Privacy Notice

Our organization recognizes the importance of protecting your personal data, in accordance with Article 16 of the Mexican Constitution (Constitución Política de los Estados Unidos Mexicanos) and the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, “LFPDPPP”). This Privacy Notice describes how we collect, use, store, and, where applicable, transfer your personal data, as well as the rights you have as the data subject. It also includes a special section for users in the European Union in compliance with the General Data Protection Regulation (GDPR).

Identity and Address of the Data Controller

The party responsible for processing your personal data is Eduardo Abad Tinoco, domiciled in Mexicali, Baja California, Mexico, with email address (or through our contact form), who also acts as the personal data protection officer for the organization. You may contact this address for any matter related to your personal data, including the exercise of your ARCO rights.

Personal Data Collected

We collect only identification and contact personal data, as well as information necessary to provide our services, for example:

Identification data: full name and email address that you provide in our registration or contact forms.
Payment data: premium itinerary purchases are completed entirely on our provider Hotmart’s platform (Hotmart Serviços Digitais LTDA., Brazil), to which you are redirected to pay. Hotmart processes the payment and receives your card or other payment-method data; our site never receives, processes, or stores card data, CVV, or any other financial data. The only thing we receive from Hotmart, through a notification from its platform, is confirmation that a purchase was made (e.g., which product), not the payment data itself.
Site usage data: automatically, when you interact with our website we may collect technical information through cookies and other tracking technologies. This may include IP address, browser type, operating system, session identifiers, access dates and times, and data about your browsing on our pages. These tools allow us to analyze how you use the service to improve your experience. This currently consists solely of Google Analytics (see the Cookies section).
Email address to deliver your itinerary: when you request a free itinerary through our forms, we collect your email address and transmit it securely to our own system, for the sole purpose of sending you or making available the itinerary you requested.

Sensitive data: We do not request or collect personal data considered sensitive (such as data about your health, beliefs, ethnic origin, political opinions, confidential financial information, etc.) for the purposes described in this Privacy Notice. In particular, financial data such as your bank card is handled directly by Hotmart and never reaches our systems, as indicated above.

Purposes of Processing

The personal data we collect will be used for the following purposes, all related to providing and improving our services:

Providing the requested service or product:We use your data to create and manage your account, identify you as a user, provide you access to the platform, and generally fulfill the delivery of the services you request. For example, your data is used to process your purchase orders or subscriptions, and to let you use our site’s features.
Processing payments and transactions:Premium itineraries are paid for through our partner Hotmart’s checkout, which processes the charge, issues the corresponding receipt or proof of payment, and notifies us of the transaction result so we can grant you access to the purchased product.
Communicating changes and providing support: We may use your contact data to notify you about updates to the terms of service, changes to our policies, or platform improvements and news. We will also use it to respond to your questions, complaints, or requests for technical support or customer service.
Improving service quality and performing statistical analysis: We use analytics tools (such as Google Analytics) that use cookies to collect aggregated usage data. This helps us understand how users interact with the site, which sections are used most, detect performance issues, and, in general, assess and improve the quality of our services. Internal studies for statistical purposes are performed with de-identified data that does not allow specific users to be identified.
Measuring and analyzing usage: With your consent, we use Google Analytics to understand which destinations and itineraries generate the most interest and how often purchase buttons are clicked, in order to improve our catalog and the site experience. We do not use this information to build advertising profiles or combine it with ad networks.
Communications about your request: If you give us your email to obtain an itinerary, we use it to deliver it and, where applicable, to follow up on that specific request.
Newsletters and email marketing:If, when requesting a free itinerary, you expressly and voluntarily check the “I’d like to receive itinerary updates, promotions, discounts, and new destination launches” box, we will use your email address to send you that kind of communication through our email delivery provider, Brevo (see “Transfer of Data to Third Parties” below). This consent is independent and separatefrom the one you give us to receive the itinerary: if you don’t check the box, we will only send you the itinerary you requested. Every marketing email includes an unsubscribe link managed directly by Brevo; you can unsubscribe at any time without affecting the delivery of itineraries you have already requested.
Compliance with legal obligations: In some cases, we may need to process your data to comply with legal obligations or requirements from government authorities. For example, tax laws, accounting requirements, or to respond to court orders requiring us to disclose certain information.

