Privacy Notice

1. Identity and address of the data controller

NIGHTCODE GROUP, S.A.P.I. de C.V. (hereinafter "Reservándonos," "the Company," or "the Controller"), with Federal Taxpayer Registry (RFC) number NGR150515496 and address at Homero 1804, floor 13, Polanco I Sección, Miguel Hidalgo borough, C.P. 11510, Mexico City, is responsible for the processing and protection of your personal data. Reservándonos is the commercial brand under which a restaurant reservation and technology services platform operates through www.reservandonos.com, its mobile applications, and its customer service channels.

This notice is issued in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties and other applicable provisions.

2. Personal data we process

3. Reservation notes and sensitive personal data

The platform includes an optional notes or comments field. You freely decide whether to use it and what information to provide. This content may include sensitive personal data, such as allergies, intolerances, health conditions, accessibility requirements, or dietary restrictions that could reveal religious beliefs.

When you include sensitive information in the notes, the platform will display an informational notice and, by clicking "Confirm reservation," you expressly authorize Reservándonos to process that information and transmit it exclusively to the selected restaurant to fulfill your request. Reservándonos retains electronic evidence of the confirmation action, the applicable version of this notice, the date and time, and the recipient restaurant.

• We do not use notes for advertising, segmentation, profiling, or building consumer profiles.
• We do not share notes with advertisers or with restaurants other than the one selected.
• We do not create health databases or store medical data as a permanent profile preference.
• Internal access to notes is limited to personnel who need it to operate the reservation and is subject to access controls.
• You may make a reservation without completing the notes field and communicate any need directly to the restaurant.

4. Call recording and automated systems

Some calls to our customer service center may be recorded for quality, training, and record-keeping purposes related to the request made. At the start of the call, you will be informed that it may be recorded. If you do not wish to continue on a recorded channel, you may request assistance through a written channel.

Recordings are ordinarily kept for six months and are then securely deleted, unless they must be retained longer to address a clarification, dispute, security incident, or a requirement from an authority.

Reservándonos may use automated systems to manage reservations and inquiries. When reasonably necessary, such systems will be identified as automated and will allow you to request assistance from a person.

5. Primary purposes

• Create, authenticate, and manage user accounts when a user decides to register.
• Enable reservations both with and without an account; manage, confirm, modify, and cancel reservations.
• Transmit to the selected restaurant the information necessary to fulfill the reservation and any requests communicated.
• Process payments through Stripe and its associated services without storing full card data.
• Use the location authorized by the user or the selected city to show relevant restaurants and options.
• Send confirmations, reminders, and changes by email, WhatsApp, SMS, or push notifications, depending on the channel available.
• Request reviews or ratings related to a visit or service used.
• Address questions, complaints, requests, and incidents.
• Prevent fraud, misuse, and unauthorized access, and protect the security of the platform.
• Comply with legal, tax, contractual obligations and requirements from authorities.

6. Secondary purposes

• Send promotions, news, and restaurant recommendations.
• Conduct satisfaction surveys and quality studies.
• Develop usage statistics and behavior analysis and personalize recommendations.
• Invite you to events, dining experiences, and benefit programs.

These purposes are not necessary to provide the service. You may decline them or withdraw your consent from your preferences, using the opt-out mechanism included in commercial communications or by writing to [email protected].

7. Source of the data

• Directly from you when you register, make a reservation, post a review, or contact Reservándonos.
• Automatically when browsing or using the app, through cookies, technical identifiers, and device permissions.
• From affiliated restaurants, when they update availability, attendance, or the status of a reservation.
• From technology providers when necessary to confirm a transaction, for example the status of a payment.

8. Transfers, disclosures, and third parties

8.1 Restaurants and providers necessary for the service

We transmit to the selected restaurant the data strictly necessary to manage your reservation. These communications are made to carry out the service you requested.

8.2 Technology providers

Some providers may process information outside of Mexico, mainly in the United States and other locations where their infrastructure operates. Reservándonos adopts reasonable contractual and organizational measures to require confidentiality, security, and processing consistent with applicable law.

Certain providers, particularly payment processors and advertising platforms, may act as independent controllers with respect to certain processing activities under their own privacy notices.

9. ARCO rights and withdrawal of consent

You may exercise your rights of Access, Rectification, Cancellation, and Objection (known as ARCO rights in Mexico), as well as withdraw your consent where applicable.

1. Send your request to [email protected] or submit it at the Controller's address.
2. Provide your name and a way to communicate the response to you.
3. Prove your identity or representation through a reasonable means proportional to the request.
4. Describe the data and the right you wish to exercise, as well as any information that helps locate it.

A determination will be communicated within the twenty business days following receipt of the request and, if applicable, will be carried out within the following fifteen business days. These periods may be extended once for an equal period when justified.

10. Limiting use or disclosure

You may request to be added to our exclusion list by writing to [email protected]. You may also use the opt-out mechanisms included in commercial communications and, where applicable, public registries to avoid advertising.

11. Cookies and tracking technologies

Non-essential cookies will only be activated after you accept them through the preferences panel. You may accept them, decline them, or change your choice later. Disabling strictly necessary cookies may affect the platform's functionality.

12. Security measures

Reservándonos maintains reasonable administrative, technical, and physical measures, including encryption of information in transit, access controls based on least privilege, multi-factor authentication for administrative access, logging of access to production systems, confidentiality obligations, and provider reviews.

If a security breach occurs that significantly affects the rights of data subjects, it will be communicated without delay, and the notification obligations set forth under applicable law will be met.

13. Retention periods

14. Minors

Our services are aimed at individuals over eighteen years of age. Reservándonos does not intentionally seek to collect data from minors. If we detect data received without valid authorization, we will proceed to delete it where appropriate.

15. Changes to this notice

Updates will be published at www.reservandonos.com/en/privacy-policy/, indicating the update date. When a change is substantial, it will be communicated by email or through a visible notice on the platform before it takes effect, where applicable.

16. Competent authority

If you believe your right to the protection of personal data has been violated, you may contact the competent federal authority for the protection of personal data held by private parties. Before doing so, you may write to [email protected] to seek a direct resolution.

17. Effective date

Version v2.4. Last updated: September 7, 2026.