Privacy Policy & Security

We collect data and information about our guests and other visitors to better provide our Services. The data collected is provided by you, either directly or via your use of the Services.

Personal Data

Personal data applies to any data that can identify you as an individual or relate to an identifiable individual. At various points during your stay and experience with Mahekal Beach Resort, we collect certain Personal Data such as:

• Contact information: First and last name, Email address, Phone number, Address, State, Province, Country, ZIP/Postal code, City, etc.
• Demographic information: Age, gender, date of birth, anniversary, primary language, etc.
• Reservation/Visit: Date of arrival and departure, special requests, goods, and services purchased and consumed, etc.
• Interests and Preferences: Regarding past, current and future stay at the Mahekal Beach Resort, such as your interests, activities, hobbies, food, beverage choices, etc.

In more limited circumstances, we also may collect Data about family members and companions, such as the ages of children. Images and video and audio data via (a) security cameras located in public areas, such as pathways and restaurants. If you submit any Personal Data about other people to us (e.g., if you make a reservation for another individual), you represent that you have the authority to do so and you permit us to use the data by this Privacy Policy.

Payment Processing Information

When you make a payment in connection with purchasing any of the Services, Mahekal Beach Resort may obtain credit card or other payment information.

Usage Data

Usage Data has collected automatically when you use the Service. Usage Data may include information such as your device's Internet Protocol address (e.g. IP address), browser type (for example Chrome, Firefox, Edge, or Safari), browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data. When you access the Service by or through a mobile device, we may likewise collect certain information automatically, including, but not limited to, the type of mobile device you use, the unique ID or IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers and other diagnostic data. We may also collect information that your browser sends whenever you access the Service by or through a mobile device. Usage data is collected via tracking technologies, including:

Cookies

A cookie is a small data file that resides on your computer and allows us to recognize you as a user when you return using the same computer and web browser. Cookie data is used to customize your experience when you use the Services. When you visit our website, you are notified of the use of cookies for tracking and analysis and asked to provide your express consent. The notice refers to the detailed explanations in this Privacy Policy. Cookies can be "Persistent" or "Session" cookies. Persistent cookies remain on your personal computer or mobile device when you go offline, while Session cookies are deleted as soon as you close your web browser. We use both Session and Persistent cookies for the purposes set out below:

• Necessary / Essential Cookies
  Type: Session Cookies; Administered by: Us Purpose: These cookies are essential to provide you with the Services. They help to authenticate users and prevent fraudulent use of user accounts. We only use these cookies to provide the Services.
• Cookies Policy / Notice Acceptance Cookies
  Type: Persistent Cookies; Administered by: Us Purpose: These cookies identify if users have accepted the use of cookies on the website(s).
• Functionality Cookies
  Type: Persistent Cookies; Administered by: Us Purpose: These cookies allow us to remember choices you make when you use our website(s), such as remembering your login details or language preference. The purpose of these cookies is to provide you with a more personal experience and to avoid your having to re-enter your preferences every time you use the website(s).
• Tracking and Performance Cookies
  Type: Persistent Cookies; Administered by: Third-Parties Purpose: These cookies are used to track information about traffic to the website and how it is used. The information gathered may directly or indirectly identify you as an individual visitor. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the website. We may also use these cookies to test new advertisements, pages, features, or new functionality of the website to see how our users react to them.
• Targeting and Advertising Cookies
  Type: Persistent Cookies; Administered by: Third-Parties Purpose: These cookies track your browsing habits to enable us to show advertising which is more likely to be of interest to you. They use information about your browsing history to group you with other users who have similar interests. Based on that information, and with our permission, third-party advertisers can place cookies to enable them to show advertisements that we think will be relevant to your interests while you are on third-party websites. Log files are deleted after 120 days. Session cookies expire and are deleted at the end of your browser session. Persistent cookies may be set to expire from 30 days to 1 year depending on the function of the cookie. After the expiry of those periods, information will be deleted or made anonymous. You can instruct your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if you do not accept Cookies, you may not be able to use some parts of our Service. Most modern internet browsers allow individuals to change the settings in the ‘options’ or ‘preferences’ menu to avoid or limit cookie storage. In addition, third-party cookies generated by certain advertisers may be turned off by requesting with the Network Advertising Initiative. Please visit http://optout.networkadvertising.org for more information. In addition to cookies, we also use Web Beacons and Embedded Script. Web Beacons help us better manage content on our Services by informing us of what content is effective. Web beacons are tiny graphics with a unique identifier, similar in function to cookies, and are used to track the online movements of web users. This information is used to help improve the overall quality and experience of the Services. Embedded Script is a programming code that collects information about your interactions with the Services, such as the links you click on. The code is temporarily downloaded onto your computer or another device from our server or a third-party service provider and is deactivated or deleted when you disconnect from the Service. We also collect data through Google Analytics and Adobe Analytics, which use cookies and technologies to collect and analyze data about the use of the Services. These services collect data regarding the use of other websites, apps, and online resources. You can learn about Google’s practices by going to https://policies.google.com/privacy and opt-out by downloading the Google Analytics opt-out browser add-on, available at tools.google.com. You can learn more about Adobe and opt-out by visiting https://www.adobe.com/privacy/policy.html.

The data and other information that we collect is used and disclosed in the following manner(s) and for the following purposes:

• To provide and maintain our Service, including monitoring the usage of our Service.
• To manage your account: to manage your registration as a user of the Service. The information you provide can give you access to different functionalities of the Service that are available only to a registered user.
• PFor the performance of a contract: ethe development, compliance, and undertaking of the purchase contract for the products, items, or services you have purchased or of any other contract with us through the Service.
• To contact you: To contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products, or contracted services, including the security updates, when necessary or reasonable for their implementation.
• To provide you with news, special offers, and general information about other goods, services, and events that we offer that are similar to those that you have already purchased or inquired about unless You have opted not to receive such information.
• To attend and manage your requests to us.
• To tailor content, recommendations, and offers we display them to you on the Services and elsewhere online.
• Improve the Services and our products, including asking you to participate in surveys and for other internal business purposes.

We disclose information and data, including personal data, to other companies for the purposes described in this Privacy Policy, such as providing and personalizing the Services, communicating with you, and accomplishing our business purposes. We share your data and other data used for making a reservation with the applicable property to fulfill and complete your reservation. Our goal is to provide you with the highest level of hospitality and to assist us with doing so, we share personal, and other, data with the following parties:

• Strategic Business Partners: We disclose data, including personal data, and other information with select strategic business partners who provide goods, services, and offers that enhance your experience at our properties or that we believe will be of interest to you. By sharing data with these parties, we can make personalized services and unique travel experiences available to you. For example, this sharing enables spa, restaurant, concierge, and other outlets at our properties to provide you with services. This sharing also enables us to provide you with a single source for purchasing packages that include travel-related services, such as airline tickets and vacation packages.
• Service Providers: We disclose data, including personal data, and other information to third-party service providers for the purposes described in this Privacy Policy. Examples of service providers include companies that provide website hosting, data analysis, payment processing, order fulfillment, information technology, related infrastructure provision, customer service, email delivery, marketing, auditing, and other services. Operation of Website By AXOVIA MARKETING & TECHNOLOGIES S. de R.L. de C.V.
  Our website is operated on our behalf by AXOVIA MARKETING & TECHNOLOGIES S. de R.L. de C.V., AV. Los tules 178, local K5, Zona Hotelera Norte Puerto Vallarta, Jalisco, Mexico, C.P. 48333 (“AXOVIA”). This means that our website (including your user account and registration information for newsletters) is physically hosted on servers operated for “AXOVIA” by Vercel Inc.. (“Vercel”) located in the USA. We have concluded a contract processing agreement with AXOVIA to ensure that the website is operated, and personal data is processed, only on our behalf and by our instructions. [The contract processing agreement contains guarantees for an adequate level of protection in the form of incorporation of the standard data protection clauses adopted by the Commission for this purpose.] AXOVIA has similarly concluded a contract processing agreement with Vercel to ensure that the website is hosted, and personal data is processed, only on its behalf and by its instructions.
• Corporate Reorganization/Business Transfers: We may disclose or transfer your data and other information to a third party in the event of any reorganization, merger, sale of our assets, financing, joint venture, assignment, transfer, or other disposition of all or any portion of Mahekal Beach Resort business, assets or stock. We may share or transfer your personal information in connection with, or during negotiations of, any merger, sale of assets, financing, or acquisition of all or a portion of our business to another company. In any such case, the successor organization’s use and disclosure of your data will continue to be subject to this policy unless (i) a court orders otherwise, for example, a bankruptcy court; or (ii) the successor organization gives you notice that your data will be subject to the successor organization’s policy, along with an opportunity for you to opt-out (which may cause you not to be able to continue to use the website). If you submit personal data after such a transfer, that information may be subject to the successor entity’s policy.
• Sweepstakes, Contests, and Promotions: We may work with third parties that sponsor or offer sweepstakes, contests, and other promotions. By participating in a promotion, you are agreeing to the terms, conditions, or official rules that govern that promotion, which may contain specific requirements of you, including, except where prohibited by law, allowing us and the sponsor(s) of the promotion to use your name, voice, likeness or other indicia of persona in advertising or marketing. If you choose to enter a promotion, personal information may be disclosed to third parties or the public in connection with the administration of such promotion, including, without limitation, in connection with winner selection, prize fulfillment, and as required by law or permitted by the promotion’s official rules, such as on a winners list.
• With other users: when you share personal information or otherwise interact in public areas with other users, such information may be viewed by all users and may be publicly distributed. If you interact with other users or register through a third-party social media platform, your contacts on such social media platforms may see your name, profile, pictures, and description of your activity. Similarly, other users may be able to view descriptions of your activity, communicate with you, and view your profile.

