Skip to content This Comprehensive Corporate Privacy Notice explains how XAMAN-HA CONNECTIONS, S.A. DE C.V. collects, uses and protects your personal data.
XAMAN-HA CONNECTIONS, S.A. DE C.V. (hereinafter, “XAMAN-HA”) is responsible for the processing of the personal data it collects in connection with its activities and the provision of tourism services. For privacy purposes, its address is Paseo del Virrey No. 13, La Toscana, Solidaridad, Playa del Carmen, C.P. 77725, Quintana Roo, Mexico. The Operations Department is the area in charge of privacy management. Contact: [email protected]; telephone 55 4094 8973.
This Notice applies corporate-wide and nationwide to the main office in Playa del Carmen, Quintana Roo, and to the branches in Los Cabos, Baja California Sur, and Mexico City, all of which belong to the same legal entity. It also covers data obtained through the website, email, telephone, WhatsApp, forms, CRM, reservation systems, digital platforms and points of sale.
Depending on the service, XAMAN-HA may collect: identification and contact data; reservation and travel data (destination, accommodation, dates, passengers, schedules, flights when necessary, pick-up and drop-off points, tours and activities); tax data; information related to payments and transactions; and images, photographs, voice or video when applicable. When necessary for the safety of the service, data regarding mobility, allergies, dietary restrictions or relevant physical conditions may be collected.
XAMAN-HA will seek not to request sensitive data unless it is necessary for the safety or proper provision of certain tours, excursions, activities or transfers. Where legally required, the applicable consent will be obtained and enhanced protection measures will be adopted.
Data may be used to identify and contact the customer; handle requests and quotations; create, manage, modify and confirm reservations; provide tours, excursions, experiences, activities, transportation and transfers; coordinate schedules and meeting points; manage services with operators, carriers, guides, hotels, parks, marinas, vessels and other providers; process and verify payments; issue invoices; handle changes, cancellations, refunds and claims; provide support before, during and after the service; prevent fraud; comply with contractual, tax, administrative and legal obligations; and keep evidence of contracting and service delivery.
XAMAN-HA may use data for advertising and marketing, promotions, loyalty programs, satisfaction surveys, commercial analysis, information about new services and promotional communications through authorized channels. The promotional use of photographs, voice or video will be subject to the specific corresponding consent. These purposes are not essential to provide the service. The data subject may object by writing to [email protected], without affecting the contracted service.
To provide the services, XAMAN-HA may disclose the strictly necessary data to tour operators, carriers, hotels, parks, marinas, guides, excursion providers, agencies, tourism service providers, financial institutions, payment processors, insurers, technology providers and competent authorities. When a transfer requires consent under applicable law, it will be obtained.
XAMAN-HA uses KOMMO as its CRM to manage leads, customers, quotations, reservations, communication history, commercial follow-up and support. It also uses WhatsApp for information, quotations, confirmations, schedules, meeting points, support and, where applicable, promotional communications. When WhatsApp is integrated with KOMMO, certain communications and associated data may be added to the customer history in the CRM.
For payments, XAMAN-HA uses Clip, PayPal and Stripe. As a general policy, it will seek to have full card data captured and processed directly by specialized platforms; where technically applicable, XAMAN-HA will not store full card numbers or CVV/CVC codes. It may keep references, amounts, dates, authorizations, statuses and partial data necessary for administrative, accounting, tax, clarification, refund, fraud-prevention and claim purposes.
Due to the nature of these services, certain data may be processed or stored on technology infrastructure outside Mexico. Providers may act as processors and, depending on the service and their own legal obligations, carry out processing under their own responsibility. XAMAN-HA may replace or add providers; if this involves a substantial change that must be reported, it will update this Notice.
The data subject may exercise the rights of Access, Rectification, Cancellation and Opposition (ARCO) by submitting a request to the Operations Department at [email protected]. The request must include: name; a means to receive a response; documents proving identity and, where applicable, representation; a description of the data; the right the person wishes to exercise; and any elements that help locate the data. XAMAN-HA will respond to the request within the applicable legal deadlines.
Where processing is based on consent, it may be revoked by submitting a request to [email protected], subject to legal and contractual limitations. The data subject may also request the limitation of the use or disclosure of data, especially for advertising, promotions and marketing.
The websites and digital platforms of XAMAN-HA may use cookies and similar technologies for browsing, preferences, statistics, service improvement and, where applicable, advertising. Users may manage certain cookies through their browser and the mechanisms available on the site.
Reservations may include minors. Their data must be provided by parents, guardians, legal representatives or a person legitimately authorized to make the reservation. XAMAN-HA will process such data to the extent necessary to manage the reservation, provide the service, ensure the safety of the minor and comply with applicable obligations.
XAMAN-HA will maintain reasonable administrative, technical and physical measures to protect data against damage, loss, alteration, destruction, and unauthorized use, access or processing. Data will be kept for the time necessary for the stated purposes and afterwards for the applicable legal, tax, contractual or administrative periods; once these have elapsed, data will be deleted, blocked or anonymized where appropriate.
XAMAN-HA may modify this Notice due to legal reforms, regulatory changes, new services, technologies, providers, branches, purposes or internal policies. Changes will be made available by physical or electronic means and, where applicable, on the XAMAN-HA website.
The data subject may go to the competent federal authority on the protection of personal data held by private parties to exercise the protection mechanisms provided by current law.
Data Controller: XAMAN-HA CONNECTIONS, S.A. DE C.V.
Area: Operations Department.
Address: Paseo del Virrey No. 13, La Toscana, Solidaridad, Playa del Carmen, C.P. 77725, Quintana Roo, Mexico.
Email: [email protected]
Telephone: 55 4094 8973.
Main office: Playa del Carmen, Quintana Roo.
Branch: Los Cabos, Baja California Sur.
Branch: Mexico City.
All three operations belong to XAMAN-HA CONNECTIONS, S.A. DE C.V.; the existence of branches does not imply separate data controllers.
XAMAN-HA CONNECTIONS, S.A. DE C.V. | Privacy | September 2026
Optimized by Seraphinite Accelerator