Privacy Policy
Yacana Expediciones y Cultura S.A.S. de C.V. ("Yacana," "we," "us") respects your privacy and is committed to protecting the personal data you share with us. This notice explains what we collect, why, who we share it with, and the rights you have over your data. It is issued in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP") and its regulations.
01 Who is responsible for your data
The party responsible for processing your personal data (the responsable) is:
02 What personal data we collect
Depending on how you interact with us — through our website, WhatsApp, email, a booking, or a trip — we may collect:
- Identification and contact data: name, email address, telephone/WhatsApp number, country of residence, and your emergency contact's name and number.
- Trip and logistics data: the trip and dates you're interested in, accommodation details, dietary requirements, and gear sizing for rentals.
- Health and physical-condition data (sensitive): fitness level, relevant medical conditions, allergies, medications, prior altitude experience, and similar information you provide on our questionnaires and waivers.
- Payment data: the information needed to process deposits and balances. Card payments are handled by our payment processor; we do not store full card numbers after a transaction.
- Identity / travel documents: where required for park permits, refuges, insurance, or international expeditions (e.g., ID or passport details).
- Images and audiovisual material: photographs and video taken during trips.
- Website and usage data: IP address, device and browser information, and cookie data when you use our website.
03 Sensitive personal data
Mountaineering is a physical activity carried out at altitude and in remote terrain. We collect health and physical-condition information because it is necessary for your safety — it lets our guides assess suitability, plan appropriately, and respond in an emergency.
We treat this information as sensitive personal data under the LFPDPPP. We process it only for safety and trip-delivery purposes, we limit access to the guides and staff who need it, and we ask for your express consent when you complete our health questionnaire or waiver. You may decline to provide it; however, for safety reasons this may prevent us from accepting you on a trip.
04 How we use your data (purposes)
Primary purposes — necessary to provide our services
- Respond to your enquiries and prepare quotes.
- Book, organise, and run your trip, including transport, lodging, permits, and gear.
- Assess suitability and plan for your safety, and act in a medical or mountain emergency.
- Process payments, deposits, refunds, and invoicing.
- Communicate with you about your booking and provide customer support.
- Comply with our legal, tax, and insurance obligations.
Secondary purposes — you may opt out at any time
- Send you marketing, offers, and newsletters.
- Use trip photographs and video, and your testimonials/reviews, in our marketing and on our website and social media.
- Send satisfaction surveys and request feedback.
If you do not want your data used for any secondary purpose, tell us at [email protected] — this will not affect your trip.
05 Photographs and video
We often photograph and film our trips and use this material to show what our expeditions are really like. If you would prefer not to appear in our marketing, let your guide know or email us before or after your trip and we will not use, and will remove where reasonably possible, images in which you are identifiable.
06 Who we share your data with (transfers)
We do not sell your personal data. We share it only as needed to deliver your trip and run our business:
- Our guides and operational staff, who need it to run your trip safely.
- Emergency, medical, and insurance providers, where necessary to protect your health or life, or to manage an incident.
- Service providers acting on our behalf (data processors), such as our payment processor, our CRM and website platform, email and messaging tools, and analytics providers.
- Logistics partners — transport, lodging, mountain refuges, park operators, and gear-rental partners — strictly as needed for your trip.
- Authorities, where required by law or for park and protected-area permits.
Transfers that are necessary to provide the service, that go to a provider acting on our behalf, or that the law permits, do not require your separate consent. Any other transfer will be made only with your consent.
07 International data transfers
Some of our service providers (for example, our website, CRM, and messaging tools) operate outside Mexico, including in the United States. This means your data may be processed abroad. Where we do this, we take reasonable steps to require those providers to protect your data consistently with this notice and applicable law.
08 Cookies and analytics
Our website uses cookies and similar technologies to make the site work, remember your preferences, and understand how it is used. You can control or disable cookies through your browser settings; some features may not work properly if you do.
09 How long we keep your data
We keep your personal data only for as long as needed for the purposes above and to meet our legal and tax obligations (for example, accounting records we are required to retain). When data is no longer needed, we delete or anonymise it.
10 How we protect your data
We maintain reasonable administrative, technical, and physical safeguards to protect your personal data against loss, misuse, and unauthorised access. No system is perfectly secure, but we work to keep your information protected.
11 Your rights (ARCO) and consent
You have the right to Access your personal data, Rectify it when inaccurate, Cancel (delete) it, and Object to its use — the "ARCO" rights. You may also revoke your consent, or limit the use or disclosure of your data, at any time.
To exercise any of these rights, email [email protected] with your name, a way to contact you, a copy of an ID to confirm your identity, and a clear description of the data and the right you wish to exercise. We will respond within the timeframes set by the LFPDPPP. Revoking consent or objecting to certain processing may mean we can no longer provide a trip where that data is essential to your safety.
12 Minors
Our services are intended for adults. Where a minor takes part in a trip, we require the consent of a parent or legal guardian, who is responsible for providing and authorising the minor's information, including any health data.
13 Changes to this notice
We may update this notice to reflect changes in our practices or in the law. The current version is always published on this page with its "Last updated" date. Material changes will be communicated here, and where appropriate, by email.
14 Contact
Questions about this notice or about how we handle your data? Contact us at [email protected] or in writing at our registered domicile above. If you are in Mexico and believe your rights have not been respected, you may also contact the competent data-protection authority.