In addition to the above scenarios, we may also disclose information about you to certain third parties if we have a good-faith belief that we are required to do so by law or legal process, to respond to legal claims, or to protect our rights, property, or safety, or the rights, property, or safety of others. We will only use your payment processing information with your explicit consent.

We will retain data, including personal data, and other information for the purposes set out in this Privacy Policy. We will retain and use such data and information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. We will also retain usage data for internal analysis purposes.

Our Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Mahekal Beach Resort is operated in Mexico. If you are located outside of Mexico, please be aware that the information we collect will be transferred to and processed in both Mexico and the United States. By using our website(s) or the Services, or providing us with any information, you fully understand and unambiguously consent to this transfer, processing, and storage of your information in both Mexico and the United States, a jurisdiction in which the privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen.

The security of your data is important to us, and Mahekal Beach Resort takes commercially reasonable security and backup measures to protect the information submitted to us. However, no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security. We encourage our customers and partners to retain copies of all uploaded information on their systems.

The Services are general audience services and are not intended for individuals younger than the age of 13. We do not knowingly collect personal data from individuals younger than the age of 13 without parental consent. If we discover that a child under the age of 13 has provided us with personal data, or that we have otherwise inadvertently collected personal data from anyone younger than the age of 13, we will delete it by applicable law.

California residents have additional rights regarding our use of their data and are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of personal information to third parties for their direct marketing purposes in the preceding calendar year. California residents under the age of 18 who are registered users of online sites, services, or applications also have the right under California law to request and obtain the removal of content or information they have publicly posted. If you are a California resident and wish to request the removal of such data, you can contact us using the contact information provided below. California residents are also entitled to exercise certain rights as expressly set forth by the California Consumer Privacy Act, including the right to give the instruction ‘Do Not Sell My Personal Information to third parties. For additional details on your California Privacy rights, see our California Privacy notice.

We comply with the provisions of the European Union’s General Data Protection Regulation (“GDPR”) as to any information in its possession regarding EU-based persons (“data subjects”). Accordingly, we only process personal information on data subjects where we have a lawful basis to do so, which may include the consent of each person (especially in the case of website visitors who provide their information) or compliance with a legal obligation. For additional details on your European Union Privacy rights, please see our European Union Privacy notice.

We may use third-party service providers to show advertisements to you to help support and maintain our Service. Such third parties include, but are not limited to:

• Google AdSense & DoubleClick Cookie: Google uses cookies to serve ads on our Service. Google's use of the DoubleClick cookie enables it and its partners to serve ads to our users based on their visit to our Service or other websites on the Internet. You may opt-out of the use of the DoubleClick Cookie for interest-based advertising by visiting the Google Ads Settings web page: http://www.google.com/ads/preferences/.
• Bing Ads: Bing Ads is an advertising service provided by Microsoft Inc. You can opt out from Bing Ads by following the instructions on Bing Ads Opt-out page: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads

For more information about Bing Ads, please visit their Privacy Policy: https://privacy.microsoft.com/en-us/PrivacyStatement.

We may use the email address that you provide to us to contact you with newsletters, marketing or promotional materials, and other information that may be of interest to you. You may opt out of receiving any, or all, of these communications by following the unsubscribe link or instructions provided in any email we send or by contacting us as set forth below. The registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registration you will receive an e-mail asking you to confirm your registration. This confirmation is necessary to prevent unauthorized use of your e-mail address by another person. We may use certain third-party email marketing service providers, such as Mailchimp and TravelClick, an Amadeus Company to manage and send emails to you. TravelClick’s Privacy Policy can be viewed at: https://www.travelclick.com/legal/travelclick-policies/

We use remarketing services to advertise on third-party websites to you after you have visited one of our websites. In the course of doing so, we use cookies to inform, optimize and serve ads based on your past visits to our Service, such as:

• Google Ads (AdWords): Google Ads (AdWords) remarketing service is provided by Google Inc. You can opt out of Google Analytics for Display Advertising and customize the Google Display Network ads by visiting the Google Ads Settings page: http://www.google.com/settings/ads Google also recommends installing the Google Analytics Opt-out Browser Add-on - https://tools.google.com/dlpage/gaoptout - for your web browser. Google Analytics Opt-out Browser Add-on provides visitors with the ability to prevent their data from being collected and used by Google Analytics. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy.
• Bing Ads Remarketing:Bing Ads remarketing service is provided by Microsoft Inc. You can opt out of Bing Ads interest-based ads by following their instructions: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads.

