Privacy Policy

1 Identity and Address of the Controller

Marietas Vallarta Tours, with its physical address at Marina de Punta de Mita, Bahía de Banderas, Nayarit, C.P. 63734, Mexico, is the legal controller responsible for the processing of the personal data you provide to us.

This policy complies with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), as well as the General Data Protection Regulation (GDPR) of the European Union and the California Consumer Privacy Act (CCPA/CPRA) to protect our international clients.

Privacy Officer Contact: info@marietasvallartatours.com

2 Personal Data We Collect

To operate our tours and process your booking, we collect the following categories of data:

• Identity and Contact Data: Full name, email address, phone number/WhatsApp.
• Booking Data: Tour date, number of guests, preferred time, medical or emergency notes (if you choose to provide them).
• Payment Data: Processed 100% by Stripe, Inc. We DO NOT store, see, or have access to your full credit card numbers, CVV codes, or expiration dates.
• Browsing Data (Cookies): IP address, browser type, device, pages visited, and visit duration.

Sensitive Data: We do not collect sensitive personal data (ethnic origin, detailed health status, religious beliefs, sexual preference). Any medical note you share with us (e.g., "I am allergic to shellfish" or "I am pregnant") is voluntary and will be used solely for your safety on board.

3 Purposes of Processing

3.1 Primary Purposes (Necessary for the service)

• Process, validate, and confirm your booking and payment.
• Send you the confirmation email, meeting point location, and safety instructions.
• Send you weather updates or rescheduling notices (via WhatsApp or email).
• Comply with tax, accounting, and regulatory obligations (invoicing).
• Ensure the safety of the crew and passengers on board.

3.2 Secondary Purposes (Optional)

• Send you promotions, discounts, or information about new tours.
• Conduct post-tour satisfaction surveys.

You may object to secondary purposes at any time by sending an email to info@marietasvallartatours.com or replying "STOP" on WhatsApp.

4 Data Transfer to Third Parties

To operate the website and tours, we share strictly necessary data with the following providers:

• Stripe, Inc. (USA): For secure payment processing (PCI-DSS Level 1).
• Hostinger (International): Web hosting and database provider.
• Google Analytics and Microsoft Clarity: For statistical analysis and user experience improvement.
• Maritime Authorities (Harbor Master/SEMARNAT): Solely for passenger registration and CONANP pass processing when required by law.

We never sell, rent, or trade your personal data with third-party marketing agencies.

5 Your Rights (ARCO, GDPR, and CCPA)

Depending on your country of residence, you have the following rights regarding your data:

6 Data Retention and Storage

We retain your personal data for the time necessary to fulfill the purposes described:

• Booking and Invoicing Data: 5 years (due to tax and accounting obligations in Mexico).
• Contact and Marketing Data: Until you request to opt-out (unsubscribe).
• Browsing Data (Cookies): Maximum 14 months (Google Analytics).
• WhatsApp/Support Messages: 1 year.

Once the term is fulfilled, the data will be securely and irreversibly deleted or anonymized.

7 Use of Cookies and Tracking Technologies

Our website uses cookies to ensure the functioning of the shopping cart and for analytical purposes. We do not use aggressive advertising cookies.

• Essential Cookies: Keep your session active, the security token (CSRF), and the payment process.
• Third-Party Cookies (Payments): Stripe uses cookies (__stripe_mid, __stripe_sid) for fraud prevention and payment validation.
• Analytical Cookies: We use Google Analytics (GA4) and Microsoft Clarity to understand how users navigate, what pages they visit, and how we can improve. This data is anonymous.

You can disable analytical cookies from your browser settings (Chrome, Safari, Firefox). If you block essential cookies, the payment process may not work.

8 Security Measures

We implement industry-standard technical and administrative measures to protect your data:

• Encryption in Transit: HTTPS connection with SSL/TLS 1.2 or higher certificate throughout the site.
• Secure Payments: Card tokenization via Stripe (PCI-DSS Level 1).
• Infrastructure: Database with restricted access, hashed passwords, and prepared statements to prevent SQL injection.
• Access: API keys and database credentials stored outside the server's public directory (.env files).

9 Minors

Our services are not directed to minors under 18 years of age without the supervision of an adult. We do not knowingly collect personal data from minors. If a parent or guardian books a tour for a minor, the adult assumes full responsibility for the minor during the tour and consents to the use of the minor's data for operational and safety purposes (e.g., life jackets).

10 Changes to this Policy

We reserve the right to update this policy at any time due to legal or business changes. The current version will always be the one published on this page, indicating the date of last update. If we make substantial changes, we will notify you by email if you have an active booking.

11 Data Protection Authorities

If you believe your rights have been violated, you have the right to contact the authority of your country of residence:

• Mexico: National Institute for Transparency, Access to Information and Personal Data Protection (INAI) - https://home.inai.org.mx/.
• European Union: You may file a complaint with the Data Protection Authority (DPA) of your country of residence.
• California, USA: The California Attorney General's Office.

12 Contact

If you have questions about how we handle your personal data, or wish to exercise your rights, contact us directly: