Privacy Notice

COLDWELL PACIFIC, S. DE R.L. DE C.V.
Last updated: October 22, 2026

1. Identity and address of the Responsible Party

COLDWELL PACIFIC, S. DE R.L. DE C.V., doing business as Coldwell Banker La Costa (the “Responsible Party”), with its address at Condominio Marina Las Palmas II, Calle Ancla, Local 24, Marina Vallarta, Puerto Vallarta, Jalisco, C.P. 48335, Mexico, is responsible for the processing of the personal data you (the “Data Subject”) provide to us, under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties published in the Official Gazette (Diario Oficial de la Federación) on March 20, 2025 (the “Law”) and other applicable rules.

Contact for any matter related to your personal data: connect@cblacosta.com · Phone +52 322 223 0055.

2. Who this Notice applies to

This Notice applies to the people whose personal data we process in the course of our real estate business:

• Property owners and sellers who hire us to market a property or business.
• Buyers, prospects and clients interested in buying a property through us.
• Website visitors at www.cblacosta.com who complete a form, register, request information or a showing, or subscribe to our newsletter.

3. Personal data we collect

Depending on your relationship with us, we may collect the following personal data:

• Identification and contact: full name, email address, phone number, notification address, country of residence and nationality.
• Transaction data: occupation, marital status and spouse’s name, Mexican tax ID (RFC), copy of official ID, power of attorney documentation, names and addresses of legal representatives and beneficiaries, and the information needed to set up or assign a bank trust (fideicomiso).
• Property data (owners): copy of the public deed or title, property tax bill, and the property’s location, dimensions, layout and features.
• Buying interest (buyers and prospects): properties of interest, areas, approximate budget, planned form of payment and search preferences.
• Browsing data: IP address, device and browser type, pages visited, searches on the site and information collected through cookies and similar technologies (see section 7).

We do not request sensitive personal data, such as racial or ethnic origin, health, religious beliefs, political affiliation or sexual preference. If you provide it voluntarily, we will process it under the Law and only with your express written consent.

If you give us personal data about third parties (for example, your spouse, beneficiaries or legal representatives), you confirm that you are authorized to do so and that you have informed them of this Notice. You are responsible for the accuracy of the data you provide.

4. How we obtain your data

• Directly from you: through real estate services contracts, website forms, email, phone calls, messaging (including WhatsApp) and at our offices.
• Automatically: through cookies and similar technologies when you use our website.
• From other sources: real estate agents who refer you, real estate portals where you request information about our properties, and the VALLARTA-NAYARIT MLS multiple listing system (the “MLS”). When we obtain your data indirectly, we will make this Notice available to you at our first contact.

When an owner hires us to market a property under the Real Estate Services with Exclusive Rights Contract, we submit to the MLS a copy of that contract, the property’s location, dimensions, type and features, the first page of the public deed showing the owner’s data, the property’s legal description and registration information, and the most recent property tax bill. The MLS uses this information only to verify that the Data Subject is the legal owner or has sufficient authority to sell.

5. Purposes of processing

Primary purposes. These are necessary for the relationship you request with us and do not require your consent:

1. Responding to your requests for information, showings, valuations and advice.
2. Promoting and marketing your property, including publishing it on the MLS and sharing it with active members of AMPI Vallarta, AMPI Riviera Nayarit and AMPI Compostela (“AMPI”) and with internal and external real estate agents who cooperate in the transaction.
3. Identifying and presenting properties that match your search, and following up on the purchase or sale process.
4. Verifying property and ownership information with the relevant public registries.
5. Preparing and closing the transaction with Notaries Public, financial and fiduciary institutions, and escrow companies.
6. Contacting you by phone, email or messaging about the progress of your transaction.
7. Complying with legal and tax obligations, including anti-money-laundering rules, and responding to requests from competent authorities.
8. Handling your complaints, clarifications and requests about your personal data.

Secondary purposes. These are not necessary for our relationship with you and require your consent:

1. Sending you our newsletter and information about new properties, developments, events and promotions.
2. Conducting quality and satisfaction surveys.
3. Showing you personalized advertising on social media and search engines.
4. Preparing market statistics and analysis. For this purpose we use the closing price, size and general location of the property without identifying the Data Subject.

If you do not want us to process your data for some or all of the secondary purposes, you can say so in the checkbox on the form, or at any time by writing to connect@cblacosta.com with the subject “Secondary purposes”. Declining will not affect the services you request from us.

