GestaProp Comprehensive Privacy Notice

In compliance with the provisions of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on Protection of Personal Data Held by Private Parties) (hereinafter, the “LFPDPPP”), its Regulations and the Privacy Notice Guidelines, this Comprehensive Privacy Notice regarding GestaProp is made available to the Data Subject.

1. Identity and Address of the Controller

RAKUN VENTURES, SOCIEDAD ANÓNIMA PROMOTORA DE INVERSIÓN DE CAPITAL VARIABLE (hereinafter, “Rakun Ventures” or “the Controller”), owner of the GestaProp platform and of the Getabed brand, with Registro Federal de Contribuyentes (RFC, Federal Taxpayer Registry) RVE201126J42 and corporate address at Avenida de la Paz 2860-D, C.P. 44130, Guadalajara, Jalisco, México, is responsible for the use and protection of the personal data it processes under the terms of this Comprehensive Privacy Notice (hereinafter, “the Notice”), in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on Protection of Personal Data Held by Private Parties) published in the Diario Oficial de la Federación (Official Gazette of the Federation) on March 20, 2025, its regulations and the applicable guidelines (jointly, “the Law”).

For purposes of this Notice:

• GestaProp is the management platform for hotels and vacation rentals that comprises the web console, the native application for Android and iOS, the self-service kiosk, the API, the booking engine, the hosted checkout, the guest portal, the owner and group organizer portals, the per-property websites (Getabed Property Website), the search widget and the Getabed.mx metasearch engine.
• Client is the individual or legal entity that contracts GestaProp to operate one or several accommodations.
• User is each person to whom the Client gives access to GestaProp (administrators, front desk, management, finance, housekeeping, maintenance and other roles).
• Guest is the person who searches, requests a quote, books, pays or registers at an accommodation operated with GestaProp, including anyone who books on behalf of others.
• Data Subject is the individual to whom the personal data correspond.

2. Scope: When We Are Controller and When We Are Processor

Rakun Ventures acts in two different capacities, and this Notice distinguishes between them at all times:

a) As Controller. Rakun Ventures decides on the processing of the data of:

1. Clients, their legal representatives and billing and collections contacts.
2. Users of the console, the application and the API, as regards their account, authentication, security and audit log.
3. Persons who register on the GestaProp waiting list or request information through the contact form, email or WhatsApp.
4. Visitors to the gestaprop.com and Getabed.mx sites.
5. Guests who search for accommodation on Getabed.mx, solely as regards the search and the referral to the accommodation's website.
6. Cardholders who pay with Gesta Payments, solely as necessary to process the charge, prevent fraud and handle inquiries and chargebacks.

b) As Processor. When the Client operates its accommodation with GestaProp, the Client is the controller of the data of its guests, its personnel, the owners of the units it manages and the group organizers, and Rakun Ventures processes them solely on behalf of and under the instructions of the Client to provide the service. In those cases, the applicable privacy notice is that of the accommodation, and the Data Subject must exercise their rights before the Client. Rakun Ventures does not use such data for its own purposes, does not sell it, does not cross-reference it between organizations and does not use it for advertising.

If a Data Subject submits to Rakun Ventures a request concerning data it processes as Processor, Rakun Ventures will forward it to the corresponding Client and will cooperate with the latter to respond to it within the periods established by the Law.

3. Personal Data We Process

3.1 Data We Process as Controller

Client financial information. Bank account data (bank, account holder and CLABE) to disburse to the Client the charges processed with Gesta Payments or to display it to the guest when the Client accepts transfers, and the card or transfer data with which it pays its subscription. Cards are tokenized by the payment processor; GestaProp does not store card numbers or security codes.

Accommodation information. Location, photographs, descriptions, amenities, unit types, rates, policies, inventory and availability. This is not personal data when it corresponds to a legal entity; if the accommodation belongs to an individual, it is processed with the same safeguards as the rest of their data.

3.2 Data We Process as Processor, on Behalf of the Client

4. Sensitive Personal Data

Rakun Ventures does not request sensitive personal data for its own purposes. Data are considered sensitive when they refer to the most intimate sphere of the Data Subject or whose improper use may give rise to discrimination or entail a serious risk to the Data Subject, such as racial or ethnic origin, present or future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions and sexual preference.

When the Client, as controller, decides to collect sensitive data from its guests (for example, a disability or a medical requirement to prepare the stay) or biometric data, it must obtain the express written consent required by the Law through its own privacy notice. GestaProp does not require such data in any flow.

