Who We Are
Quetzal Liveaboard ("Quetzal," "we," "our," or "us") operates the website quetzalliveaboard.com and provides liveaboard diving expeditions in Mexican waters, operating out of La Paz, Baja California Sur, Mexico.
For the purposes of applicable data protection laws, Quetzal Liveaboard is the data controller responsible for your personal information.
Jurisdiction & Governing Law
This Privacy Policy is governed by the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on Protection of Personal Data Held by Private Parties) of the United Mexican States. By using our website and services, regardless of your country of residence, you consent to the processing of your data in accordance with Mexican law.
For citizens of the European Union, the General Data Protection Regulation (GDPR) also applies to the extent that we process personal data of EU residents. We are committed to upholding the rights granted under both Mexican law and the GDPR.
What Data We Collect
To provide our services effectively, we collect the following categories of personal information:
- Identity & Contact: Full name, email address, phone number, mailing address, and country of residence.
- Travel Documents: Passport number, nationality, and date of birth — required by Mexican maritime authorities for passenger manifests.
- Diving & Medical: Diving certification level and agency, logged dive count, relevant medical conditions, dietary restrictions, and emergency contact details.
- Payment Information: Credit card details, billing address, and transaction history. Full card numbers are not stored on our servers; they are processed by our PCI-compliant payment gateways.
- Travel Preferences: Cabin type preference, dive gear rental requests, and special occasion notes.
- Communication Records: Emails, WhatsApp messages, contact form submissions, and phone call summaries.
How We Collect It
We collect your personal information through the following channels:
- Booking & Contact Forms: When you book an expedition or submit an inquiry through our website.
- Direct Communication: Via email, WhatsApp, phone calls, or social media messages.
- Automated Technologies: Cookies, server logs, and analytics tools when you browse our website.
- Third Parties: Travel agencies or dive operators who book on your behalf with your consent.
Server Logs & Analytics
When you visit our website, our servers automatically record certain information sent by your browser. This may include your IP address, browser type and version, operating system, screen resolution, referring URL, pages visited, and the date and time of your visit.
We use Google Analytics and similar tools to understand how visitors interact with our website. These services use cookies to collect anonymized data about traffic patterns and user behavior. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
How We Use Your Data
We use your personal information for the following purposes:
- Booking & Service Delivery: To process your reservation, confirm your expedition, communicate itinerary details, and provide the services you have purchased.
- Legal Compliance: To submit passenger manifests to Mexican maritime and port authorities as required by law (Ley de Navegación y Comercio Marítimos).
- Safety & Emergencies: To ensure we have accurate medical and emergency contact information in case of an incident during your expedition.
- Customer Support: To respond to your inquiries, resolve issues, and provide pre-trip and post-trip assistance.
- Marketing Communications: With your explicit consent, to send you newsletters, special offers, and trip announcements. You may unsubscribe at any time.
- Service Improvement: To analyze aggregated data and improve our website, offerings, and customer experience.
Cookies
Our website uses cookies and similar technologies to enhance your browsing experience. We use:
- Essential Cookies: Required for the website to function — session management, security, and booking flow.
- Analytics Cookies: Google Analytics and similar services to measure site usage and performance.
- Preference Cookies: To remember your language selection and display preferences.
Data Storage & Security
Your personal data is stored on secure servers with industry-standard encryption. We implement technical and organizational measures — including SSL/TLS encryption for all data in transit, firewalls, access controls, and secure authentication — to protect your information against unauthorized access, alteration, disclosure, or destruction.
Payment information is processed by PCI-DSS compliant payment processors. We do not store complete credit card numbers on our systems.
Third-Party Sharing
We do not sell, rent, or trade your personal information to third parties. We share data only in the following limited circumstances:
- Payment Processors: Stripe processes your payments. Stripe receives only the transaction data necessary to complete the payment.
- Maritime Authorities: Passenger manifests are submitted to Mexican port authorities (Capitanía de Puerto) and immigration authorities as required by law.
- Service Providers: Trusted vendors who assist with email delivery, website hosting, and analytics — bound by data processing agreements.
- Legal Obligations: When required by law, court order, or government regulation.
Your ARCO Rights (Mexico)
Under Mexican law, you have the following rights regarding your personal data (known as ARCO rights):
- Access: Request confirmation of whether we process your personal data and obtain a copy.
- Rectification: Request correction of inaccurate or incomplete data.
- Cancellation: Request deletion of your data when it is no longer needed for the purposes it was collected.
- Opposition: Object to the processing of your data for specific purposes, including direct marketing.
Your GDPR Rights (EU Residents)
If you reside in the European Union, you have additional rights under the GDPR:
- Right to data portability in a structured, machine-readable format.
- Right to restrict processing under certain conditions.
- Right to withdraw consent at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint with your local data protection supervisory authority.
Your CCPA Rights (California Residents)
If you are a resident of California, USA, the California Consumer Privacy Act (CCPA) grants you specific rights regarding your personal information. We collect the following categories of personal data: identifiers (name, email, phone, address), commercial information (booking records, transaction history), internet activity (browsing data, analytics), and geolocation data (IP-based country/city).
We do NOT sell your personal information to third parties. We do not share data with advertisers, data brokers, or analytics companies beyond what is strictly necessary to operate our services.
- Right to Know: Request disclosure of the categories and specific pieces of personal data we have collected about you over the past 12 months.
- Right to Delete: Request deletion of your personal data, subject to legal exceptions (e.g., completing a transaction, complying with legal obligations).
- Right to Opt-Out: You have the right to opt out of the sale of your personal data. Since we do not sell data, this right is automatically satisfied.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
Data Retention
We retain your personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by Mexican law. Booking and financial records are retained for a minimum of 5 years per tax and maritime regulations. Marketing consent data is retained until you withdraw consent. Server logs and analytics data are retained for up to 26 months.
Contact Us
To exercise your ARCO, GDPR, or CCPA rights, or if you have questions about this Privacy Policy, contact us at:
- Email: info@quetzalliveaboard.com
- Phone: +52 (612) XXX-XXXX
- Address: La Paz, Baja California Sur, Mexico
