1. Who Is Responsible for Your Personal Information?
Gestoría Turística de México, S.A. de C.V., operating under the trade name Tulum Transport Company ("TTC," "we," "us" or "our"), is responsible for the personal information described in this Privacy Policy.
Our privacy address is Carretera Federal 307 (Cancún–Chetumal), kilómetro 201, ejido de Chunyaxché, C.P. 77150, Felipe Carrillo Puerto, Quintana Roo, México.
Privacy questions and requests are handled by the TTC Privacy and Customer Service Department at reservations@tulumtransportcompany.com.
2. Scope of This Privacy Policy
This Privacy Policy applies to personal information submitted through tulumtransport.company, transfer request forms, the TTC online booking system, email, telephone, WhatsApp and other direct communications with TTC regarding transportation services.
It also explains the website technologies and external services that may process technical information when you visit or interact with the website.
Third-party websites and platforms have their own privacy practices. This Privacy Policy does not replace the privacy notices provided by Stripe, PayPal, BBVA, Google, WhatsApp, Avionio, TikTok or other independent providers.
3. Personal Information We May Process
Identification and Contact Information
- Full name.
- Email address.
- Telephone number and country code.
- Preferred language.
- Information included in communications with TTC.
Reservation and Travel Information
- Type of transfer or service requested.
- Booking or payment reference.
- Arrival and departure dates.
- Airport.
- Airline and flight number.
- Pickup and drop-off location.
- Hotel, villa, Airbnb or other property information.
- Number of adults and children.
- Passenger and luggage information needed to select a vehicle category.
- Child-seat or operational assistance requests.
- Comments and custom transfer details.
Transaction Information
- Payment status.
- Transaction reference.
- Amount and currency.
- General payment method.
- Information needed for payment reconciliation and accounting.
Complete card numbers, security codes and other sensitive payment credentials are entered by the user through the applicable payment gateway. TTC employees do not request or receive complete card credentials through WhatsApp or email.
Website and Technical Information
- IP address.
- Browser and device characteristics.
- Operating system.
- Language and general location settings.
- Pages visited.
- Referring URL.
- Date and time of visits.
- Interaction with booking and WhatsApp buttons.
- Cookie or measurement identifiers.
- Consent preferences.
- Conversion and website performance information.
Some technical information may be collected automatically by the website platform, Google Tag Manager, Google Analytics, Google Ads or embedded third-party services.
Sensitive Personal Information
TTC does not intentionally request medical diagnoses, government identification numbers, complete payment-card credentials or other sensitive personal information through general website fields. Please do not include this information in the Custom Request Details or Comments fields.
If operational accessibility assistance is required, provide only the minimum information necessary to describe the transportation or vehicle-access requirement. Contact Customer Service before sending health-related information so TTC can determine an appropriate method and whether additional consent is required.
4. How Information Is Collected
- Directly from the user through the request form.
- Through the online booking system.
- Through email, telephone or WhatsApp.
- Through payment confirmations from Stripe, PayPal or BBVA.
- Automatically through website technologies and Google measurement tools.
- Through embedded services when the user loads or interacts with them.
- From a representative or travel organizer acting for the passenger.
If you provide information about another passenger, you are responsible for ensuring that you are authorized to provide it and that the passenger has access to this Privacy Policy.
5. Purposes of Processing
Primary purposes
- Respond to transfer inquiries.
- Prepare and review quotations.
- Follow up on an active quotation or incomplete reservation requested by the user.
- Create, confirm and administer reservations.
- Verify travel, passenger, luggage and pickup information.
- Coordinate vehicles, drivers and Customer Service follow-up.
- Monitor arrival flight information when it is relevant to a reserved transfer.
- Communicate operational updates.
- Process and reconcile payments.
- Provide receipts and service confirmations.
- Respond to questions, changes, cancellations and refund requests.
- Maintain operational, accounting and legal records.
- Prevent misuse, fraud and unauthorized access.
- Comply with contractual and legal obligations.
- Exercise or defend TTC's legal rights.
Secondary purposes
With the user's website preferences, TTC may use Google Analytics and Google Ads technologies to understand website usage, measure booking and WhatsApp interactions, evaluate advertising performance and improve the website.
TTC will not use information submitted through the website form for unrelated promotional messages unless separate authorization has been obtained. Refusing secondary purposes does not prevent a user from requesting or receiving transportation services.
Options to refuse: Reject analytics and advertising technologies in the consent banner; reopen Cookie Preferences; or email reservations@tulumtransportcompany.com to object to promotional use or withdraw authorization.
6. Reservations, Payments and Financial Providers
TTC's online reservation system is available at payment.tulumtransportcompany.com. Payments may be completed through Stripe, PayPal or a bank transfer to BBVA México, depending on the option presented to the user.