In particular:

• Reading of identifications. The kiosk reads on the device itself the machine-readable zone (MRZ) of passports and identifications; the image is not sent to external services during the reading. The guest confirms or corrects what was read before submitting it, and the photograph is stored in private storage as pending review. GestaProp does not verify identities or perform facial recognition.
• Signature on screen. The signature of the check-in registration is stored as an image with the date and time it was captured, as evidence of the registration. It is not used as biometric data or compared with other signatures.

5. Purposes of the Processing

5.1 Primary Purposes (Necessary for the Legal Relationship)

1. Evaluate and approve the registration application, manage the waiting list and activate the trial period.
2. Enter into, perform and manage the GestaProp license agreement with the Client, including onboarding, configuration, data import and the contracted training.
3. Create and manage User accounts, authenticate them (password, one-time code by email, second factor or sign-in with Google or Apple), assign them roles and scopes, and record in the audit log who made each change and when.
4. Charge the subscription, the add-ons and the commissions; issue the corresponding tax receipts; manage the grace period and, where applicable, suspension for non-payment.
5. Process Gesta Payments charges, disburse to the Client the amounts collected, process refunds to the same account that was charged and handle inquiries and chargebacks.
6. Publish the accommodation on Getabed.mx when the Client consents, display offers with a quoted price and confirmed availability, refer the Guest to the accommodation's website and attribute to the Client the reservations arriving through that channel.
7. Provide technical support, handle incidents and communicate operational, security, billing and service change notices.
8. Prevent fraud, abuse and unauthorized access (attempt and rate limits, anti-bot verification, duplicate detection and webhook review).
9. Respond to requests for information and to the contact form.
10. Comply with legal and tax obligations and respond to requests from competent authorities.

5.2 Secondary Purposes (Not Necessary)

1. Send commercial information about new features, add-ons, events and promotions of GestaProp and Getabed.
2. Apply satisfaction surveys and request opinions to improve the service.
3. Prepare aggregated and anonymous usage statistics of the sites and the platform.

If the Data Subject does not wish their data to be processed for any secondary purpose, they may so indicate at any time at the email address indicated in §10 or through the unsubscribe link included in each commercial communication. Refusal will not be grounds for denying the service.

5.3 Purposes of the Processing on Behalf of the Client

As Processor, Rakun Ventures processes the data described in §3.2 only to provide the Client with the GestaProp functions that it activates: booking engine, quoting, checkout and guest portal; front desk, check-in and kiosk; folios, cashier, charges, refunds and reconciliation; transactional booking emails; channel distribution; CFDI electronic invoicing; groups; housekeeping and maintenance; settlements and owner portal; and human resources through RakunCoreRH.

5.4 Legal Bases for Persons Subject to the GDPR

Where the General Data Protection Regulation (GDPR) of the European Union is applicable, the legal bases of the processing are, as applicable: the performance of the contract or the application of pre-contractual measures (Article 6.1(b)); compliance with legal obligations, including tax, accounting and data protection obligations (Article 6.1(c)); the legitimate interest in the security of the platform, fraud and abuse prevention, service continuity and the defense of claims (Article 6.1(f)), with a documented balancing test that does not override the rights of the Data Subject; and consent for secondary purposes, optional communications and non-essential technologies (Article 6.1(a)), revocable at any time. Where Rakun Ventures processes the data as Processor (§3.2), the bases are determined by the Client in its capacity as controller.

6. How the Data Is Obtained

Rakun Ventures obtains personal data:

a) Directly, when the Data Subject provides it upon registering, contracting, filling out the contact form, writing by email or WhatsApp, or using the console, the application, the API or the checkout.

b) Through electronic means, when the Data Subject visits gestaprop.com, Getabed.mx or a website operated with GestaProp, through the technical cookies described in §12.

c) Indirectly, from sources permitted by the Law:

• from the Client, which uploads or imports the data of its guests, personnel and owners, including migration from Getabed Suite;
• from the online travel agencies (OTA) that send reservations to the Client through GestaProp's Distribution module;
• from the payment processors, which report the result of each charge;
• from Google or Apple, when the User chooses to sign in with those accounts, which provide their name and email.

7. Referrals to Processors and Transfers

7.1 Referrals to Processors

To operate GestaProp, Rakun Ventures communicates personal data to providers that process it on its behalf and under its instructions (referrals). These communications do not require the Data Subject's consent, and the providers are contractually bound to confidentiality and security measures. Some of them are located abroad.

When the Client connects its own payment processor (Stripe, Openpay, Conekta or Mercado Pago), that processor is engaged and chosen by the Client; the charge data is communicated to it at the Client's instruction.

