Privacy Policy and Legal Notice

1. Data controller

In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations, we inform you that:

XPECTATIVE TRAVEL S.R.L. DE C.V. (hereinafter, "Cancun100" or "the Agency"), with registered address at Calle Tejón 14, Planta Baja, Cancún, Quintana Roo, C.P. 77500, Mexico, RFC XTR2306232CA, is responsible for the processing, use and protection of your personal data collected through the site cancun100.com and associated channels (WhatsApp, email, forms, social media).

2. Personal data we collect

Depending on the type of interaction, we may collect the following categories of personal data:

Identification data

• Full name, nationality, date of birth or age.

Contact data

• Email, mobile phone and/or WhatsApp.

Booking data

• Tour, package or service contracted, dates, number of people, hotel and pickup point, special conditions (allergies, mobility needs).

Tax data (only if you request an invoice)

• RFC, company name, tax address, CFDI use, tax regime.

Payment data

• We do NOT store full card numbers. Payments are processed through PCI DSS certified platforms (Stripe, PayPal, MercadoPago). We only receive the transaction reference.

Browsing data

• IP address, browser type, operating system, device, approximate location (city level), pages visited, time on site, referral source.

We do not collect sensitive personal data (racial or ethnic origin, health, religious beliefs, sexual preference, political opinions) except when you voluntarily share medical information relevant to the provision of the service (e.g. allergies, physical restrictions).

3. Purposes of processing

A. Primary purposes (necessary for the service)

• Managing your booking, processing payments and issuing confirmations.
• Contacting you to confirm, modify or cancel services.
• Coordinating transport and logistics with tour operators.
• Issuing invoices and tax receipts in accordance with the law.
• Handling questions, clarifications, complaints or requests.
• Complying with legal obligations (tax, accounting, consumer protection).
• Preventing fraud and protecting the security of our systems.

B. Secondary purposes (optional; require consent)

• Sending promotions, discounts, news and travel recommendations.
• Conducting satisfaction surveys.
• Analysing preferences and consumer behaviour to improve our offer.
• Showing you personalised ads through Meta (Facebook/Instagram), Google Ads, TikTok and other advertising platforms.

If you do not want your data to be used for secondary purposes, send an email to info@cancun100.com with the subject "Refusal of secondary purposes". This will not affect the services you have contracted.

4. Legal basis for processing

We process your personal data on the basis of:

• Consent: for secondary purposes and marketing communications.
• Performance of a contract: to manage your booking and provide the contracted service.
• Compliance with legal obligations: for issuing invoices, tax records and responding to requests from the authorities.
• Legitimate interest: to prevent fraud, improve the security of the site and analyse aggregated usage trends.

5. Retention periods

We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected:

Once these periods have elapsed, the data is securely deleted or anonymised.

6. Transfers of personal data

Your personal data may be transferred to:

• Tour operators and carriers duly certified, exclusively for the provision of the service you contracted.
• Hotels to manage your accommodation where applicable.
• Payment processors (Stripe, PayPal, MercadoPago) to validate transactions.
• Technology providers (hosting, email, CRM, analytics) under confidentiality agreements.
• Advertising platforms (Meta, Google, TikTok) for marketing campaigns, with prior consent.
• Competent authorities in compliance with legal or judicial orders.

We do not sell or trade your personal data to third parties for their own use.

7. Analytics and marketing tools

To improve your experience, measure the site's performance and show you relevant advertising, we use the following tools:

You can object to the use of these tools by configuring your browser to block cookies or by using control tools such as the Google Analytics opt-out extension or the advertising preferences of each platform.

For full details, see section 9, Cookies and similar technologies.

8. Your ARCO rights

You have the right to Access, Rectify, Cancel or Object to the processing of your personal data (ARCO rights), as well as to revoke the consent you have given us.

To exercise them, send a request to info@cancun100.com with the subject "ARCO request" and the following information:

1. Your full name and a legible copy of valid official identification (INE, passport, FM2/FM3).
2. A clear and precise description of the data on which you wish to exercise the right.
3. The specific right you wish to exercise (access, rectification, cancellation or objection).
4. A means of contact to receive our reply (email or postal address).
5. In the case of rectification: documentation supporting the requested change.

We will reply within a maximum of 20 business days in accordance with article 32 of the LFPDPPP. If the request is admissible, the change will take effect within the following 15 business days.

This service is free of charge. We will only charge justified shipping or reproduction costs where applicable.

9. Cookies and similar technologies

This site uses cookies, web beacons and similar technologies to remember your preferences, analyse the use of the site and show you personalised advertising. This section is Cancun100's cookie policy: what they are, what we use them for, which ones we install and how to manage them. You can change your choice at any time from "Cookie preferences", at the bottom of every page.

9.1 What cookies are

Cookies are small text files that a website stores in your browser (Chrome, Safari, Firefox, etc.) when you visit a page. They are used to remember information about your visit: preferred language, products in the cart, logged-in session, approximate location, etc.

Along with cookies, this site may use similar technologies such as:

• Web beacons / pixels: small invisible images that record your visit.
• LocalStorage / SessionStorage: browser storage for saving preferences.
• Fingerprinting: identification based on device characteristics (we do not actively use this technique).

For the purposes of this policy, all these technologies are collectively referred to as "cookies".