Payment providers process payment credentials and financial information under their own privacy notices, security procedures and legal obligations. TTC may receive transaction references, payment status, amount, currency and other limited information needed to identify and reconcile the reservation.
TTC employees do not request complete card numbers or CVV security codes by email, telephone or WhatsApp. Users should not send this information through TTC communication channels.
8. External Platforms and Service Providers
| Provider | Purpose |
|---|---|
| Landingsite / hosting infrastructure | Website hosting and delivery of website form submissions |
| Stripe | Payment processing |
| PayPal | Payment processing |
| BBVA México | Bank-transfer processing |
| Google Tag Manager / Google Analytics / Google Ads | Website analytics and advertising measurement |
| Google My Maps | Service-area map |
| Avionio | Airport flight board |
| WhatsApp / Meta | User-initiated communications |
| TikTok | Embedded or externally linked video content |
| Email and infrastructure providers | Delivery and storage of business communications |
| Image and content delivery networks | Delivery of website images and technical resources |
Provider privacy links: Landingsite, Google, WhatsApp, Avionio.
9. Sharing and International Processing
TTC may disclose or make information available to service providers and business systems when necessary to operate the website, process a transfer request, administer a reservation, coordinate transportation, process payments, maintain records, prevent fraud or comply with legal obligations.
Payment, analytics, communication, hosting and embedded-content providers may process information in Mexico, the United States or other jurisdictions where they or their service providers operate. Their processing is subject to their own privacy terms and applicable legal obligations.
TTC may also disclose information when required by a competent authority, legal process or applicable law, or when reasonably necessary to protect the rights, safety or property of TTC, its passengers, personnel or other persons.
10. Data Retention
TTC retains personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy and to meet applicable operational, contractual, accounting, tax, dispute-resolution and legal requirements.
The retention period may depend on the type of information, the status of a quotation or reservation, the duration of the customer relationship, applicable limitation periods, payment and accounting obligations, security needs and backup cycles.
When information is no longer necessary and no legal or operational reason requires its continued retention, TTC will take reasonable steps to delete, anonymize or block access to the information, as appropriate. Information stored in periodic backups may remain isolated until the corresponding backup cycle is replaced.
11. Security Measures
TTC applies administrative and technical controls intended to reduce unauthorized access to personal information. Access to operational systems is limited to personnel authorized by management. User accounts are protected by usernames and passwords, and system permissions are assigned according to work responsibilities.
TTC's system provider performs periodic backups. When a collaborator no longer works with TTC or no longer requires access, the corresponding system access is blocked or removed.
Complete card credentials are processed through the applicable payment gateway and are not requested by TTC employees through WhatsApp or email.
No method of transmission or electronic storage can be guaranteed to be completely secure. Users should avoid sending unnecessary sensitive information through open-text fields or communication channels.
12. ARCO Rights and Privacy Requests
As permitted by applicable law, users may exercise rights of access, rectification, cancellation and opposition (ARCO), revoke consent, or request a limitation on the use or disclosure of personal information.
To submit an ARCO request, revoke consent or request a limitation on the use or disclosure of personal information, contact the TTC Privacy and Customer Service Department at reservations@tulumtransportcompany.com. Use "ARCO / Privacy Request" as the recommended subject line.
The request should include:
- Full name.
- Email or other method for receiving notifications.
- A clear description of the personal information involved.
- The right or action requested.
- Information that helps TTC locate the relevant reservation, communication or record.
- If acting through a representative, information sufficient to establish the representation.
TTC may request reasonable information to verify the identity of the requester and protect personal information from unauthorized disclosure. Do not send government identification documents until TTC confirms an appropriate verification method.
TTC will communicate its determination within a maximum of 20 days after receiving a complete ARCO request. If the request is granted, TTC will make it effective within the following 15 days. These periods may be extended once when legally justified, and the requester will be informed.
For reference, the Federal Law on the Protection of Personal Data Held by Private Parties provides relevant context on these rights in Mexico.
13. Children and Passenger Information
TTC's website and booking services are intended for adults arranging transportation. TTC does not knowingly ask children to submit personal information directly through the website.
A responsible adult may provide the number of child passengers and request child-seat or transportation assistance information when arranging a transfer. TTC does not request children's names, medical diagnoses or identification documents through the general website form.
The adult making the reservation is responsible for providing only the information reasonably necessary to coordinate the service.
14. Changes to This Privacy Policy
TTC may update this Privacy Policy when its services, systems, providers or legal obligations change. The current version will remain available at /privacy-policy, and the "Last updated" date will identify the effective version.
If a change materially affects how personal information already collected is used, TTC will provide an appropriate notice or request additional consent when required.