Privacy Notice for Hosts

Courtesy translation. In the event of any discrepancy, the Spanish version shall prevail.

1. Data controller

KORU HOLDING, S.A.S., the company that operates the KORU brand, with address at Marie Curie 303, interior C13, Reforma y Ferrocarriles Nacionales, Toluca de Lerdo, Estado de México, C.P. 50070, is the data controller responsible for processing your personal data, in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Mexican Federal Law on the Protection of Personal Data Held by Private Parties).

Privacy contact: legal@korurent.com

This notice applies to those who offer spaces on KORU Room (“Hosts”), to their legal representatives and to the members of their team. If you also rent or stay with KORU, your data as a customer is governed by the Customer Privacy Notice.

2. Data we process

• Identification and contact: name, date of birth, nationality, CURP (Mexican population registry code), address, email, phone number and profile photograph (optional).
• Data from your INE: name, date of birth, CURP and verification result.
• If you act for a company: company name, details of the legal representative and, when KORU requests them, the documents evidencing their powers.
• Tax data: RFC, tax regime, tax postal code and Constancia de Situación Fiscal.
• Bank and financial data: bank, CLABE, account holder, and your collections, commissions, withholdings and payouts.
• Space data: exact address, location on the map, type of place, capacity, prices, rules, calendar, check-in instructions and the safety and camera declaration.
• Photographs of the space and, where applicable, of damage or incidents.
• Property documents, when KORU requests them: title or authorization from the owner or landlord, permits, licenses and local registrations.
• Data on your stays: bookings, messages with guests, cancellations, claims, reviews, acceptance rate and response time.
• Evidence of the electronic signature: date, time, IP address, device and location at the time of signing.
• Dashboard usage data: IP address, device, browser and activity log.
• Communications with our team.

Bank and financial data require your express consent, which you give when you register your account and sign the Host Agreement.

3. Biometric data (sensitive data)

To verify your identity, Didit compares a photograph of your face (liveness check) with the one on your INE. These biometric data are sensitive personal data, so they are processed only with your express written consent, which you give by electronic means on the verification screen before starting it.

Didit captures and processes the images on its own platform. KORU keeps only the verification result and the document data needed for the agreement, not the images of your face.

If you do not give this consent, we will not be able to register you as a Host.

4. What we use your data for

Purposes necessary for the service:

• Creating and managing your account and your team’s accounts.
• Verifying your identity and preventing fraud.
• Preparing, signing and keeping the Host Agreement.
• Reviewing and publishing your spaces. The exact address is shared only with the guest who has a confirmed stay.
• Managing bookings, collections, commissions, payouts and refunds.
• Handling incidents, damage and claims, and applying the breaches and consequences of the Terms for Hosts.
• Withholding and remitting taxes, issuing tax receipts and complying with reporting obligations to the authorities.
• Sending you notices about your stays, your account and changes to the legal texts.
• Maintaining the security of the Platform.

Additional purposes (you may object without affecting the service):

• Sending you promotions, news and tips for your listings.
• Using the photographs and descriptions of your spaces in KORU’s advertising outside the Platform.
• Measuring use of the dashboard to improve it, with analytics cookies that are activated only if you accept them.
• Measuring and improving our advertising campaigns on Meta and Google, with advertising cookies that are activated only if you accept them.
• Asking for your opinion about the service.

To object to the additional purposes, write to legal@korurent.com. For analytics and advertising cookies, simply reject that category in the cookie banner.

5. Who we share your data with

We share your data, without the need for your consent, when necessary to perform the agreement or to comply with the law:

• With guests: your name or your business name, your profile photograph, the listing information and, once the stay is confirmed, the exact address, the check-in instructions and a means of contact.
• With Stripe: your identity, tax and bank data, to open your payments account and transfer your collections to you. Stripe verifies your identity and your account and also processes that data in accordance with its own privacy notice.
• With the partner insurer and its adjusters, if there is coverage for your stay: to issue it and handle claims.
• With tax authorities: the Servicio de Administración Tributaria (SAT) and the state tax authorities, to which the law requires us to report your name, RFC, CURP, tax address, bank and CLABE, the amount of your transactions and the address of the property.
• With tourism authorities and other competent authorities, when local law requires platforms to report properties and their occupancy, or when they require it by law or court order.

Only with your consent, which you give by accepting advertising cookies:

• With Meta Platforms, Inc. and Google LLC, based in the United States: identifiers of your browser and the actions you take on the site, to measure our campaigns.

We do not sell your personal data.

6. Providers that process data on KORU’s behalf

These providers use your data only to provide us with the contracted service:

• Didit: identity verification, liveness check and phone confirmation.
• Supabase: database, authentication and file storage. Photographs and documents are kept in private storage.
• Vercel: website hosting and performance measurement.
• Resend: sending transactional emails.
• Timestamping provider: receives the digital fingerprint of the agreement, not its content, to seal the date and time of signing.
• Upstash: abuse control and usage limits of the Platform.
• KORU HOLDING LLC (Delaware, United States), a KORU company: operates our applications on Meta, TikTok and Google, only on our instructions.
• Google and Apple: sign-in, if you choose that option.

Some of these providers store information on servers outside Mexico, mainly in the United States, with contractual security measures.

7. How long we keep your data

• Agreements, payouts, withholdings and tax receipts are kept for up to 10 years, due to the obligations under the Código de Comercio (Mexican Commercial Code) and the Código Fiscal de la Federación (Mexican Federal Tax Code).
• Account data and data on your spaces are kept while the account is active. When it is closed, they are blocked and deleted when the legal periods end.
• Photographs and evidence of incidents are kept for as long as they may be needed to clarify damage or claims.
• The record of breaches is kept for up to 72 months.

8. Your rights (ARCO) and how to exercise them

You may access your data, rectify it, cancel it or object to its processing, as well as limit its use or disclosure.

Send your request to legal@korurent.com with:

• Your name and your account email.
• A copy of your ID (or that of your representative and the document evidencing their authority).
• The right you wish to exercise and the data it refers to.

We will respond within a maximum of 20 business days and, if appropriate, will give effect to it within the following 15 business days.

Some data cannot be cancelled while there is a legal obligation to keep it. For example, a signed agreement and its signature evidence cannot be modified or deleted; in that case we block it and use it only to comply with the law or defend rights.

If you believe your rights were not respected, you may contact the personal data protection authority, the Secretaría Anticorrupción y Buen Gobierno.

9. Withdrawal of consent

You may withdraw the consent you gave us at any time, without retroactive effect, by writing to legal@korurent.com with the same details as in section 8. We will respond within the same periods.

If you withdraw your consent for data that are necessary for the service, such as biometric, tax or bank data, we will not be able to keep you as a Host. Confirmed stays are honored and the data the law requires us to keep are blocked.

10. Cookies and similar technologies

We use cookies and local storage necessary for the website and the dashboard to work and, only with your consent, analytics and advertising cookies. See the details in the Cookie Policy for Providers. You can change your choice at any time from the “Cookies” link at the bottom of the page.

11. Security

We apply administrative, technical and physical measures to protect your data: encryption in transit, profile-based access control, activity logging and provider review. If a breach occurs that significantly affects your rights, we will inform you without delay so that you can take action.

12. Data of other people

If you give us data of other people, such as members of your team, the owner of the property or your legal representative, you must have informed them of this notice and have their permission.

The guest data you receive for each stay are not yours: you process them under the confidentiality rules of the Host Agreement.

13. Changes to this notice

We will publish any change on this page with its update date. If the change affects the purposes or requires new consent, we will inform you by email or in your dashboard and ask you to accept it.