

If you believe your right to the protection of your personal data has been infringed, you may file a complaint with the Mexican federal authority responsible for personal data protection in the private sector, the Secretaría Anticorrupción y Buen Gobierno, which assumed these functions in March 2025.

13. Changes to this notice

We may update this notice to reflect changes in the law, in our services or in how we process data. The current version, with its date of last update, is always published on this page. If a change is significant, we will also inform you by email when we have your address.

14. Your consent

By providing your personal data after this notice has been made available to you, you consent to their processing as described here, except for any voluntary purposes you have refused. Where the law requires your express consent — for sensitive personal data — we will request it separately.