Notice of Privacy

1. Who is responsible for your personal data?

Knafer S.A. de C.V., operating as Xico Dive Center, is the data controller.

2. Personal data we may collect

Depending on how you interact with Xico, we may collect the following categories of personal data:

• Identity and contact data: name, email address, phone/WhatsApp number, country and other contact details you provide.
• Booking and trip data: preferred dates, group size, participant ages, hotel or pickup information where relevant, itinerary preferences and booking notes.
• Diving and training data: certification level, training agency, logged dives, last-dive date, Nitrox certification, equipment needs, relevant experience and other information needed to assess the suitability of a dive or course.
• Purchase and payment data: products or services purchased, amounts, currency, payment method, payment status, transaction references, refunds and billing/shipping information. Full card details are processed by the applicable payment provider and are not intentionally stored by Xico on the website.
• Communications: messages, inquiries, customer-service history and information you send by website form, email, WhatsApp or other channels.
• Technical and usage data: IP address, browser/device information, pages viewed, timestamps, referral information, cookies and similar identifiers.
• Marketing and attribution data where available: campaign parameters and identifiers such as UTM values, gclid, gbraid, wbraid, fbclid, fbc or fbp.

Sensitive personal data

Scuba diving and certain training activities may require medical screening or proof of fitness to dive. If Xico needs health information, a medical questionnaire, medical certificate or similar health-related data, we will request only what is reasonably necessary for safety, eligibility and legal/operational requirements. Health data is treated as sensitive personal data. Where applicable law requires it, Xico will obtain express consent through a signed, electronic or other legally valid mechanism before processing that information.

Data relating to minors

Xico offers certain activities and courses for children and junior divers. Personal data relating to a minor should be provided by, or with the authorization of, the minor’s parent or legal guardian. We may request age and guardian/contact information where necessary to determine eligibility and operate the service safely.

3. Why we use your personal data

We use personal data for primary purposes that are necessary to manage our relationship with you, including to:

• respond to inquiries and availability requests;
• recommend an appropriate dive, course, package, tour or other service;
• create, manage, modify and support bookings and purchases;
• verify certification, experience, age or other eligibility requirements;
• coordinate boats, guides, instructors, transportation, pickup logistics or third-party providers where required for the service;
• process deposits, payments, refunds and payment-status reconciliation;
• provide customer service before, during and after an activity or purchase;
• maintain operational, accounting, tax, safety and transaction records;
• prevent fraud, abuse, security incidents and misuse of our website or payment systems;
• comply with legal obligations and establish, exercise or defend legal rights.

We may also use contact and website-use information for secondary purposes such as service-improvement analysis, customer feedback, promotions, remarketing or marketing communications where legally permitted. You may ask us to stop using your information for optional marketing purposes at any time by contacting us at info@xicodivecenter.com.

4. Payments

Online payments may be processed by third-party payment providers, including Mercado Pago and PayPal. Those providers process payment information under their own privacy and security terms. Xico may receive and retain limited transaction information such as payment status, amount, currency, transaction reference, payer identity or refund status as needed to manage the transaction and booking.

5. Cookies, analytics and similar technologies

Our website may use cookies, local storage and similar technologies for essential website functions, shopping-cart and checkout behavior, language preferences, security, analytics, advertising attribution and performance measurement. Where analytics or advertising technologies are enabled, information may be shared with the relevant technology provider in accordance with its terms and applicable law.

You can control many cookies through your browser settings and, where a website consent or preference tool is available, through that tool. Blocking certain functional or payment-related technologies may prevent some parts of the website or checkout from working correctly.

6. Service providers and data transfers

We do not sell personal data. We may disclose or transfer personal data only when reasonably necessary for the purposes described in this notice, including to:

• payment processors and financial-service providers;
• website hosting, email, security, technical-support and IT providers acting on our behalf;
• boat operators, guides, instructors, tour operators, transportation providers or other service partners when needed to fulfill the service you requested;
• analytics, advertising or communications providers where those services are enabled and legally permitted;
• professional advisers, insurers, accountants or legal representatives where reasonably necessary;
• government, port, judicial, regulatory or law-enforcement authorities when disclosure is required or permitted by law.

Some service providers may process information outside Mexico. Consent to transfers: where applicable law requires your consent for a transfer described in this notice, you may communicate your refusal before the transfer by emailing info@xicodivecenter.com. Transfers necessary to perform a contract or service requested by you, protect legal rights, comply with law or otherwise fall within a legal exception may be made without additional consent where permitted. If refusing a necessary transfer means we cannot provide a requested service, we will tell you.

7. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes described in this notice and for applicable legal, accounting, tax, safety, contractual, warranty, fraud-prevention or dispute-resolution periods. When data is no longer required, it will be deleted, anonymized or placed into a legally required blocking period, as applicable.

8. Security

Xico applies reasonable administrative, technical and physical measures intended to protect personal data against loss, unauthorized access, misuse, alteration or disclosure. No internet transmission or electronic storage system can be guaranteed to be completely secure, so we also encourage customers to use appropriate precautions when sending information online.

9. Your ARCO rights

Under applicable Mexican data-protection law, you may have rights of Access, Rectification, Cancellation and Opposition (ARCO) regarding your personal data. You may also request revocation of consent or limitation of certain uses or disclosures where legally available.

To submit a privacy or ARCO request, email info@xicodivecenter.com with the subject ARCO / Privacy Request and include:

• your full name and a way for us to contact you;
• information reasonably necessary to verify your identity or representation;
• the ARCO right or privacy request you wish to exercise;
• a clear description of the personal data concerned;
• for rectification requests, the correction requested and supporting documentation where appropriate;
• any information that may help us locate the relevant records.

Under the current Mexican private-sector data-protection law, Xico will communicate its determination on an ARCO request within a maximum of 20 business days from receipt. If the request is granted, it will be made effective within the following 15 business days, subject to any lawful extension, verification requirement, retention obligation or other permitted exception.

10. Limiting use, marketing and revoking consent

You may ask us to stop optional marketing communications or to limit certain non-essential uses of your personal data by emailing info@xicodivecenter.com. You may also revoke consent where the law permits. Revocation does not have retroactive effect and may not apply where Xico must continue processing information to perform a contract, comply with law, protect safety or preserve legal claims.

11. Third-party websites and services

Our website may link to third-party websites, payment platforms, social networks, maps, review platforms or service-provider pages. Their privacy practices are governed by their own notices and policies. Xico is not responsible for a third party’s independent processing of personal data outside Xico’s control.

12. Changes to this Privacy Notice

We may update this Privacy Notice when our services, technology, legal obligations or data-processing practices change. The current version will be published on this page with an updated effective or revision date. Material changes may also be communicated through the website or another reasonable channel where appropriate.

13. Contact