We will never use your personal data for purposes that are different, incompatible, or unrelated to those described above without obtaining your additional consent. If in the future we need to use your data for different purposes, we will inform you through the contact methods you have provided and, if necessary, request your prior consent.

Use of Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to distinguish you from other users, provide you with a better experience, and collect information about how you browse our content. Cookies are small text files stored on your device when you visit a website, which allow us to remember your preferences and activities.

Specifically, we use our own and third-party cookies for the following purposes:

Necessary cookies: These are essential for the basic operation of the site (for example, to keep you signed in or remember the contents of your shopping cart). Without these cookies, certain features may not be available.
Analytics and performance cookies: We work with Google Analytics to collect aggregated statistical data about site usage, such as the most visited pages, the time spent in each section, the type of device or browser used, etc. These cookies help us measure traffic and usage patterns on our site so we can improve its performance and content. This is the only non-essential tracking technology we currently use; we do not use advertising cookies or social media pixels.

Consent banner: The first time you visit the site, you are shown a banner where you can accept or declineanalytics cookies. Until you consent, Google Analytics does not load or collect any data. You can change your choice at any time from the “Cookie preferences” link in the site footer.

Please note that Google will also have access to the information collected by its cookies once you accept, and processes it in accordance with its own privacy policy. You may consult Google’s privacy policy on its official site to learn more about how it uses the collected information.

Opt-out options:In addition to the consent banner, you may disable or delete cookies at any time through your web browser’s settings. Most browsers let you refuse new cookies, be notified when you receive a new cookie, or delete existing cookies. Check your browser’s “Help” section to learn how to enable these options.

Transfer of Data to Third Parties

To carry out our operations and provide our services, in some cases we share your personal data with third-party service providers, who act as processors or third-party recipients of the data. Some of these third parties are located outside Mexico, so this involves international data transfers. Below are the main recipients and the purpose of these transfers:

DigitalOcean, Inc. (U.S.): Provider of hostingand cloud storage services. Our servers and database are hosted on DigitalOcean’s infrastructure, so your data may be processed and stored in data centers outside Mexico (mainly in the United States).
Google LLC – Google Analytics (U.S.): We use Google Analytics, only if you consent through the cookie banner, for site metrics analysis. This means certain data (such as your IP address, cookie identifiers, device information, and browsing events) may be transmitted to Google and processed on its servers in the United States, in accordance with its privacy policies. We do not use Google AdSense or any other Google advertising product.
Google LLC – reCAPTCHA (U.S.): We use reCAPTCHA on our contact form and on the free-itinerary request form, to prevent spam and automated abuse. reCAPTCHA invisibly analyzes certain technical data (such as your IP address and interaction with the page) and sends it to Google to calculate a trust score; it does not require you to solve any visible challenge. Unlike Google Analytics, this tool is considered necessary for form security and therefore always runs, without depending on the cookie consent banner.
Hotmart Serviços Digitais LTDA. (Brazil): Checkout and payment processingplatform for our premium itineraries. When you click a premium itinerary’s purchase button, you are redirected off our siteto Hotmart’s checkout, which directly collects and processes your payment data and grants you access to the purchased product in accordance with its own privacy policy. We only receive a notification from Hotmart that the purchase was made, for record-keeping and support purposes.
Brevo (Sendinblue SAS, France/EU): Our email delivery provider, used only if you checked the marketing box when requesting a free itinerary, to send you newsletters, promotions, discounts, and news about new destinations. Brevo receives your email address and certain consent metadata (date and source of the request), and manages delivery, sender reputation, and the unsubscribe link included in every email. Because Brevo/Sendinblue SAS is based in the European Union, this transfer takes place under a level of data protection equivalent to or higher than what Mexican law requires.