6. Transfers and service providers

To carry out the primary purposes, we may transfer your personal data, within or outside Mexico, to the following third parties:

• Notaries Public, to prepare and execute deeds.
• Financial institutions, including fiduciary and custodial institutions, to set up or assign bank trusts and handle payments.
• Escrow companies, some of them located in the United States, to hold deposits and transaction payments.
• The MLS and AMPI member agents who cooperate in the transaction, to promote the property or complete the sale.
• Competent authorities, when required by law or by an authority’s order.

These transfers are necessary to enter into or perform the legal relationship between you and the Responsible Party, or are required by law, so they do not require your consent under the Law. Third parties who receive your data assume the same obligations as the Responsible Party regarding its processing. The Responsible Party does not sell your personal data and does not transfer it to third parties for those third parties’ own advertising purposes.

We also share data with service providers that process it on our behalf, under contract and following our instructions, including: Real Geeks (website and client management system, USA), Mailchimp (newsletter delivery, USA), and Google, Meta and Microsoft (web analytics and advertising). These providers may not use your data for their own purposes.

7. Cookies and similar technologies

Our website uses cookies, pixels and similar technologies to operate, to remember your preferences and saved searches, and to analyze site use and the effectiveness of our advertising. These include Google Analytics, Google Tag Manager, the Meta pixel, Microsoft Clarity and FullStory. These tools may collect your IP address, device and browser type, pages visited, time on site and approximate location.

You can disable or delete cookies in your browser settings. If you do, some site features may not be available.

8. ARCO rights

You or your legal representative may at any time exercise your rights to:

• Access: know what personal data we hold and how we process it.
• Rectification: correct inaccurate or incomplete data.
• Cancellation: ask us to delete your data when it is no longer necessary or has been processed improperly.
• Opposition: object to the processing of your data for specific purposes.

To exercise them, send your request to our Personal Data Protection Department by any of these means:

1. Email: connect@cblacosta.com
2. Mail, courier or delivery at our office: Condominio Marina Las Palmas II, Calle Ancla, Local 24, Marina Vallarta, Puerto Vallarta, Jalisco, C.P. 48335.

Your request must include:

• The Data Subject’s full name.
• An address or email to receive our response.
• A clear description of the personal data and the right you wish to exercise.
• Any document that helps locate your data.
• A copy of valid official ID and, if applicable, proof of legal representation.

We will respond within 20 business days of receipt. If your request is granted, we will carry it out within 15 business days of our response.

9. Revoking consent

You may revoke at any time the consent you have given us to process your data, by sending a request through the same means and with the same requirements described in section 8. In some cases we may not be able to process the revocation immediately, for example when the processing is needed to meet a legal obligation or a current contract; if so, we will tell you.

10. Limiting the use or disclosure of your data

• You can stop receiving our emails at any time using the “unsubscribe” link in each message.
• You can ask us to stop contacting you by phone, text, email or postal mail by writing to connect@cblacosta.com. We will add you to our internal exclusion list.
• You may demand at any time that information about you not be given or transmitted to third parties for marketing or advertising purposes, and that we not send you advertising.
• You can register your phone number, free of charge, in the Public Registry to Avoid Advertising (REPEP) of Mexico’s Federal Consumer Protection Agency (PROFECO).

11. Security and retention

We treat your personal data as confidential and maintain administrative, technical and physical security measures to protect it against damage, loss, alteration, destruction or unauthorized use, access or processing. We keep your data only as long as needed for the purposes of this Notice and the periods required by applicable law; we then delete or block it securely.

12. Exceptions to consent

Under the Law, there are cases in which your consent is not required to process your personal data, for example when the processing is necessary to meet obligations arising from a legal relationship with you or when a law requires it.

13. Changes to this Notice

We may change this Notice because of legal changes, changes to our services or changes to our privacy practices. Any change will be posted on this page with its new update date. If a change means processing your data for a purpose not described here, we will tell you by email and, when the Law requires it, ask for your consent again.

14. Authority

If you believe your right to the protection of your personal data has been violated, you may contact the Secretaría Anticorrupción y Buen Gobierno, the competent Mexican authority.

Coldwell Banker La Costa is operated by COLDWELL PACIFIC, S. DE R.L. DE C.V. The Spanish version of this Notice is the original and prevails over any translation. For questions, write to connect@cblacosta.com.