Comprehensive Privacy Notice

Last updated: August 14, 2026.

COSTA DEVELOPMENT, S.A. DE C.V.

“Costa Realty”

In compliance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), hereinafter referred to as “the Law,” its Regulations, and other applicable provisions; Costa Development, S.A. de C.V., doing business as “Costa Realty,” hereinafter (“Costa Development” or the “Data Controller”), makes this Comprehensive Privacy Notice available to its customers, suppliers, employees, partners, and the general public—the subjects of personal data—for the purpose of informing them about how it collects, uses, stores, retains, protects, and, where applicable, discloses their personal data.

I. IDENTITY AND ADDRESS OF THE DATA CONTROLLER

Costa Development, S.A. de C.V., which operates commercially under the name “Costa Realty,” is responsible for processing the personal data it collects in connection with the activities, services, transactions, and legal relationships it maintains with its customers, prospects, suppliers, service providers, property owners, buyers, landlords, tenants, representatives, visitors to its websites and digital platforms, as well as with any other individuals with whom it has a legal or commercial relationship.

For the purposes of this Privacy Notice, the Data Controller’s address is:

Avenida Bonampak, at the corner of Donceles, Block 3, Lot 11, Unit C-109, Interior A, Palmeras Condominium, Cancún, Benito Juárez, Quintana Roo, ZIP Code 77500, Mexico.

Personal data provided to the company by any means—including email, fax, completed forms, telephone calls, contracts, postal mail, business cards, digital media, etc.—will be processed in accordance with the principles of lawfulness, purpose, good faith, consent, quality, proportionality, information, and accountability as provided by law.

II. PERSONAL DATA THAT MAY BE COLLECTED

Depending on the legal, commercial, or service relationship with the data subject and the real estate transaction in question, Costa Development may collect the following categories of personal data:

1. Identification Data
   Full name, address, nationality, place and date of birth, age, marital status, Federal Taxpayer Registry (RFC) number, Unique Population Registry Code (CURP), signature, number and details contained on official identification, as well as, where applicable, immigration information and documentation.
   
   
2. Contact Information
   Address, phone numbers, email address, work contact information, and any other information necessary to communicate with the data subject.
   
   
3. Employment and Professional Information
   Profession, occupation, position or title, company where the individual works, length of service, business activity or line of business, and any other information related to the individual’s professional or business activities.
   
   
4. Financial and Asset Information
   When necessary for the provision of services or the formalization and fulfillment of a real estate transaction, data may be collected regarding income, expenses, bank accounts, account statements, credit information, real estate, public deeds, proof of address and tax documents, information related to guarantors, sureties, jointly and severally liable parties, and other information necessary for the evaluation, structuring, or processing of real estate transactions or loans.
   
   The processing of financial and asset data will be carried out with the data subject’s express consent, unless one of the exceptions provided for by law applies.
   
   
5. Data Related to Real Estate Transactions
   Information and documentation related to sales, leases, marketing, and real estate brokerage, including contracts, agreements, proposals, letters of intent to purchase, transaction or rental amounts, terms, property characteristics, and documentation necessary to formalize the transaction.
   
   
6. Third-Party Data Related to the Transaction
   Where necessary, data may be requested from legal representatives, guarantors, sureties, jointly and severally liable parties, beneficiaries, personal or employment references, and other individuals related to a transaction or legal relationship.
   
   Costa Development will endeavor to collect only the personal data that is necessary, appropriate, and relevant for the purposes set forth in this Privacy Notice.

III. SENSITIVE PERSONAL DATA

As a general rule, Costa Development does not collect or process sensitive personal data in the course of providing its real estate services. In the exceptional event that it becomes necessary to process sensitive personal data for a legitimate, specific, and defined purpose, Costa Development will comply with the applicable provisions of the Law and will obtain the data subject’s express written consent when required.

