Privacy Policy

Sail Baja Adventures (“we”, “us”, “our”) is a Mexican catamaran tour and charter business operating out of Marina Cabo San Lucas, Dock F, in Cabo San Lucas, Baja California Sur, Mexico. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you interact with us — whether through our website, by booking a tour, by contacting us, or in person at the marina.

This policy is designed to comply with:

• Mexico: Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).
• European Union: General Data Protection Regulation (GDPR).
• California, USA: California Consumer Privacy Act (CCPA) and CPRA.

If you have questions about anything below or want to exercise your rights, contact our Privacy Officer at YOUR_PRIVACY_EMAIL_HERE.

We collect the minimum information necessary to provide our services. Specifically:

Booking information. When you book a tour or charter, we collect your full name, email address, phone number, date of the tour or charter, group size, names and ages of additional guests (for safety and headcount purposes), and any dietary restrictions or accessibility needs you share with us.

Payment information. We process payments through third-party providers (Stripe, PayPal, and similar). We do not store your full credit card or bank account details on our servers. We retain transaction records (date, amount, last 4 digits of the card, payment provider reference) for accounting, tax, and dispute-resolution purposes.

Contact information. When you send us a message through our contact form, by email, by WhatsApp, or by phone, we collect the information you choose to share — your name, contact details, and the contents of your message.

Website usage data. When you visit sailbaja.com, we automatically collect technical data including your IP address, browser type and version, operating system, referring page, pages viewed on our site, and timestamps. This is collected through cookies and analytics tools (described in detail in the Cookies section below).

Photos and video. During tours, our crew sometimes takes photos and video for marketing purposes. If you appear identifiably in any image we want to use on our website or social media, we ask permission before publishing. You can always tell us beforehand if you do not want to be photographed.

Marketing preferences. If you opt in to receive newsletters or promotional emails, we record your consent, the date you gave it, and your communication preferences.

We use your information for the following purposes:

• To deliver the services you booked. Process your reservation, communicate logistics, prepare for your tour, provide on-board services.
• To process payments and prevent fraud. Through our payment processors, in line with their own security standards.
• To communicate with you. Respond to your inquiries, send booking confirmations, share tour-related updates, and follow up after your experience.
• To comply with legal obligations. Mexican tax law, customs regulations, port authority requirements, and similar.
• To improve our services. Anonymized analytics help us understand which parts of our website are useful, where guests come from, and how to better serve future visitors.
• For marketing (only if you opt in). Newsletters, promotional offers, seasonal updates, and similar. You can unsubscribe at any time.

Legal basis for processing (GDPR): We process your data under one of the following bases: (1) contractual necessity, to fulfill your booking, (2) consent, for marketing and non-essential cookies, (3) legal obligation, for tax and regulatory compliance, or (4) legitimate interest, for fraud prevention and service improvement.

We do not sell your personal information to anyone. Ever. We share data only with the third parties necessary to provide our services or comply with the law:

• Payment processors (Stripe, PayPal, etc.), to process your payment securely.
• Email service providers to send booking confirmations and communications.
• Analytics providers (Google Analytics, Meta Pixel where applicable), in anonymized or pseudonymized form.
• Hosting and infrastructure providers our website is hosted by HostGator and similar providers who have access to data only to the extent needed to operate the infrastructure.
• Mexican government authorities tax authorities (SAT), port authority, and similar, only when legally required.
• Booking platforms (if you booked through a third party like Viator, GetYourGuide, etc.), we share confirmation status and any logistics information they need to support you.
• Custom event vendors, for weddings, corporate events, and similar, where you have engaged us to coordinate with caterers, florists, photographers, etc.

Each of these third parties is bound by their own privacy policies and, where applicable, by data processing agreements with us.

Our business is based in Mexico, but many of our service providers (Stripe, Google, Meta, HostGator) are based in the United States or other countries. When your personal data is transferred outside of Mexico, the European Economic Area, or the United Kingdom, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission.
• Adherence to the EU-U.S. Data Privacy Framework where applicable.
• Compliance with the data transfer requirements of LFPDPPP for transfers from Mexico.