These data transfers are carried out solely for the necessary purposes described above (service delivery, analytics, marketing, and payment processing). In all cases, we ensure that the receiving third parties assume contractual obligations of confidentiality and personal data protection consistent with this Privacy Notice and applicable law. Under Mexican law, transfers to these providers do not require the data subject’s additional consent because they fall within the exceptions of Article 37 of the LFPDPPP (as they are necessary for the legal relationship with the data subject or for compliance with contractual obligations, among others).

Additionally, when we transfer personal data to third parties located abroad, especially outside Mexico, we verify that adequate levels of data protection exist. In the case of transfers of data belonging to users residing in the European Union (see the GDPR section below), we implement standard contractual clauses or other approved legal mechanisms to ensure the legality of the transfer and the protection of your data. If you would like more information about the specific safeguards applicable to international transfers of your data, please contact us.

Except as described above, we do not share, sell, or transfer your personal data to third parties outside the service, unless we have your express consent or applicable law permits or requires it (for example, at the request of a competent authority).

Data Retention Period

The personal data we collect will be retained only for as long as necessary to fulfill the purposes for which it was obtained. In general, we will keep your data for as long as a contractual or service relationship exists with you, and as long as you have not requested its deletion or cancellation. Once the purposes of processing have been fulfilled, or if you exercise your right of cancellation or objection and it is deemed applicable, we will delete or anonymize your personal data from our records to prevent its improper processing.

It is important to note that, in some cases, we may need to retain certain data for additional periods required by law — for example, tax obligations or accounting information — but such data will remain blocked and will only be used to comply with those legal obligations. Outside of those cases, if you request that your information be removed, it will stop being actively processed and will be securely erased from our databases within the timeframes established by applicable regulations.

ARCO Rights of the Data Subject

In accordance with Mexican data protection law, as a data subject you have the right to exercise your so-called ARCO rights, which stand for: Access, Rectification, Cancellation, and Objection. In simple terms, this gives you control over your personal information. These rights are briefly explained below:

Access: You may request to be informed which of your personal data we hold in our databases, the origin of that data, and the conditions of its processing (purposes, use, sharing, etc.). Upon verification of your identity, we will provide you with a copy of the personal data we hold about you and information related to its use.
Rectification: You have the right to request the correction or updateof your personal data if it is inaccurate, incomplete, or outdated. For example, if your name or email is misspelled or has changed, we will correct it according to your instructions and upon verification of the requester’s identity.
Cancellation: You may request the cancellation (deletion) of your data from our databases when you believe it is no longer necessary for the purposes for which it was collected, is being used for purposes you did not consent to, or your relationship with us has ended. Cancellation involves blocking and subsequently deleting your data, except where retention is necessary to comply with a legal obligation. Once cancelled, we will no longer process your personal data.
Objection: You have the right to object to the processing of your data for specific purposes, when there is a legitimate reason to do so. This means you may refuse to let us use your data in certain circumstances, for example, for advertising purposes. If your objection request is deemed applicable, we will stop processing your data for those purposes.

Additionally, you have the right to revoke any consent you have previously given us for the processing of your data, at any time you wish. This applies, for example, if at some point you authorized us to use your information for marketing purposes and later change your mind. It is important to note that revoking consent may not always take effect immediately or result in the complete cessation of processing, since there may be situations where we are legally required to continue processing certain data. We will inform you of the consequences of revoking your consent in each specific case.