9.2 What we use them for at Cancun100

We use cookies for four main purposes:

• Operation: so that the site works correctly (shopping cart, session, WPML language).
• Improved experience: remembering your preferences between visits (language, currency, forms).
• Analytics: understanding how the site is used in order to improve it (which pages are visited most, where people leave, which tours are of interest).
• Marketing: showing you relevant ads on Facebook, Instagram, Google, TikTok and other platforms, including remarketing.

9.3 Categories of cookies we use

We classify cookies into four categories according to their purpose and level of privacy:

Essential — no consent required

Necessary for the operation of the site. Without them you cannot browse or book.

Preferences — implied consent

They remember your choices (language, currency) to improve your experience.

Analytics — optional consent

They help us understand the use of the site in an aggregated and anonymous way.

Marketing — optional consent

They allow us to show you personalised advertising and measure its effectiveness.

9.4 Essential cookies

9.5 Preference cookies

9.6 Analytics cookies

9.7 Marketing and advertising cookies

9.8 Additional third-party cookies

Some external services integrated into our site may set their own cookies outside our direct control:

• YouTube (embedded videos): sets cookies when you play a video. Google policy
• Google Maps (embedded maps): sets functional and analytics cookies.
• Stripe / PayPal / MercadoPago (payment gateways): cookies needed to process secure payments and prevent fraud. Stripe policy
• WhatsApp (chat button): cookies to start a conversation.
• Mailchimp (newsletter, if you subscribe): cookies tracking opens and clicks.

Cancun100 does not directly control these third-party cookies. We recommend that you review the privacy policies of each service to understand how they treat your data.

9.9 Your consent

When you first access cancun100.com, we show a cookie notice informing you about the use of these technologies. By continuing to browse or closing the notice, you give your consent to the use of cookies in accordance with this policy, in compliance with:

• Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, Mexico)
• General Data Protection Regulation (GDPR) for visitors from the European Union
• ePrivacy Directive of the EU
• California Consumer Privacy Act (CCPA) for California residents

You can withdraw your consent at any time by adjusting your browser's cookie settings or by using the opt-out tools described in section 9.10.

9.10 How to manage or delete cookies

From your browser

You can configure your browser to block, delete or be notified of cookies. Links to the official guides:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge
• Opera

Opting out of specific services

You can opt out of tracking by some services directly:

• Google Analytics: install the GA opt-out add-on
• Google Ads: set your ad preferences
• Meta (Facebook/Instagram): adjust your Meta advertising preferences
• TikTok: set the ad personalisation options in the app
• Microsoft Clarity: respects the browser's "Do Not Track" signal

General control platforms

• Your Online Choices (Europe)
• Digital Advertising Alliance (USA)
• Network Advertising Initiative (USA)

9.11 Duration of cookies

Cookies are classified according to their duration:

• Session cookies: automatically deleted when you close the browser.
• Persistent cookies: remain on your device for a set period (from minutes to several months), depending on the purpose.

The specific duration of each cookie is indicated in the tables in sections 9.4 to 9.7.

10. Information security

We implement reasonable administrative, technical and physical measures to protect your data against unauthorised access, loss, alteration or disclosure. These measures include:

• Encrypted connections with an SSL/TLS certificate across the whole site.
• Access to personal information restricted to authorised staff bound by confidentiality.
• PCI DSS certified payment processors (we do not store card data).
• Periodic backups and monitoring of anomalous activity.
• Constant updating of software and security patches.

Despite our reasonable measures, no system is 100% inviolable. In the event of a security incident that significantly affects your data, we will notify you without undue delay in accordance with article 20 of the LFPDPPP.

11. Data of minors

Our services are aimed at people over 18 years of age. We do not knowingly collect personal data from minors without the express consent of the person holding parental authority or guardianship.

When a booking includes minors as companions, their data will be provided by the responsible adult, who declares that they are authorised to do so.

If you discover that a minor has provided us with data without authorisation, contact us to delete it immediately.

12. International visitors

If you visit this site from the European Union, the United Kingdom, California (USA), Canada or another jurisdiction with specific data protection laws:

• GDPR (European Union / United Kingdom): we recognise the applicable provisions on the rights of access, rectification, erasure, portability, restriction and objection. You can exercise them through the same channels indicated in section 8.
• CCPA (California): we recognise the rights to know, to delete, to opt out of sale ("Do Not Sell My Personal Information") and to non-discrimination.
• PIPEDA (Canada): we recognise the applicable provisions on use, disclosure and consent.

Notwithstanding the above, the principal applicable jurisdiction is Mexico, as the country of incorporation of the Agency, and data is processed in accordance with the LFPDPPP.

13. Changes to this notice

Cancun100 reserves the right to update this Privacy Notice to reflect legal, operational or technological changes. Changes will be published on this page, indicating the date of update at the top.

We recommend that you review this document periodically. Continued use of the site after any change implies acceptance of the new notice.

14. Data protection authority

If you consider that your right to the protection of personal data has been violated, you can file a complaint with the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI):

• Website: home.inai.org.mx
• Phone: 800 835 4324

Before going to the INAI, we invite you to contact us directly to resolve any concern.

15. Contact for the privacy officer

For any matter related to your personal data or this Privacy Notice, contact us:

• Data Protection Department: info@cancun100.com
• Phone / WhatsApp: +52 998 763 7653
• Address: Calle Tejón 14, Planta Baja, Cancún, Quintana Roo, C.P. 77500, Mexico