We retain personal data only as long as necessary for the purposes outlined in this policy:

• Booking and transaction records: 10 years, as required by Mexican tax law (Article 30 of the Código Fiscal de la Federación).
• Contact form submissions and email correspondence: 3 years from the date of last interaction, then deleted.
• Marketing data (if you opted in): Until you unsubscribe or 3 years of inactivity, whichever comes first.
• Website analytics: 26 months in aggregated and pseudonymized form, then anonymized or deleted.
• Photos and video used in marketing: Indefinitely, unless you request removal (see Your Rights below).

You have the following rights regarding your personal data. To exercise any of them, contact us. We respond within 20 calendar days (LFPDPPP) or 30 days (GDPR/CCPA).

Right to access. Request a copy of the personal data we hold about you.

Right to rectification. Ask us to correct any inaccurate or incomplete data.

Right to erasure (“right to be forgotten”). Ask us to delete your data when it is no longer needed for the purpose it was collected, or when you withdraw consent. Note that some data must be retained for tax and legal reasons (see retention periods above).

Right to restrict processing. Ask us to limit how we use your data while a dispute or request is being resolved.

Right to data portability. Receive your data in a structured, machine-readable format and have it transmitted to another service.

Right to object. Object to processing based on legitimate interest or for direct marketing purposes.

Right to withdraw consent. Where processing is based on consent, withdraw it at any time without affecting prior processing.

CCPA-specific rights (California residents). Right to know what personal information is collected and shared, right to delete, right to opt out of the sale or sharing of personal information (we do not sell, but you can confirm), and the right to non-discrimination for exercising these rights.

To exercise any of these rights, send us a request with proof of identity (a scan of an ID document, partially redacted). We will not charge a fee unless your request is manifestly unfounded, excessive, or repetitive.

Our website uses cookies to function properly and to help us understand how guests use the site. The categories of cookies we use:

• Essential cookies. Required for the website to work (session management, security, language preferences). These cannot be disabled.
• Analytics cookies. Help us understand which pages are visited, how long people stay, and where guests come from. We use Google Analytics for this purpose, in pseudonymized form.
• Marketing cookies. Used to show you relevant ads on third-party platforms (Meta/Facebook, Google Ads) if you have visited our site. These are only set if you consent.

You can control cookies through your browser settings and through the cookie consent banner that appears on your first visit. You can change your preferences at any time by clearing your cookies or revisiting the consent banner.

We take reasonable and appropriate measures to protect your personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction:

• Our website uses SSL/TLS encryption for all data transmitted between your browser and our servers.
• Payment processing is handled by PCI-DSS compliant providers (Stripe, PayPal).
• Access to personal data within our team is restricted to those who need it to perform their role.
• Our hosting providers maintain physical and technical security measures including firewalls, intrusion detection, and regular security updates.
• We do not store sensitive payment details (full card numbers, CVV, etc.) on our own systems.

No system is completely secure. If we become aware of a data breach affecting your personal information, we will notify you and the appropriate authorities (Mexican INAI, EU Data Protection Authorities, California Attorney General) within the legally required timeframes.

Our services are intended for adults. We do not knowingly collect personal information from children under 13 (under 16 in some jurisdictions including the EU). When children participate in our tours, the booking is always made by a parent or guardian, who is responsible for any data shared about the child.

If you believe we have inadvertently collected personal data from a child, contact us immediately and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page.
• Notify you by email if we have your contact information and the change materially affects how we process your data.
• Where required by law (typically for material changes), seek your renewed consent.

We encourage you to review this policy periodically.

Questions, requests, or complaints about this policy or how we handle your personal data? Contact our Privacy Officer:

Mailing address: Sail Baja Adventures, Marina Cabo San Lucas, Dock F, Cabo San Lucas, BCS 23410, Mexico

For Mexican residents: If you believe your data protection rights have been violated, you have the right to file a complaint with the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) at inai.org.mx.

For EU/UK residents: You have the right to lodge a complaint with your local data protection authority.

For California residents: Contact the California Attorney General’s office at oag.ca.gov/privacy.