Comprehensive privacy notice

Last updated: October 20, 2026


INMOBILIARIA BASAC, S.A. DE C.V.


"GRUPO COSTA"


In compliance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), hereinafter referred to as the “Law,” its Regulations, and other applicable provisions; INMOBILIARIA BASAC, S.A. DE C.V., trading as “GRUPO COSTA,”, hereinafter referred to as (“INMOBILIARIA BASAC” or the “Data Controller”), makes available to its customers, suppliers, employees, partners, and the general public—who are the subjects of personal data— this Comprehensive Privacy Notice, for the purpose of informing them about how it collects, uses, stores, retains, protects, and, where applicable, discloses their personal data.

I. IDENTITY AND ADDRESS OF THE DATA CONTROLLER

INMOBILIARIA BASAC, S.A. DE C.V., which operates commercially under the name “GRUPO COSTA” , is responsible for processing the personal data it collects in connection with the activities, services, transactions, and legal relationships it maintains with its customers, prospects, suppliers, service providers, property owners, buyers, landlords, tenants, representatives, and visitors to its websites and digital platforms, as well as with any other individuals with whom it has a legal or commercial relationship.

For the purposes of this Privacy Notice, the Data Controller’s address is:

Avenida Bonampak, Block 3, Lot 11, Unit C-109, Interior A, Palmeras Condominium, Cancún, Benito Juárez, Quintana Roo, ZIP Code 77500, Mexico.

Personal data provided to the company by any means—including email, fax, completed forms, telephone calls, contracts, regular mail, business cards, digital media, etc.—will be processed in accordance with the principles of lawfulness, purpose, good faith, consent, quality, proportionality, information, and accountability as set forth in the Law.

For commercial and operational identification purposes, the Data Controller may also identify itself to the data subjects using the name “GRUPO COSTA INVESTMENTS,” as appropriate for the activity, project, real estate development, platform, or medium through which the relationship with the data subject is established.

The names listed above are included in this Notice solely to facilitate the identification of the Data Controller by the data subjects; their mention does not, in and of itself, imply that they constitute separate legal entities or that other affiliated companies are responsible for the processing of personal data.

Consequently, unless expressly stated otherwise in the corresponding privacy notice, INMOBILIARIA BASAC, S.A. de C.V. shall be the legal entity responsible for processing the personal data collected through such names, within the scope of the activities it actually carries out and with respect to which it determines the purposes and means of processing.

II. PERSONAL DATA THAT MAY BE COLLECTED

Depending on the legal, commercial, or service relationship with the data subject and the real estate transaction in question, INMOBILIARIA BASAC may collect the following categories of personal data:

  1. 1. Identification Information
Full name, address, nationality, place and date of birth, age, marital status, Federal Taxpayer Registry (RFC) number, Unique Population Registry Code (CURP), signature, number and details contained on official identification, as well as, where applicable, immigration information and documentation.

  1. 2. Contact Information
Address, phone numbers, email address, work contact information, and any other information necessary to communicate with the data subject.

  1. 3. Employment and Professional Information
Profession, occupation, position or title, company where the individual works, length of service, business activity or line of business, and other information related to their professional or business activity.

  1. 4. Financial and Asset Information
When necessary for the provision of services or the execution and fulfillment of a real estate transaction, data may be collected regarding income, expenses, bank accounts, bank statements, credit information, real estate, public deeds, proof of address and tax documents, information related to guarantors, sureties, jointly and severally liable parties, and any other information necessary for the evaluation, structuring, or processing of real estate transactions or loans. The processing of financial and asset data will be carried out with the express consent of the data subject, unless one of the exceptions provided for in the Law applies.

  1. 5. Data related to the real estate transaction
Information and documentation related to real estate sales, leases, marketing, and brokerage, including contracts, agreements, proposals, letters of intent to purchase, transaction or rental amounts, terms, property characteristics, and documentation necessary to formalize the transaction.

  1. 6. Third-Party Data Related to the Transaction
Where necessary, data may be requested from legal representatives, guarantors, sureties, jointly and severally liable parties, beneficiaries, personal or employment references, and other individuals related to a transaction or legal relationship. INMOBILIARIA BASAC will endeavor to collect only the personal data that is necessary, appropriate, and relevant for the purposes stated in this Privacy Notice.

III. SENSITIVE PERSONAL DATA
As a general rule, INMOBILIARIA BASAC does not request or process sensitive personal data for the provision of its real estate services. In the event that, exceptionally, it becomes necessary to process sensitive personal data for a legitimate, specific, and defined purpose, INMOBILIARIA BASAC will comply with the applicable provisions of the Law and will obtain the data subject’s express written consent when such consent is required.

