Comprehensive privacy notice

Last updated: 21-10-2025


Grupo Costa


(Inmobiliaria Basac, S.A. de C.V.)


I. In compliance with the provisions of the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and the Guidelines issued by the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI), Grupo Costa makes this Comprehensive Privacy Notice available to its clients, suppliers, employees, partners, and the general public.

The legal entities responsible for collecting your personal data will be the holding companies, subsidiaries, or affiliates under the common control of the business group "Inmobiliaria Basac", S.A. de C.V., a variable capital corporation, legally incorporated and registered in the United Mexican States, operating under the name: "Grupo Costa", designating as its registered office for all legal purposes the one located at:


Avenida Bonampak, esquina Donceles, Manzana 3, Lote 11, Local C-109 Int. A, Condominio Palmeras, Cancún, Benito Juárez, Quintana Roo, C.P. 77500.


Please be advised that any personal, asset, or financial data you have provided to this company by any means—including email, fax, forms, phone calls, contracts, mail, business cards, digital media, etc.—will be handled strictly in accordance with the principles of legality, consent, information, quality, purpose, loyalty, and responsibility.



II. DATA COLLECTED.


"Grupo Costa" collects the following personal data, including but not limited to:


  1. Identification:Name, address, nationality, place and date of birth, age, marital status, tax ID (RFC), unique population registry code (CURP), handwritten signature, official ID number, and immigration documents.
  2. Contact:Phone numbers, personal or institutional email addresses.
  3. Work and professional: Occupation, profession, position or job title, activity or line of business.
  4. Financial assets: Income, expenses, bank accounts, bank statements, credit history, real estate, public deeds, utility bills, tax receipts, guarantor or co-signer information, credit processing data.
  5. Operating data: Contracts, purchase and sale agreements, leases, contract terms, and rental amounts.
  6. Personal or professional references.

Grupo Costa does not request sensitive data, except for what is strictly necessary to comply with applicable contractual or legal obligations.



III. PURPOSES OF PERSONAL DATA PROCESSING.


"Grupo Costa" hereby informs you that the personal data you provide will be used for:


A. Primary purposes (necessary):


  1. Formalize and fulfill real estate brokerage operations (sale, lease, management, or marketing of real estate properties).
  2. Draft and formalize contracts, purchase agreements, and leases.
  3. Verify and confirm the identity, tax status, and financial solvency of the holder.
  4. Handle procedures and formalities before notaries, financial institutions, INFONAVIT, FOVISSSTE, tax authorities, and other municipal, state, or federal agencies.
  5. Assess the quality of services and fulfill the obligations arising from the legal relationship.

B. Secondary purposes (optional):


  1. Sending information about services, promotions, or properties of interest to you.
  2. Development of satisfaction studies and surveys.
  3. Follow-up contact for future real estate operations or projects.
  4. Personalized access to our web portal and digital platforms.
  5. Make our website easier to use: https://www.grupocosta.mx/

If you do not wish for your data to be processed for secondary purposes, you may state so by sending your request to: ecommerce@costarealty.com.mx.


Even if you don't end up using our real estate services, we suggest staying in our database so we can keep you updated and give you priority on our latest products and services.


Personal data will be kept under the strictest confidentiality and may not be used for any purpose other than those mentioned above, unless there is a change to this Privacy Notice.



IV. ARCO RIGHTS.


Article 28 of the LFPDPPP grants you four rights to exercise:

  1. Access your personal data held by the data controller, and be informed of the Privacy Notice and its purposes.
  2. Rectify your data if it is inaccurate, incorrect, or outdated.
  3. Cancel your personal data when you consider that it is not being used to fulfill the purposes established in this Privacy Notice.
  4. Object to the processing of your personal data regarding any of the purposes established in this Privacy Notice.

"Grupo Costa", shall not be obligated to cancel personal data in any of the cases established by law, including but not limited to the following: when it refers to the parties of a private, social, or administrative contract and is necessary for its development and fulfillment; when it must be processed by legal provision or mandate of a competent authority; when its deletion hinders judicial or administrative proceedings linked to tax obligations, the prosecution of crimes, or the updating of administrative sanctions; when it is necessary to protect the legally protected interests of the data subject; when it is necessary to fulfill a legally acquired obligation by the data subject; and when it is subject to processing in accordance with the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin (LFPIORPI) and other applicable regulations regarding the prevention of money laundering and terrorist financing.