IV. PURPOSES OF DATA PROCESSING

Personal data may be processed for the following purposes:

A. Primary or necessary purposes. These purposes are necessary to establish, maintain, and fulfill the legal, contractual, or commercial relationship with Costa Development:

1. To identify and contact customers, prospects, property owners, buyers, landlords, tenants, suppliers, and other individuals related to Costa Development’s services.
2. To provide real estate brokerage, consulting, marketing, promotion, management, and operational services.
3. To formalize and monitor contracts, purchase agreements, leases, and other documents related to real estate transactions.
4. To verify the identity and, when necessary for the transaction, the asset, financial, tax, or credit information provided by the data subject.
5. To compile and manage physical and electronic records related to real estate transactions.
6. To carry out procedures with notaries, financial institutions, lending entities, and tax, administrative, municipal, state, or federal authorities, as well as any other individuals or entities that are legitimately involved in a transaction.
7. To follow up on procedures related to mortgage loans, including, where applicable, procedures with institutions such as INFONAVIT, FOVISSSTE, and other financial or lending institutions.
8. Respond to requests from competent authorities and exercise or defend rights before administrative, judicial, or other authorities.
9. Carry out activities related to billing, collections, accounting, auditing, and compliance with tax obligations.
10. Respond to requests, inquiries, clarifications, complaints, and claims related to our services.

B. Secondary or Optional Purposes. In addition, Costa Development may process certain personal data for the following secondary purposes:

1. To send information about properties, projects, services, products, promotions, events, and real estate opportunities that may be of interest.
2. To conduct surveys and studies on satisfaction and service quality.
3. To maintain communication with the data subject regarding future real estate transactions, projects, or services.
4. To personalize certain content and communications on digital platforms, in accordance with the data subject’s preferences.

The data subject may at any time object to the use of their data for secondary purposes by sending an email to: ecommerce@costarealty.com.mx. Objection to secondary purposes shall not constitute grounds for denying the data subject the requested services or products.

V. CONSENT

All processing of personal data is subject to the data subject’s consent, except as provided for in Articles 10 and 37 of the Law. Consent may be express or implied, as applicable. In the case of financial or asset-related data, Costa Development will obtain the data subject’s express consent, unless a legal exception applies.

The data subject may revoke their consent to the processing of their personal data at any time by sending a request to the email address: mgodoy@costarealty.com.mx; however, such revocation shall not have retroactive effect. Revocation will not apply when processing is necessary to comply with legal or contractual obligations, exercise rights, respond to requests from authorities, or when any other exception provided for by applicable law applies.

VI. OPTIONS AND MEANS TO LIMIT THE USE OR DISCLOSURE OF DATA

The data subject may limit the use or disclosure of their personal data—particularly with respect to secondary purposes—by submitting a request to: ecommerce@costarealty.com.mx. Additionally, they may request that their data be removed from certain lists or internal systems used for commercial communication purposes. Exercising these options will not affect the processing necessary to comply with contractual or legal obligations.

VII. TRANSFERS OF PERSONAL DATA

Costa Development may disclose or transfer personal data to third parties when necessary to fulfill the purposes set forth in this Privacy Notice and in accordance with the Law. Depending on the nature of the transaction, the data may be disclosed to:

1. Affiliates or subsidiaries of Costa Development.
2. Real estate agents, advisors, real estate agencies, and collaborators who are legitimately involved in a real estate brokerage transaction.
3. Notaries public involved in the formalization of transactions, as well as banking, financial, and credit institutions or entities related to obtaining and formalizing loans.
4. Tax, administrative, municipal, state, or federal authorities, when necessary or legally required.
5. Attorneys, accountants, advisors, appraisers, experts, and other professionals involved in the transaction.
6. Owners, buyers, landlords, tenants, and other parties directly involved in a real estate transaction, exclusively with respect to the information necessary for its completion.
7. Technology providers and real estate marketing platforms, such as Inmuebles 24, Vivanuncios, and internal CRMs.
8. Competent authorities when there is a legal provision, request, resolution, court order, or warrant that is duly substantiated and justified.

Personal data may only be shared for the purpose of jointly carrying out the necessary procedures related to real estate brokerage activities, including the sale, purchase, lease, or management of real estate.

When the transfer requires the data subject’s consent, Costa Development will request it in accordance with the terms established by law. When the transfer is exempt from the consent requirement under applicable law, it may be carried out without obtaining consent. Costa Development will ensure that data processors and third parties involved in the processing of personal data maintain confidentiality and implement appropriate security measures.

VIII. EXERCISING ARCO RIGHTS

The data subject or their legal representative may exercise the following rights: Access, Rectification, Cancellation, and Objection (ARCO).

Access: Allows the data subject to find out what personal data is processed by Costa Development and to obtain information regarding the conditions and general aspects of such processing.

Rectification: Allows you to request the correction of personal data when it is inaccurate, incomplete, or out of date.

Deletion: Allows you to request that Costa Development cease to hold your personal data and delete it.