IV. PURPOSES OF DATA PROCESSING
Personal data may be processed for the following purposes:

A. Primary or Necessary Purposes. These purposes are necessary to establish, maintain, and fulfill the legal, contractual, or commercial relationship with INMOBILIARIA BASAC:

  1. 1. To identify and contact clients, prospects, property owners, buyers, landlords, tenants, suppliers, and other individuals related to the services provided by INMOBILIARIA BASAC.
  2. 2. Provide real estate brokerage, advisory, marketing, promotion, management, and operational services.
  3. 3. Formalize and monitor contracts, promises to buy and sell, leases, and other documents related to real estate transactions.
  4. 4. To verify the identity and, when necessary for the transaction, the asset, financial, tax, or credit information provided by the data subject.
  5. 5. To compile and manage physical and electronic records related to real estate transactions.
  6. 6. Carry out procedures with notaries, financial institutions, lending entities, tax, administrative, municipal, state, or federal authorities, and other individuals or entities that are legitimately involved in a transaction.
  7. 7. To follow up on procedures related to mortgage loans, including, where applicable, dealing with institutions such as INFONAVIT, FOVISSSTE, and other financial or credit institutions.
  8. 8. To respond to requests from competent authorities and to exercise or defend rights before administrative, judicial, or any other type of authority.
  9. 9. Perform billing, collection, accounting, auditing, and tax compliance activities.
  10. 10. Respond to requests, inquiries, clarifications, complaints, and claims related to the services.


B. Secondary or Optional Purposes. In addition, INMOBILIARIA BASAC may process certain personal data for the following secondary purposes:

  1. 1. To send information about properties, projects, services, products, promotions, events, and real estate opportunities that may be of interest.
  2. 2. To conduct surveys and studies on satisfaction and service quality.
  3. 3. To maintain communication with the data subject regarding future real estate transactions, projects, or services.
  4. 4. To personalize certain content and communications on digital media, in accordance with the data subject’s preferences.

The data subject may at any time object to the use of their data for secondary purposes by sending an email to: ecommerce@costarealty.com.mx. Objecting to secondary purposes will not be grounds for denying the data subject the requested services or products.

V. CONSENT
All processing of personal data shall be subject to the data subject’s consent, except as provided for in Articles 10 and 37 of the Law. Consent may be express or implied, as applicable. In the case of financial or asset-related data, INMOBILIARIA BASAC will obtain the data subject’s express consent, unless a legal exception applies.

The data subject may revoke their consent to the processing of their personal data at any time by sending a request to the following email addresses: mgodoy@costarealty.com.mx, provided that such revocation shall not have retroactive effect. Revocation will not apply when processing is necessary to comply with legal or contractual obligations, exercise rights, respond to requests from authorities, or when any other exception provided for by applicable law applies.

VI. OPTIONS AND MEANS TO LIMIT THE USE OR DISCLOSURE OF DATA
The data subject may limit the use or disclosure of their personal data, particularly with respect to secondary purposes, by submitting a request to: ecommerce@costarealty.com.mx. Additionally, they may request that their data be excluded from certain lists or internal mechanisms used for commercial communication purposes. Exercising these options will not affect the processing necessary to comply with contractual or legal obligations.

VII. TRANSFERS OF PERSONAL DATA
INMOBILIARIA BASAC may disclose or transfer personal data to third parties when necessary to fulfill the purposes set forth in this Privacy Notice and in accordance with the law. Depending on the nature of the transaction, the data may be disclosed to:

  1. 1. Affiliates or subsidiaries of INMOBILIARIA BASAC.
  2. 2. Real estate agents, advisors, real estate agencies, and collaborators who are legitimately involved in a real estate brokerage transaction.
  3. 3. Notaries public involved in the formalization of transactions, as well as banking, financial, and credit institutions or entities related to obtaining and formalizing loans.
  4. 4. Tax, administrative, municipal, state, or federal authorities, when necessary or legally required.
  5. 5. Attorneys, accountants, advisors, appraisers, experts, and other professionals involved in the transaction.
  6. 6. Owners, buyers, landlords, tenants, and other parties directly involved in a real estate transaction, exclusively with respect to the information necessary for its completion.
  7. 7. Technology providers and real estate marketing platforms, such as Inmuebles 24, Vivanuncios, and internal CRMs.
  8. 8. Competent authorities when there is a legal provision, requirement, resolution, court order, or warrant that is duly substantiated and justified.

Personal data may only be shared for the purpose of jointly carrying out the necessary procedures related to real estate brokerage activities, including the sale, purchase, lease, or management of real estate.

When the transfer requires the data subject’s consent, INMOBILIARIA BASAC will request it in accordance with the terms established by law. When the transfer is exempt from the consent requirement under applicable law, it may be carried out without obtaining consent. INMOBILIARIA BASAC will ensure that data processors and third parties involved in the processing of personal data maintain confidentiality and adopt appropriate security measures.

VIII. EXERCISE OF ARCO RIGHTS
The data subject or their legal representative may exercise the following rights: Access, Rectification, Cancellation, and Opposition (ARCO).

Access: Allows you to find out what personal data is processed by INMOBILIARIA BASAC and to obtain information regarding the conditions and general terms of its processing.