How to Exercise Your ARCO Rights

To exercise any of the ARCO rights or other rights related to the protection of your personal data, the data subject (you or your duly accredited legal representative) may start a request through our contact form, addressed to Eduardo Abad Tinoco, our personal data officer. We would appreciate it if your request included the following information, so that we can handle it appropriately (we will request identification documentation by email as a second step, once we receive your request):

Full name of the data subject (and, where applicable, of the legal representative) and a contact method for us to communicate our response (for example, email or physical address).
The ARCO right you wish to exercise (Access, Rectification, Cancellation, or Objection), with a clear and precise description of the data for which you seek to exercise the right and the specific request. In the case of Rectification, please indicate the correction to be made and attach documentation supporting the change.
Document proving your identity: since our contact form does not support file attachments, we will follow up by email to request a copy of a valid official ID (voter ID, passport) of the data subject before proceeding. If acting through a representative, that same email will also request the document proving the representation (for example, a power of attorney signed before two witnesses or a notarized power of attorney, along with identification of both the data subject and the representative).
Additional information that may help us locate the data in our system (for example, the email address you registered with, the approximate date you provided your data, etc.), to speed up the search.

Once we receive your complete and duly integrated request, we will have a maximum period of 20 business days to inform you of its outcome, and if applicable, we will carry out the determination within the following 15 business days, in accordance with the LFPDPPP. We will communicate our response through the contact method you indicated (e.g., by email), sending you, as applicable, electronic copies of the requested data, confirmation of the rectification or cancellation performed, or the reasons for our refusal if the request is not deemed applicable, substantiated in accordance with the law.

If the information provided in your request is incorrect or insufficient, or the necessary documents are not attached, within the 5 business days following receipt of your request we will notify you of this so you can correct the deficiencies. In that case, you will have 10 business days to respond to the request for additional information; if you do not respond within that period, your request will be considered not filed.

Finally, we inform you that we will not charge you any amount for processing your ARCO rights request. However, if you request physical copies of documents or delivery by physical means, we may charge you only the justified shipping or reproduction costs, as permitted by law.

If you believe you have not received a satisfactory response from us, or believe your right to personal data protection has been harmed by our conduct, you have the right to appeal to the competent Mexican data protection authority (INAI) and file a complaint. The National Institute for Transparency, Access to Information and Personal Data Protection (INAI) is the authority responsible for overseeing compliance with the LFPDPPP. For more information, you may visit the INAI website: www.inai.org.mx.

Provisions for European Union Users (GDPR)

If you reside or are located within the territory of the European Union, the provisions of the EU’s General Data Protection Regulation (GDPR) may apply to you. In those cases, in addition to the rights and safeguards already mentioned in this Privacy Notice, the following special conditions apply:

Legal bases for processing: We are committed to processing your personal data only when a valid legal basis exists under the GDPR. This means processing will generally occur because it is necessary to perform a contract we have with you (for example, the data we process to provide you the requested service), because you have given us your explicit consent for one or more specific purposes (for example, to send marketing communications, install non-essential cookies, etc.), or because we have a prevailing legitimate interest in carrying out certain processing (for example, improving the security and performance of our website), always after evaluating that such interest does not override your fundamental rights and freedoms. In exceptional cases, we may process data due to a legal obligation or to protect the vital interests of you or other individuals, in accordance with Articles 6 and 7 of the GDPR.

Rights of European users: The GDPR grants data subjects (you, as a user) a set of rights over your personal data, some of which are equivalent to the ARCO rights already described, and others that are additional. In particular, you may exercise the following rights under the GDPR:

Access and Rectification: As with ARCO, you may access the information we hold and request corrections if it is inaccurate.
Erasure (“Right to be forgotten”): You have the right to request the deletion of your personal data under certain circumstances, for example, if the data is no longer necessary for the purposes for which it was collected, or if you withdraw consent and no other legal basis exists for processing. We will comply with erasure requests in the cases provided for in Article 17 of the GDPR.
Restriction of processing: You may request that the use of your personal data be temporarily restricted in certain situations (for example, while a rectification request or a challenge to the accuracy of your data is being resolved, or if the processing is unlawful and you prefer restriction rather than deletion). We will mark your data so that, during the restriction period, we only retain it for the establishment, exercise, or defense of legal claims or other permitted purposes.
Data portability: You have the right to obtain a copy of your personal data in a structured, commonly used, and machine-readable format, and, if applicable, to have us transmit that data directly to another controller you indicate, where technically feasible, if the processing is based on your consent or on a contract and is carried out by automated means.
Objection: In addition to what is described under ARCO, under the GDPR you may object at any time, on grounds related to your particular situation, to our processing of your data when the legal basis is a public interest or our legitimate interest. You also have the right to object at any time to the processing of your data for direct marketing purposes (advertising), which includes profiling related to such marketing. If you exercise this right, we will stop processing your data for those purposes.
Automated decisions: The GDPR guarantees your right not to be subject to decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you, except for the exceptions the regulation itself provides. Our service does not make automated decisions of this kind without human intervention that could substantially affect you.