• Twitter: Twitter remarketing service is provided by Twitter Inc. You can opt-out of Twitter's interest-based ads by following their instructions: https://support.twitter.com/articles/20170405. You can learn more about the privacy practices and policies of Twitter by visiting their Privacy Policy page: https://twitter.com/privacy
• Facebook / Instagram: Facebook remarketing service is provided by Facebook Inc.

You can learn more about interest-based advertising on Facebook by visiting this page: https://www.facebook.com/help/164968693837950. To opt-out of Facebook's interest-based ads, follow these instructions from Facebook: https://www.facebook.com/help/568137493302217. Facebook adheres to the Self-Regulatory Principles for Online Behavioral Advertising established by the Digital Advertising Alliance. You can also opt out from Facebook and other participating companies through the Digital Advertising Alliance in the USA http://www.aboutads.info/choices/, the Digital Advertising Alliance of Canada in Canada http://youradchoices.ca/ or the European Interactive Digital Advertising Alliance in Europe http://www.youronlinechoices.eu/, or opt-out using your mobile device settings. For more information on the privacy practices of Facebook, please visit Facebook's Data Policy: https://www.facebook.com/privacy/explanation.

• AdRoll: AdRoll remarketing service is provided by Semantic Sugar, Inc. You can opt out of AdRoll remarketing by visiting this AdRoll Advertising Preferences web page: http://info.evidon.com/pub_info/573?v=1&nt=1&nw=false For more information on the privacy practices of AdRoll, please visit the AdRoll Privacy Policy web page: http://www.adroll.com/about/privacy.

• Facebook Fan Page: We are the Data Controller of personal data collected while using the Service. As operators of the Facebook Fan Page https://www.facebook.com/mahekalbeachresort, Mahekal Beach Resort and Facebook are Joint Controllers. Visit the Facebook Privacy Policy https://www.facebook.com/policy.php for more information about how Facebook manages personal data or contact Facebook online, or by mail: Facebook, Inc. ATTN, Privacy Operations, 1601 Willow Road, Menlo Park, CA 94025, United States.
• Facebook Insights: uWe use the Facebook Insights function in connection with the operation of the Facebook Fan Page to obtain anonymized statistical data about our users. For this purpose, Facebook places a Cookie on the device of the user visiting our Facebook Fan Page. Each Cookie contains a unique identifier code and remains active for two years, except when it is deleted before the end of this period.

Facebook receives, records, and processes the information stored in the Cookie, especially when the user visits the Facebook services, services that are provided by other members of the Facebook Fan Page, and services by other companies that use Facebook services. For more information on the privacy practices of Facebook, please visit Facebook Privacy Policy here: https://www.facebook.com/full_data_use_policy.

We may update this Privacy Policy at any time and any changes will be effective upon posting. If there are material changes to the way we treat your data, we will display a notice on our website(s), or through other means. You are encouraged to review this Privacy Policy periodically for any changes. Continued use of our website(s) or our Services after any update will constitute your agreement to the new policy.

Mahekal Beach Resort undertakes to respect the confidentiality of your data and to guarantee you can exercise your rights. You have the right under this Privacy Policy, and by law, if you are within the EU, to:

• Request access to your data. You can access, update or request deletion of your data, please contact us and we will attempt to assist you as possible. You also have a right upon request to receive a copy of the personal data we hold about you.
• Request correction of the personal data that we hold about you. You have the right to have any incomplete or inaccurate information we hold about you corrected.
• Object to processing of your data. This right exists where we are relying on legitimate interest as the legal basis for our processing and there is something about your particular situation which makes you want to object to our processing. You also have the right to object to where we are processing your data for direct marketing purposes.
• Request erasure of your data. You have the right to ask us to delete or remove personal data from further processing.
• Request the transfer of your data. We will provide to you, or to a third party you have chosen, your data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw your consent. You have the right to withdraw your consent to use your data. If you withdraw your consent, we may not be able to provide you with access to certain specific functionalities of the Service.

You may exercise your rights of access, rectification, cancellation, and opposition by contacting us via email at reservations@mahekalbeachresort.com or mail at Mahekal Beach Resort Calle 38, Entre Avenida 5A y Zona Federal Maritima, Playa del Carmen, Quintana Roo, Mexico Attn: Comptroller. Please note that we may ask you to verify your identity before responding to such requests. If you make a request, we will try our best to respond to you as soon as possible. You have the right to complain to a Data Protection Authority about our collection and use of your data. For more information please contact your local data protection authority in the EEA.