In these cases, personal data will be kept only for as long as necessary to comply with the relevant legal obligations, applying the administrative, technical, and physical security measures required for its protection.



V. OPTIONS AND MEANS TO LIMIT THE USE OR DISCLOSURE OF DATA.


We also inform you that the personal data provided to "Grupo Costa" is duly protected through technological, physical, and administrative security measures, preventing its improper use or disclosure.


To limit the use or disclosure of your personal information, the owner may:


  1. Send your request to ecommerce@costarealty.com.mx; o
  2. Sign up for PROFECO's Public Registry to Avoid Advertising (REPEP): www.profeco.gob.mx.


VI. PROCEDURES FOR EXERCISING ARCO RIGHTS AND REVOCATION OF CONSENT FOR THE PROCESSING OF YOUR DATA.


To exercise your rights of Access, Rectification, Cancellation, and Opposition or your right to revoke consent for the processing of your personal data, you must submit a free-form written request stating your claims regarding the misuse or rectification of your personal data to the following email address: mgodoy@costarealty.com.mx, along with a copy of an official ID and complying with the requirements set forth in Article 29 of the LFPDPPP regulations. Alternatively, you may submit your written request in person, in Spanish, in accordance with the requirements established in the aforementioned article at the address specified in section (I) of this Privacy Notice. A response will be issued within a maximum period of 5 business days, indicating whether the request is granted or denied as provided by the LFPDPPP.



VII.    DATA TRANSFER.


The personal data provided to us will not be disclosed or shared with third parties at any time; for the purposes of this Privacy Notice, the following cases shall not be considered third parties:


  1. With affiliates or subsidiaries within the same corporate group.
  2. With real estate offices, associate agents, or members of a real estate association for brokerage operations.
  3. With banking institutions, notary publics, law firms, or accounting firms.
  4. With real estate marketing platforms (for example: Inmuebles24, Vivanuncios, internal CRMs).
  5. With competent authorities, when required by court order or legal provision.

Furthermore, data may only be shared for the purpose of collaborating on the necessary arrangements for real estate brokerage activities involving the purchase, sale, leasing, or management of real property.


Any third parties to whom your personal data is transferred shall be bound by the same terms of this Privacy Notice and shall comply with the corresponding security and confidentiality measures.


Likewise, we are obliged to transfer your personal data to third parties without your consent, under the principles of legality, consent, information, purpose, loyalty, proportionality, and responsibility, solely for the cases established in article 37 of the LFPDPPP, as well as to carry out said transfer under the terms of the aforementioned Law.



VIII. REVOCATION.

The data subject may revoke their consent for the processing of personal data at any time, in accordance with Article 8 of the LFPDPPP, and must, solely for such purposes, send their request via a written statement to the Personal Data Controller: Ms. Margarita Godoy Ávila, either by courier to the address or to the email mentioned in section (VI) of this Privacy Notice.


The personal data owner is also informed that "Grupo Costa", will have a period of 7 calendar days to address your request; the response will provide information regarding the request's merits.



IX.COOKIES.


"Grupo Costa" uses its own and third-party cookies to analyze your browsing habits and offer you a more personalized service tailored to your interests. Certain areas of our site also use cookies to learn more about you in order to provide a personalized browsing experience. If you would like to know our Cookie Policy, you can consult www.grupocosta.mx in the privacy notice section.



X. CONSENT OF THE DATA SUBJECT.


In accordance with the provisions of Article 8 of the LFPDPPP, it shall be understood that the data subject tacitly consents to the processing of their personal data when, having been provided with this Privacy Notice, they do not expressly state their opposition.



XI. CHANGES TO THE PRIVACY NOTICE.


We reserve the right to modify or update this Privacy Notice at any time, whether due to regulatory changes, internal needs, or new data protection practices. Updates will be made available through any of the following means:


  1. Signs posted in our facilities.
  2. On our website.
  3. We will send them to the last email address you provided us.

We will not be held responsible if you do not receive notification of changes to the Privacy Notice due to any issues with your email account or internet data transmission.


Sincerely

"Grupo Costa"

Inmobiliaria Basac, S.A. de C.V.

Data Controller: C.P. Margarita Godoy Ávila

ecommerce@costarealty.com.mx | Tel: (998) 321 0234