This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you visit our website, make inquiries, or book a stay/experience (the “Services”).
1) Information We Collect
- Identifiers & Contact: name, email, phone, postal address, country of residence.
- Booking Details: travel dates, party size, preferences, dietary needs, special requests, flight details (if provided), transfer needs.
- Payment Information: cardholder name and billing details. Card numbers are processed by our payment processor and are not stored by us.
- Government/License Details (optional/where required): fishing licenses, passport details needed to arrange services or comply with law.
- Communications: messages, surveys, reviews, and support requests.
- Device/Usage Data: IP address, device type, browser, pages viewed, time on site, referring URLs, and general location (via IP).
- Cookies & Similar Tech: pixels, tags, and SDKs for essential site function, analytics, and (where applicable) advertising.
2) How We Use Information
- Provide, manage, and confirm bookings, payments, and on-site services.
- Arrange third-party services (e.g., transfers, guiding, equipment), and communicate itinerary updates.
- Respond to inquiries and provide customer support.
- Send operational messages (confirmations, reminders) and, with your consent or as permitted by law, marketing communications.
- Improve our website, Services, and guest experience; perform analytics and monitor performance.
- Detect, investigate, and prevent fraud, security incidents, and abuse; comply with legal obligations.
3) Sharing of Information
We may share personal information with:
- Service Providers/Processors: booking platforms, payment processors, transfer operators, guides, IT/hosting, analytics, and customer support vendors under contractual confidentiality.
- Affiliates/Business Transfers: in connection with corporate transactions or restructuring.
- Legal/Compliance: where required by law, regulation, or valid legal request, or to protect rights, property, or safety.
We do not sell personal information. We do not share for cross-context behavioral advertising unless disclosed in our cookie banner and you consent where required.
4) International Transfers
We operate in Mexico and may process data in Mexico, the United States, and other countries. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) for transfers to countries without equivalent data protection.
5) Data Retention
We retain personal information as needed to provide the Services, for legitimate business purposes (e.g., tax/accounting), to resolve disputes, and to comply with law. Retention periods vary by data type and purpose.
6) Your Rights
Depending on your location, you may have rights over your personal information:
- EU/UK (GDPR): access, rectification, erasure, restriction, portability, and objection; right to withdraw consent; right to lodge a complaint with your supervisory authority.
- Mexico (LFPDPPP – ARCO rights): access, rectification, cancellation, and objection to processing; withdraw consent; limit use or disclosure.
- US (e.g., California): right to know/access categories and specific pieces of personal information, deletion, correction, and to opt-out of certain sharing; non-discrimination for exercising rights.
To exercise rights, contact us at [privacy email]. We may request information to verify your identity and will respond within the time required by applicable law. Authorized agents may submit requests where permitted.
7) Cookies & Tracking
We use essential cookies for site operation and, with consent where required, analytics and advertising cookies. You can manage preferences via our cookie banner or your browser settings. Disabling certain cookies may affect site functionality. We do not respond to “Do Not Track” signals at this time.
8) Security
We implement reasonable technical and organizational measures to protect personal information, but no method of transmission or storage is completely secure.
9) Children’s Privacy
Our Services are not directed to children under 16 (or the age defined by your jurisdiction). We do not knowingly collect personal information from children. If we learn we have done so, we will delete it promptly.
10) Third-Party Links & Services
Our Services may link to or integrate with third-party sites or services (e.g., booking platforms, payment processors, transportation providers). Their privacy practices are governed by their own policies.
11) Changes to this Policy
We may update this Policy. The “Effective date” shows when it was last revised. Material changes will be posted on this page and, where required, notified to you.
12) Contact
Questions or requests regarding privacy:
The Xflats
Camino Costero Mahahual KM 54, 77970 Xcalak, Q.R., Mexico
+1-863-632-2672
