1. Who is responsible for your data
Bon Vivant Tulum, based in Tulum, Quintana Roo, Mexico, is responsible for your personal data. This notice is our privacy notice (aviso de privacidad) under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).
For any privacy question or request, contact us by WhatsApp at +52 81 2887 2039.
2. What data we collect
Data you give us
- Your name and contact details: WhatsApp number, phone number and email address.
- Trip details: travel dates, group size, occasion, accommodation, the services you are interested in, your budget and any notes you send.
- Booking details we need to reserve services for you, such as the names of guests, arrival and departure information, and dietary requirements or allergies you choose to share.
- Reviews you submit on our website: the name you choose to show, the occasion, the month of your trip, your rating and your text. We publish them only with your consent and after checking them, and you can ask us to remove your review at any time.
We do not ask for sensitive personal data. If you share information about health (for example allergies) or other sensitive matters, we use it only to arrange your booking and with your express consent.
Data collected automatically
When you visit the website, our hosting provider records technical data such as your IP address, browser type, the pages requested and the time of the request. This is needed to deliver the website securely.
We use Vercel Web Analytics to count visits, pages viewed, the country you visit from and clicks on our contact buttons. It works without cookies and does not identify you personally; the data is only shown to us as totals. Our website does not use advertising cookies.
3. Why we use your data
Primary purposes (necessary to provide our service)
- Answering your enquiry and planning your trip.
- Making reservations with villas, restaurants, clubs, festivals, boat operators, drivers and other providers on your behalf.
- Keeping in touch with you before and during your stay, including changes and support.
- Meeting our legal, tax and accounting obligations.
Secondary purposes (optional)
- Sending you occasional news and offers, such as festival dates.
- Asking you for feedback or a review after your trip.
You can object to the secondary purposes at any time by telling us on WhatsApp or by email. This does not affect the service we provide.
4. Who we share your data with
We share only the data each provider needs to fulfil your booking, for example your name and arrival time with a driver, or group size and dietary requirements with a chef. These providers include villa owners and managers, restaurants, beach clubs, nightclubs, festival organisers, boat operators, transport companies, car rental companies and wellness professionals.
We also use service providers that process data for us:
- WhatsApp (Meta Platforms), which carries our messages with you.
- Vercel, our website hosting provider, which stores technical logs and provides anonymous visitor statistics.
Some of these companies are located outside Mexico, including in the United States. Transfers needed to provide the service you requested do not require separate consent under the LFPDPPP. We do not sell your personal data.
We may disclose data when required by law or by a competent authority.
5. How long we keep your data
We keep your data for as long as we need it to plan and deliver your trip and to handle any follow-up, and afterwards for the period required by Mexican tax and commercial law. We then delete or anonymise it.
6. Your rights
You can access, rectify or cancel your personal data, and object to its use (ARCO rights). You can also withdraw your consent or limit how we use and disclose your data.
To make a request, contact us by WhatsApp at +52 81 2887 2039 with your name, a way to contact you, a copy of an ID (or proof of representation), a clear description of the data and the right you want to exercise, and anything that helps us find the data. We will reply within 20 business days and, if your request is valid, act on it within the following 15 business days.
If you are in the European Union or the United Kingdom, you also have the rights given by the GDPR, including data portability and the right to complain to your local data protection authority. If you are a California resident, you can ask what personal information we hold about you and ask us to delete it; we do not sell or share personal information for targeted advertising.
7. Security
We use reasonable administrative, technical and physical measures to protect your data against loss, misuse and unauthorised access. No transmission over the internet is completely secure, so please avoid sending card numbers or passwords over WhatsApp or email.
8. Children
Our services are aimed at adults. We do not knowingly collect data from children under 18 except where a parent or guardian provides it as part of a family booking.
9. Changes to this notice
We may update this notice. The current version is always on this page, with the date of the last update at the top.