To exercise any of these additional rights under the GDPR, the contact mechanisms are the same as those described above for ARCO rights (our contact form). We will address your requests and respond within the timeframes provided for by the GDPR, which is generally 1 month from your request, extendable by 2 additional months in complex cases; in that case we will inform you of the need for more time.

International data transfers (EU): As indicated in the Transfers section, some of our external providers are located outside the European Economic Area (for example, in the United States). When we transfer personal data of users located in the EU to countries that do not have an adequacy decision from the European Commission, we implement appropriate safeguards as required by Chapter V of the GDPR. This includes entering into contracts based on the Standard Contractual Clauses approved by the European Commission, requiring recipients to protect personal data to standards equivalent to European ones. In this way, we ensure that your internationally transferred data has an adequate level of protection.

Supervisory authority and complaints: If you are located in the European Union and believe that the processing of your personal data violates the GDPR, you have the right to file a complaint with the data protection supervisory authority of your country of residence or with any other competent supervisory authority in the EU. We suggest that, before doing so, you contact us directly to try to resolve any issue, but in any case you may approach, for example, the Spanish Data Protection Agency (AEPD) or another local authority, which will provide guidance and a channel to enforce your rights.

Provisions for Users in Brazil (LGPD)

If you are located in Brazil, the processing of your personal data may additionally be subject to the Lei Geral de Proteção de Dados Pessoais (LGPD, Law 13.709/2018). The LGPD grants you rights equivalent to those already described in this Notice (confirmation of processing, access, correction, anonymization, portability, deletion, information about third parties with whom we share your data, and withdrawal of consent), which you may exercise through our contact form. Please note that when you pay for a premium itinerary, your payment data is collected directly by Hotmart, a Brazilian company that acts as an independent controller of that data under its own privacy policy. If you believe your rights under the LGPD have been violated, you may contact the Autoridade Nacional de Proteção de Dados (ANPD).

Provisions for Users in the United States (CCPA/CPRA and state laws)

If you reside in California or another U.S. state with a consumer privacy law in effect, please note that: we do not sell your personal data, nor do we share it with third parties in exchange for consideration. We only share data with the providers necessary to operate the site and process purchases, described in the “Transfer of Data to Third Parties” section. Using Google Analytics (only after your consent) may, under some broad CPRA definitions, be considered “sharing” data for analytics purposes; you can prevent this at any time by declining analytics cookies in the consent banner or in “Cookie preferences” in the site footer. You have the right to request access to, correction of, or deletion of your data, and to not suffer discriminatory treatment for exercising these rights; you may exercise them through our contact form.

Changes or Updates to this Privacy Notice

We reserve the right to make modifications or updates to this Privacy Notice at any time, for example, to reflect changes in our information practices, incorporate new legal or regulatory requirements, or adapt it to improvements in our service. Any substantial change to the content of this notice will be communicated to you through our usual contact channels (for example, through a notice on our website or by email) and/or will be published in the corresponding section of our website. We recommend that you periodically review this Privacy Notice to stay informed about how we protect your information.

If changes are made to the purposes for which your personal data is processed, and those purposes require your consent, we will request that consent again before the new processing takes effect.

Contact

If you have any questions or comments about this Privacy Notice, or need more information about how we handle your personal data, please do not hesitate to contact us through our contact form, attention Eduardo Abad Tinoco. We will be glad to assist you with any matter related to the privacy and protection of your personal data.

Last updated: July 22, 2026.