Privacy notice

This notice is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette on 20 March 2025 (the "Law"), its Regulations and the Privacy Notice Guidelines. The Spanish version is the legally binding text; this translation is provided for convenience. Read it before creating an account.

Items in brackets must be completed with the operating company's details before publishing. This document must be reviewed by a licensed Mexican attorney before use.

1. Data controller

[LEGAL ENTITY NAME], tax ID (RFC) [RFC], with its address at [FULL ADDRESS, Holbox, Lázaro Cárdenas, Quintana Roo, 77310] ("we" or the "Platform"), is the controller of the personal data collected through the customer app, the driver and courier app and the business web portal (together, the "Services").

Personal data office: [PRIVACY EMAIL], phone [PHONE].

2. Personal data we collect

Depending on which Service you use, we collect:

Customers

• Identity and contact: mobile phone number, name, email (optional), preferred language.
• Location: device location while the app is open, pickup points, destinations and delivery addresses, including hotel or beach references you provide.
• Transactions: history of rides, orders and bookings; chosen payment method; the last four digits and brand of your card. We never store the full card number or the security code; the payment processor receives them directly.
• Communications: reviews and ratings you write, support messages, incident reports.
• Technical data: device identifier for notifications, app version, operating system, error logs.

Driver and courier partners

• All of the above, plus: identity documents and driver's licence, unit number, vehicle type, verification status, profile photo.
• Background location while you are online or on a job, as explained in the app and in section 4.
• Performance data: offer acceptances and declines, timings, ratings received, incidents, GPS signal integrity indicators.
• Financial data: earnings, tips, commissions, cash balance owed, payments made, CLABE bank account for deposits.

Staff of partner businesses (restaurants, stores, tour operators, fleets)

• Name, phone, role, business they belong to, actions taken in the portal.

Conecta users (activities, friends, dating and community)

• Profile: display name, photos, country, languages, interests, bio, dates of stay on the island and, if you provide them, birth date and whether you declared being an adult or a minor.
• Content: activities you host or join, friend requests, Dating likes and matches, chat messages (text and photos), posts, comments and reactions.
• Safety: reports you file or receive, blocks and moderation decisions.
• We never collect or show your exact location or your hotel name in Conecta; chats never share coordinates automatically.

Sensitive data. We do not request sensitive personal data (health, ethnic origin, beliefs, sexual preferences, etc.). Please do not include it in order notes, reviews or messages. The only exception is Dating: if you turn it on, your gender and who you want to meet may reveal your sexual orientation. We only process that data with your express consent, given when you turn Dating on, and you can withdraw it at any time by turning Dating off, which erases those preferences.

Minors. The Services are intended for people aged 18 or over. We do not knowingly collect data from minors. In Conecta, if someone declares being under 18 we only store that declaration and they can only see public activities; they cannot use Dating, Friends, private chats or the Community.

3. Purposes

Primary purposes (necessary for the service; without them we cannot provide it):

1. Create and authenticate your account with a code sent to your phone.
2. Request, assign, carry out and charge rides, food or grocery orders and tour bookings.
3. Show the driver's or courier's location to the customer during the service, and the customer's location to the driver for pickup or delivery.
4. Calculate prices, tips, commissions and partner payouts; issue receipts.
5. Verify the identity and documents of driver partners as required by law.
6. Prevent fraud and abuse: delivery codes, pickup PIN, fake-location detection, charge limits.
7. Handle incidents, complaints, refunds and claims; meet tax, accounting and labour obligations.
8. Send operational notifications (ride or order status, job offers to partners, safety alerts).

Secondary purposes (you may refuse without affecting the service):

1. Send you promotions, news and satisfaction surveys.
2. Produce aggregate statistics to improve the Services.

To refuse the secondary purposes write to [PRIVACY EMAIL] or use the option in the app's "Account" section. Refusing does not affect the service.

4. Geolocation

• The customer app uses your location only while it is open, to centre the map and suggest pickup points.
• The partner app uses location in the background only while the partner is online or on a job, and shares it with the customer of the active service and with dispatch staff. Collection stops when the partner goes offline.
• Individual positions are kept for 48 hours for operational and safety purposes and then deleted. Only the start and end points of each service are kept as part of the transaction history.

5. Transfers

Your data may be shared with:

Beyond these cases we do not transfer your data to third parties without your consent. We do not sell personal data.

Cloud providers may be located outside Mexico; in those cases we contractually require security measures equivalent to those in the Law.

6. ARCO rights and other rights

You may Access your data, Rectify it, Cancel it or Object to its processing, as well as withdraw your consent and limit the use or disclosure of your data.

How to exercise them:

1. In the app: Account → My data. You can download a copy of your information, correct your name and email, or submit a cancellation, objection or account deletion request.
2. By email: write to [PRIVACY EMAIL] with your name, registered phone number, the right you wish to exercise and a clear description. Attach a copy of an official ID or reply to the code we send to your phone to verify your identity.

We will respond within 20 business days and, where applicable, act on the request within the following 15 business days. Withdrawal of consent or cancellation does not apply where the law requires us to keep information (for example, transaction records for 10 years under the Commercial Code, or partner labour records). In those cases we will block the data and keep it only for those purposes.

If you believe your rights have been violated, you may file a complaint with the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno), the authority for personal data held by private parties.

7. Retention

8. Automated decisions

Assignment of services to driver partners is automatic: one partner is offered at a time, prioritising the nearest and, at equal distance, the one idle the longest. Prices are calculated from fixed zone rates published in the app, with no surge pricing. No partner is deactivated automatically because of ratings; every deactivation is reviewed by a person and the reason is communicated. Partners may request review of any automated decision by writing to [PRIVACY EMAIL].

9. Security

We apply administrative, technical and physical measures: encryption in transit, codes and sessions stored encrypted or hashed, staff access to sensitive data logged with a reason, payment data kept with the processor, and backups. In the event of a breach that significantly affects your rights, we will notify you without delay through your registered contact details.

10. Cookies and similar technologies

The web portal uses only a session cookie needed to keep you signed in and local storage for your language and theme preferences. We do not use advertising or third-party cookies. You can clear them from your browser; you will then need to sign in again.

11. Changes to this notice

We will publish any changes at this same address and, when the changes are substantial, ask you to accept them again in the app before continuing. The date of the last update appears at the top.

12. Consent

By tapping "I accept" in the app, or by continuing to use the Services after reading this notice, you consent to the processing of your data for the purposes described. For financial data (payment method, CLABE) consent is given expressly at the moment you provide it.