Rectification: Allows you to request the correction of personal data when it is inaccurate, incomplete, or out of date.

Deletion: Allows you to request that INMOBILIARIA BASAC cease to hold your personal data and delete it.

Objection: Allows you to object to the processing of personal data when there is a legitimate reason and the data subject’s particular situation justifies it, or when any other circumstance provided for by law applies.

IX. PROCEDURE FOR EXERCISING ARCO RIGHTS
The application may be submitted by email to: mgodoy@costarealty.com.mx; or in person at:

Avenida Bonampak, Block 3, Lot 11, Unit C-109, Interior A, Palmeras Condominium, Cancún, Benito Juárez, Quintana Roo, ZIP Code 77500, Mexico.

The application must include, at a minimum:
  1. 1. Name of the data subject and address or method for receiving notifications.
  2. 2. Documents proving the identity of the data subject or, if applicable, the legal status and identity of their representative.
  3. 3. A clear and precise description of the personal data regarding which an ARCO right is to be exercised, except in the case of the right of access.
  4. 4. A description of the ARCO right the data subject intends to exercise or the specific request being made.
  5. 5. Any information or document that facilitates the location of the personal data.

In requests for rectification, the intended modification must also be specified, and the request must be accompanied by supporting documentation.

INMOBILIARIA BASAC will notify you of its decision within a maximum of 20 days from the date of receipt of the request. If the request is granted, it will take effect within 15 days of the date on which the response is communicated. These deadlines may be extended once only, for an equal period, when the circumstances of the case warrant it, in accordance with the law.

X. RETENTION, BLOCKING, AND DELETION
INMOBILIARIA BASAC will retain personal data for as long as necessary to fulfill the purposes set forth in this Privacy Notice and to comply with any applicable contractual, legal, tax, accounting, administrative, or other obligations. Once the purpose has been fulfilled and the corresponding retention period has ended, the data may be blocked and subsequently deleted, in accordance with applicable law and INMOBILIARIA BASAC’s internal data retention policies.

XI. SECURITY AND CONFIDENTIALITY MEASURES
INMOBILIARIA BASAC will implement and maintain reasonable administrative, technical, and physical security measures, proportionate to the risk, designed to protect personal data against damage, loss, alteration, destruction, unauthorized use, access, or processing. Furthermore, INMOBILIARIA BASAC will establish controls and mechanisms to ensure that individuals involved in any phase of the processing maintain confidentiality regarding personal data, an obligation that will remain in effect even after their relationship with INMOBILIARIA BASAC has ended.

In the event of a security breach that significantly affects the economic or moral rights of data subjects, INMOBILIARIA BASAC will act in accordance with the notification obligations and other provisions established by law.

XII. DATA OBTAINED FROM THIRD PARTIES
When INMOBILIARIA BASAC receives personal data from a person other than the data subject, it will endeavor to inform the data subject of the corresponding processing in accordance with the terms set forth by law, unless any of the legal exceptions apply. The person providing personal data of third parties must have the necessary authority, authorization, or legal standing to provide such information when required.

XIII. COOKIES AND TRACKING TECHNOLOGIES
INMOBILIARIA BASAC uses cookies, identifiers, and similar technologies—whether its own or from third parties—to analyze browsing behavior and offer a more personalized service tailored to your interests. Certain areas of our site also use cookies to provide customers with a personalized browsing experience. To learn more about our cookie policy, please visit www.grupocosta.mx, in the Privacy Notice section.

XIV. CHANGES TO THE PRIVACY NOTICE
INMOBILIARIA BASAC reserves the right to modify, update, or supplement this Privacy Notice at any time when necessary or as a result of regulatory changes, internal needs, or new data protection practices. Updates will be available through any of the following channels:
  1. 1. Visible notices in our offices.
  2. 2. On our website: https://grupocosta.mx/en/privacy-notice.html
  3. 3. By email.

When it is necessary to directly notify data subjects of any changes, INMOBILIARIA BASAC may do so through the available contact methods, including email, and shall not be liable if the data subject does not receive notification of the change due to a problem with the data subject’s email account or with data transmission over the Internet. The date of the last update will appear at the beginning of this Privacy Notice.

XV. CONTACT
For any questions, inquiries, comments, or requests related to the protection of your personal data, you may contact INMOBILIARIA BASAC via:

INMOBILIARIA BASAC, S.A. DE C.V.

Email: ecommerce@costarealty.com.mx

Email for ARCO requests: mgodoy@costarealty.com.mx

Phone: (998) 321 0234

Address: Avenida Bonampak, Block 3, Lot 11, Unit C-109, Interior A, Palmeras Condominium, Cancún, Benito Juárez, Quintana Roo, ZIP Code 77500, Mexico.

Sincerely;

INMOBILIARIA BASAC, S.A. DE C.V. (GRUPO COSTA)

Last updated: October 2026.