Identity and Address of the Controller.

YACHTCLUB VACATIONS S.A. DE C.V, commercially known as "YACHTVIBES" and hereinafter referred to as the "Company" or "Controller", has its address at Spectrum Corporate Center, Av. Sayil Suite 806, Hotel Zone, 77500 Cancun, Quintana Roo. For any requirement or query, the telephone number 800 461 0428 and email: operaciones@yachtvibes.com

The Company assumes responsibility for the processing of the personal data of its customers and users, in strict compliance with the Mexican Federal Law on the Protection of Personal Data in Possession of Private Parties (LFPDPPP) and its Regulations, ensuring that such processing is carried out in accordance with the applicable legal provisions.

Personal Data Collected.

In order to carry out the purposes described in this privacy notice, the Data Controller will collect the following personal data:

• Identification and contact data: Full name, address, landline and/or mobile phone, email, signature, official identification.

• Financial data: Credit or debit card information for the payment of services (this data is processed temporarily and securely, and only for transaction purposes).

• Service-related data: Yacht charter history, hotel, room number.

• Personal data related to minors. Like age and name.

• Personal data related to existing medical conditions. Such as allergies or pre-existing medical condition.

Gif, web beacons, and other technologies.

• GIFs are small graphics that allow you to identify certain functions similar to cookies, these elements are also stored on your hard drive and are sometimes invisible in browsers (Web beacons). From time to time, we will use GIFS in connection with our services for the purpose of tracking users' activities on our digital platforms, which help us manage content and establish statistical data on the use of our digital services. We and the contracted third parties also use GIFS in their HTML language, emails, to our customers, replies, and provide us with identification such as when you receive, forward or reply to an e-mail from us.

Log Files.

Most of our browsers collect certain information such as your IP address, computer type, screen resolution, operating system, as well as your browser.

Third-party analytics.

The Company uses automated applications such as Google Analytics to evaluate our services. We use these applications to store non-personal information about users that will serve us in order to improve our services and user experience. These providers may use cookies and other technologies to perform their services and may combine the information they collect from you for their own purposes. Such non-personal data in this section will be subject to the privacy policies of those companies. For more information on this topic, you can manage some of these permissions by disabling cookies or consulting our Cookie Policy.

Purposes of Processing.

The processing of your personal data has the following purposes:

Primary Purposes (necessary for the provision of the service).

1. Provision of the Yacht Charter Service: Contracting, management, administration and operation of the yacht charter services requested.

2. Membership Management: Registration, administration and maintenance of the yacht charter membership at a preferential price.

3. Invoicing and Collection: Charge for services and issue the corresponding tax receipts.

4. Customer Service: Respond to your requests, questions and comments about the services.

5. Essential Notifications: Inform you about changes to services, schedules, itineraries, and terms and conditions.

6. Minors' data is essential as written consent from parents or guardians is required for minors to board the Yachts, as well as to implement strict security measures to ensure the confidentiality and physical safety of minors.

7. The medical condition is used to safeguard the health of people with disabilities or to take into account an existing medical condition or to obtain information about food and beverages to meet their needs and tastes.

Secondary purposes (not necessary for the provision of the service).

1. Marketing and Advertising: To send you advertising, promotions and information about new YACHTVIBES services that may be of interest to you.

2. Quality Surveys: Evaluate the quality of our services.

3. Confirmation of Automated Decision-Making Processes.

If you do not wish your personal data to be processed for secondary purposes, you can express your refusal through the ARCO Rights procedure described below.

All your data collected will be treated with strict confidentiality in accordance with the Company's Personal Data Security Management System.

Data Retention Period

The use and transfer of personal data shall be carried out for a period of twelve (12) months and shall be limited to the fulfillment of the purposes of processing, unless a legal or regulatory provision establishes otherwise, or until the Company receives a request from the Data Subject to exercise their ARCO Rights, in accordance with Article 37 of the Regulations of the LFPDPPP.

Data Transfers.

Your personal data may be transferred inside and outside the country to:

• Software and Information Technology Systems: For the storage, management, and processing of data necessary for the operation and provision of our services (e.g., customer management, reservations, and administration systems).

• Competent Authorities: In the cases legally provided for to respond to judicial or administrative requirements.

It is reported that transfers to software systems are necessary for the fulfillment of the primary purposes and do not require your express consent, in accordance with article 36 of the LFPDPPP.

The Company declares that personal data transfers may occur between subsidiaries or affiliated companies under the common control of the same corporate group or parent company, in accordance with Article 70 of the Regulations of the LFPDPPP.

Means to Exercise ARCO Rights (Access, Rectification, Cancellation and Opposition).

You have the right to know what personal data we hold about you, what we use it for and the terms of use we give it (Access). Likewise, it is your right to request the correction of your personal information in case it is outdated, inaccurate or incomplete (Rectification); that we delete it from our records or databases when we believe that it is not being used properly (Cancellation); as well as opposing the use of your personal data for specific purposes (Opposition).

To exercise any of the ARCO rights, you must submit a written request to the Personal Data Department of YACHTVIBES, at the following email address: operaciones@yachtvibes.com

Procedure for the Exercise of ARCO Rights

1. Application Form: The application must contain:

o Name of the owner and address or other means to communicate the response to your request.

o Documents that prove the identity or, where appropriate, the legal representation of the holder (valid official identification).

o Clear and precise description of the personal data with respect to which you seek to exercise any of the ARCO rights.

o Any other element or document that facilitates the location of personal data.

2. Response Period: The Controller will notify the owner of the decision adopted within a maximum period of 20 business days, counted from the date on which the request was received.

3. Effectiveness of the Law: If the request is admissible, it will become effective within 15 working days following the date on which the response is communicated. The aforementioned time limits may be extended only once for an equal period, provided that the circumstances of the case so warrant.

If you consider that your right to the protection of your personal data has been violated by any conduct or omission on our part, or if you suspect any violation of the provisions of the Federal Law on the Protection of Personal Data in Possession of Private Parties, its Regulations and other applicable regulations, you may file your disagreement or complaint with the Anti-Corruption and Good Governance Secretariat through the Personal Data Protection Unit.

Revocation of Consent and Limitation of Use or Disclosure of Data.

You may revoke the consent you have given us for the processing of your personal data. You may also limit the use or disclosure of your personal data. To do so, it must follow the same procedure and the deadlines established for the exercise of the ARCO Rights.

Changes to the Privacy Notice.

This Privacy Notice may be modified, changed or updated due to new legal requirements; of our own needs for the services we offer; our privacy practices; changes in our business model, or for other reasons.

We undertake to keep you informed about any changes to this privacy notice through our website www.yachtvibes.com

Last updated: January 26, 2026.

‍