7.2 Transfers

Rakun Ventures does not sell or rent personal data and does not transfer it to third parties for its own purposes. It only carries out the transfers that the Law permits without the Data Subject's consent, in particular:

1. To competent authorities, when they so require by a founded and reasoned order or when required by a legal provision.
2. To companies of the same Rakun Ventures group that operate under the same processes and internal policies, for the same purposes of this Notice.
3. To payment processors, banking institutions and card networks, when necessary for the clarification of a charge or the handling of a chargeback.
4. When necessary for the recognition, exercise or defense of a right in judicial proceedings.
5. In the event of a merger, spin-off or assignment of the platform, to the acquirer, which will remain bound by this Notice.

Referral from Getabed.mx. When a Guest chooses an accommodation on Getabed.mx, they are sent to that accommodation's website with their destination, dates, occupancy and a signed reference valid for seven days. Getabed.mx does not collect their name, email or payment data: the Guest provides them directly at the accommodation's checkout, whose privacy notice applies to them.

International transfers. Some infrastructure, email, payment and security providers may be located outside Mexico. Where an international transfer occurs, it is assessed in accordance with the Law and, if the GDPR is applicable, it is covered by a European Commission adequacy decision or another appropriate safeguard, such as standard contractual clauses, together with supplementary measures where applicable. No provider is stated to be in a specific country without verifying it.

8. Security Measures

Rakun Ventures maintains administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction, unauthorized use, access or processing, including:

1. Isolation by organization in the database: one Client's data is not visible to another, and websites, keys, domains and portals are not shared.
2. Access control by permission and by scope (organization, portfolio or property), with authorization policies on every write operation.
3. Mandatory second factor for Administration and Finance roles, and an operation key for sensitive actions.
4. Passwords, one-time codes, tokens and secrets stored only as hashes, with short validity, attempt limits and responses that do not reveal whether an account exists.
5. Immutable audit log of relevant changes, with actor, date and reason.
6. Encryption in transit (HTTPS/TLS 1.3) on all surfaces and encryption at rest (AES-256) in databases and vaults; encrypted local queue in the application for offline operation.
7. Private object storage: receipts, identifications, evidence and XML files are served only through signed URLs with limited validity.
8. No card storage: the processor tokenizes payment data, and charge notifications (webhooks) are accepted only with the verified signature of the account that collected the charge.
9. Purge of emails with access links or codes once sent.
10. Digital seals (CSD) for invoicing are kept in the vault of the tax service and not in GestaProp.

No measure completely eliminates risk. If a security breach occurs that significantly affects the pecuniary or moral rights of the Data Subject, Rakun Ventures will inform them immediately, together with the measures it adopts and those the Data Subject may take to protect themselves; if the data is processed on behalf of a Client, it will inform the Client so that the Client notifies its data subjects.

9. Retention and Deletion

Personal data is retained only for the time necessary for the purposes of this Notice and to comply with applicable legal obligations:

Once the period ends, the data is deleted or anonymized. Corrections to accounting and tax records are made through reversing entries and not by deleting the original record, because the law and accounting integrity so require; in those cases the data is blocked and retained only to address legal liabilities.

Requests for export or deletion of personal data are answered within a period no longer than 30 calendar days, without prejudice to the periods of the Law described in §10.

10. ARCO Rights and Revocation of Consent

The Data Subject has the right at all times to:

• Access: to know what personal data we have about them, what we use it for and the conditions of its processing.
• Rectification: to correct it when it is inaccurate, incomplete or outdated.
• Cancellation: to request that it be deleted from our records when they consider that it is not processed in accordance with the Law, after a blocking period where applicable.
• Opposition: to object to its processing for a legitimate cause or for specific purposes.

They may also revoke the consent they have granted, to the extent the Law permits. Revocation or opposition with respect to a primary purpose may prevent us from continuing the contractual relationship or providing the service.

10.1 How to Submit the Request

The request is submitted in writing at the address of the Legal Department or by email to the address indicated below, and must contain:

1. Name of the Data Subject, address and email address to receive the response.
2. Documents proving their identity and, where applicable, the identity and powers of their representative.
3. Where possible, the area or service that processes the data (for example: User account, billing, waiting list, Gesta Payments).
4. Clear and precise description of the data with respect to which the right is exercised, unless it is the right of access.
5. The right exercised or what is requested.
6. Any element or document that facilitates locating the data.

In the case of rectification, the Data Subject indicates the modifications and provides the documentation supporting them. In the case of cancellation, they state the causes motivating it. In the case of opposition, they state the reasons justifying it and the damage or harm that continuing the processing would cause them or, if partial, the specific purposes with which they disagree.

10.2 Periods

Rakun Ventures will communicate the determination adopted within a maximum period of 20 business days counted from receipt of the request, extendable only once for an equal period where circumstances justify it, and, if applicable, will make it effective within the 15 business days following the response. Access is delivered at no cost, except for justified shipping or reproduction expenses. For data that Rakun Ventures processes as Processor, the provisions of §2 apply.

