Privacy Notice

I.Data controller

This Comprehensive Privacy Notice is issued pursuant to Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20, 2025, and other applicable regulations (the “Law”).

II.Who is responsible for your data?

Dr. Alfred is a white-label platform that hotels make available to their guests. Processing your data therefore involves two distinct roles:

Where Dr. Alfred acts as a processor, the Hotel’s privacy notice determines the purposes of processing, and rights requests should preferably be addressed to the Hotel. If you send them to us, we will forward them to the Hotel and assist in responding.

III.Personal data we process

Identification and contact

Name, email address, phone number, language, country of residence and, where applicable, profile photo.

Stay and booking

Booking number, arrival and departure dates, room number and type, number of companions, loyalty program and special occasions.

Service use and preferences

Requests, orders, restaurant, spa or activity reservations, purchase history, food, beverage and amenity preferences, reviews, ratings and conversations with the Assistant or staff.

Financial

Payment data processed directly by PCI-DSS certified providers (e.g., Stripe). Dr. Alfred receives only limited information, such as the last four digits, card brand, amounts and transaction status.

Technical and browsing

IP address, device identifiers, browser and operating system, access date and time, pages viewed, activity logs and, only if you allow it on your device, approximate location.

Sensitive personal data

The Platform may let you share allergies, health-related dietary restrictions or accessibility needs, solely to make your stay safe. This data is optional, is processed only with your express consent given on the Platform, and is shared only with Hotel staff who need it.

Third-party data

If you provide data about companions or other people, you confirm you have their consent and have made this Notice available to them.

IV.Purposes of processing

Primary purposes (necessary)

• Identifying you and giving you access to the Platform during your stay.
• Receiving, managing and following up on your requests, orders and bookings, and routing them to the Hotel.
• Operating the AI concierge Assistant and answering your questions.
• Processing payments, room charges, cancellations and refunds in coordination with the Hotel and payment processors.
• Sending operational communications about your stay.
• Accommodating allergies or accessibility needs when you share them.
• Securing the Platform, preventing fraud and misuse, and keeping audit logs.
• Providing technical support and handling complaints or inquiries.
• Complying with legal obligations and requests from competent authorities.

Secondary purposes (optional)

• Sending promotions, offers and marketing communications from the Hotel or Dr. Alfred.
• Personalizing recommendations based on your preferences and past stays.
• Requesting feedback through satisfaction surveys.
• Producing statistics and analyses to improve the Platform and the Assistant, preferably using de-identified or aggregated data.

V.Artificial intelligence

• Your conversations with the Assistant are processed by AI models, our own or those of technology providers acting as processors or sub-processors, solely to generate responses and operate the service.
• We engage providers that are contractually bound to protect the information and not to use it to train their own general-purpose models.
• The Assistant does not make decisions that produce legal effects or significantly affect you without human involvement. Requests that require it are handled by Hotel staff.
• Authorized Hotel staff may review conversations in order to follow up on them.

VI.Transfers and disclosures

Your data may be shared with:

We also disclose data to processors that provide services to us under contract and confidentiality obligations, including: cloud hosting and infrastructure, payment processing (Stripe), messaging (Meta’s WhatsApp Business, email and SMS), AI providers, analytics and support. Some of these providers are located outside Mexico, mainly in the United States; in all cases we require protection levels equivalent to those set out in the Law.

VII.ARCO rights

You have the right to Access your data, Rectify it if inaccurate or incomplete, Cancel it when you consider it is not needed for the stated purposes, and Object to its processing for specific purposes.

Procedure

1. Send your request to privacy@dralfred.ai including: your name and a means to receive our response; a document proving your identity (or your representative’s, with proof of authority); a clear description of the right you wish to exercise and the data involved; and, if applicable, the Hotel and dates of stay.
2. If the information is insufficient, we may request additional details within 5 business days; you will have 10 business days to respond.
3. We will communicate our decision within 20 business days of receiving the request and, if applicable, implement it within the following 15 business days. These periods may be extended once for an equal period when justified.
4. Exercising ARCO rights is free of charge; only justified shipping or reproduction costs may apply.

If the request concerns data we process on behalf of a Hotel, we will forward it to the Hotel and let you know.

VIII.Withdrawing consent and limiting use

You may withdraw your consent at any time, and limit the use or disclosure of your data, by writing to privacy@dralfred.ai following the procedure above. Withdrawal is not retroactive and, in some cases, cannot be applied immediately where a legal or contractual obligation requires us to retain the data.

You may also: unsubscribe from promotional communications via the link they contain; reply “STOP” on WhatsApp or SMS; disable push notifications and location permissions on your device; and register with PROFECO’s Public Registry to Avoid Advertising (REPEP).

IX.Cookies and similar technologies

The Platform uses cookies, local storage and similar technologies for:

• Essential: keeping your session, language and security. These cannot be disabled.
• Analytics: measuring Platform usage to improve it.
• Preferences: remembering display settings.

Data collected includes session and device identifiers, IP address, browser, operating system, pages visited and time of use. You can disable non-essential cookies in your browser settings or cookie banner, although some features may be affected.

X.Retention and security

We keep data only as long as necessary for the stated purposes, in line with the Hotel’s instructions and the retention periods required by tax, commercial and consumer protection laws. Afterwards, data is blocked and securely deleted, or anonymized.

We apply administrative, technical and physical safeguards, such as encryption in transit and at rest, role-based access control, strong authentication, audit logs, backups and confidentiality agreements. If a breach significantly affects your rights, we will notify you without undue delay, in coordination with the Hotel.

XI.Minors

The Platform is not directed to children under 18. We do not knowingly collect their data without the consent of a parent or legal guardian. If we learn such data was collected without consent, we will delete it.

XII.Changes to this Notice

This Notice may change due to legal updates, new features or privacy practices. Any change will be published on the Platform and at dralfred.ai with its update date. Where changes require new consent, we will ask for it.

XIII.Authority and consent

If you believe your right to personal data protection has been violated, you may file a complaint with the competent supervisory authority under the Law (currently, Mexico’s Ministry of Anti-Corruption and Good Governance — Secretaría Anticorrupción y Buen Gobierno).

By using the Platform after this Notice has been made available to you, you consent to the processing of your personal data as described. For sensitive data and purposes that require it, we will obtain your express consent.

In case of any discrepancy between language versions, the Spanish version prevails.