Objection: Allows you to object to the processing of your personal data when there is a legitimate reason and the data subject’s particular situation justifies it, or when any other circumstance provided for by law applies.

IX. PROCEDURE FOR EXERCISING ARCO RIGHTS

Requests may be submitted by email to: mgodoy@costarealty.com.mx; or in person at:

Avenida Bonampak, corner of Donceles, Block 3, Lot 11, Unit C-109, Interior A, Palmeras Condominium, Cancún, Benito Juárez, Quintana Roo, ZIP Code 77500, Mexico.

The request must include, at a minimum:

1. The data subject’s name and address or a means of receiving notifications.
2. Documents proving the identity of the data subject or, where applicable, the legal status and identity of their representative.
3. A clear and precise description of the personal data regarding which the data subject intends to exercise an ARCO right, except in the case of the right of access.
4. A description of the ARCO right the data subject intends to exercise or the specific request being made.
5. Any information or document that facilitates the identification of the personal data.

In requests for rectification, the requested modification must also be specified, and the request must be accompanied by supporting documentation.

Costa Development will communicate its decision within a maximum of 20 days from the date of receipt of the request. If the request is deemed valid, it will be carried out within 15 days following the date on which the response is communicated. These deadlines may be extended once only, for an equal period, when the circumstances of the case warrant it, in accordance with the law.

X. RETENTION, BLOCKING, AND DELETION

Costa Development will retain personal data for as long as necessary to fulfill the purposes set forth in this Privacy Notice and to comply with any applicable contractual, legal, tax, accounting, administrative, or other obligations. Once the purpose has been fulfilled and the corresponding retention period has ended, the data may be blocked and subsequently deleted, in accordance with applicable law and Costa Development’s internal information retention policies.

XI. SECURITY AND CONFIDENTIALITY MEASURES

Costa Development will implement and maintain reasonable administrative, technical, and physical security measures, proportionate to the risk, designed to protect personal data against damage, loss, alteration, destruction, unauthorized use, access, or processing. Furthermore, Costa Development will establish controls and mechanisms to ensure that individuals involved in any phase of the processing maintain confidentiality regarding personal data, an obligation that will remain in effect even after their relationship with Costa Development has ended.

In the event of a security breach that significantly affects the economic or moral rights of data subjects, Costa Development will act in accordance with the notification obligations and other provisions established by law.

XII. DATA OBTAINED FROM THIRD PARTIES

When Costa Development receives personal data from a person other than the data subject, it will endeavor to inform the data subject of the corresponding processing in accordance with the terms set forth by law, unless any of the legal exceptions apply. Any person providing personal data of third parties must have the necessary authority, authorization, or legal standing to provide such information when required.

XIII. COOKIES AND TRACKING TECHNOLOGIES

Costa Development uses cookies, identifiers, and similar technologies—whether its own or those of third parties—to analyze browsing behavior and offer a more personalized service tailored to your interests. Certain areas of our site also use cookies to provide customers with a personalized browsing experience. To learn more about our cookie policy, please visit www.costarealty.com.mx, in the privacy notice section.

XIV. CHANGES TO THE PRIVACY NOTICE

Costa Development reserves the right to modify, update, or supplement this Privacy Notice at any time when necessary or as a result of regulatory changes, internal needs, or new data protection practices. Updates will be available through any of the following channels:

1. Visible notices in our establishments.
2. On the website: https://costarealty.com.mx/aviso-privacidad-integral/
3. By email.

When it is necessary to directly notify data subjects of a change, Costa Development may do so through the contact information it has on file, including email, and shall not be liable if the data subject does not receive notification of the change due to a problem with the data subject’s email account or with data transmission over the internet. The date of the last update will appear at the beginning of this Privacy Notice.

XV. CONTACT

For any questions, inquiries, comments, or requests regarding the protection of your personal data, you may contact Costa Development via:

Costa Development, S.A. de C.V.

Email: ecommerce@costarealty.com.mx

Email for ARCO requests: mgodoy@costarealty.com.mx

Phone: (998) 321 0234

Address: Avenida Bonampak, corner of Donceles, Block 3, Lot 11, Unit C-109, Interior A, Palmeras Condominium, Cancún, Benito Juárez, Quintana Roo, ZIP Code 77500, Mexico.

Sincerely,

Costa Development, S.A. de C.V. (Costa Realty)

Last updated: August 2026.