10.3 Legal Department

10.4 GDPR Rights

Where the GDPR is applicable, the Data Subject may exercise the rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent, under the terms of Articles 15 to 22 of the GDPR, through the same channels of §10.1; withdrawal of consent does not affect the lawfulness of prior processing. The response is given within one month from receipt, extendable by up to two additional months where the complexity or number of requests justifies it, with notice to the Data Subject. They may also file a complaint with the competent supervisory authority of their Member State, without prejudice to the Mexican remedies of §14. For data that Rakun Ventures processes as Processor, the request is directed to the Client as controller (§2).

11. Limitation of Use or Disclosure

In addition to the ARCO rights, the Data Subject may limit the use or disclosure of their data:

1. Commercial communications: with the unsubscribe link included in each email, or by writing to the Legal Department.
2. Non-operational emails of a reservation (for example, reminders or surveys that the accommodation sends with GestaProp): with the signed unsubscribe link in the email itself. Essential emails of the reservation (confirmation, modification and cancellation) continue to be sent while the reservation exists.
3. Listing on Getabed.mx: the Client may withdraw its consent to appear in the metasearch engine at any time; the listing stops being displayed immediately, without deleting its history.

Rakun Ventures maintains an internal exclusion list with the email addresses that have unsubscribed, bounced or reported a message as unwanted, in order not to send them non-operational communications again.

12. Cookies and Similar Technologies

12.1 What They Are

Cookies are data files that the site stores in the visitor's browser and that allow it to exchange state information, such as the session, authentication or preferences. Web beacons or tracking pixels are images, visible or hidden, that allow knowing the behavior of those who visit a page.

12.2 What We Use

GestaProp, gestaprop.com, Getabed.mx and the websites and checkouts operated with GestaProp use only technical cookies, necessary for operation:

We do not use advertising or segmentation cookies, tracking pixels or web beacons, and we do not share browsing information with advertising networks. If analytics tools are incorporated in the future, they will be without identifiable personal data and this section will be updated before they are activated.

12.3 How to Manage Them

The visitor may view, block or delete the cookies from their browser settings. Because the cookies we use are necessary, blocking them may mean that the visitor cannot sign in, complete a reservation or access the guest portal. More information on how to manage them: https://www.aboutcookies.org.

Accommodation websites published outside GestaProp (for example, on Wix) that embed the search widget have their own cookies, which are governed by the accommodation's privacy notice.

13. Changes to the Privacy Notice

Rakun Ventures may modify this Notice due to legal changes, changes in its services, in its providers or in its privacy practices. The current version is published on gestaprop.com and on the GestaProp page of rakun.mx, with its update date. Substantial changes —a new purpose, a new transfer requiring consent or a change in the identity of the Controller— are also communicated by email to Clients and Users and by notice on the GestaProp console before they take effect.

14. Authority and Consent

If the Data Subject considers that their right to the protection of personal data has been violated, they may turn to the Secretaría Anticorrupción y Buen Gobierno (Anti-Corruption and Good Governance Secretariat), the authority on the matter for the private sector under the Law.

The Data Subject expresses consent to the processing described in this Notice by checking the acceptance box at registration, in the contact form or at the checkout, or by continuing to use the services after it has been made available to them. Acceptance of the policies at the checkout is recorded with the version, language, date and time it was granted.

15. Persons in the European Union

Where the GDPR is applicable by offering services to persons in the European Union or the European Economic Area, or by any of the circumstances of its Article 3, Rakun Ventures complies with the corresponding obligations. If the designation of a representative in the Union under Article 27 of the GDPR is required, their data will be published in this Notice. The rights and complaint channels of the GDPR are not limited by the jurisdiction clause of the Terms and Conditions of Use.

Automated decisions. No decisions are made exclusively by automated means with legal effects on the Data Subject outside the technical controls for licensing, security and fraud and abuse prevention; any substantial change will be communicated by the means of §13.

Normative references: Ley Federal de Protección de Datos Personales en Posesión de los Particulares (current text) and Regulation (EU) 2016/679 (GDPR).

16. Governing Law and Jurisdiction

This Notice is governed by the federal laws of the United Mexican States and, as applicable, by those of the State of Jalisco. For the interpretation, performance or resolution of disputes regarding the processing of personal data, the parties submit to the competent courts of the Metropolitan Area of Guadalajara, Jalisco, waiving any other jurisdiction that may correspond to them, without prejudice to the rights and complaint channels that the GDPR recognizes for persons in the European Union (§15) nor to the powers of the Mexican authority (§14).

Last updated: Guadalajara, Jalisco, México, October 7, 2026.