PRIVACY NOTICE

Boutique Concierge DTE MX · Quintana Roo, México Effective 6 September 2026 Applies to: clients, guests and contacts

WHO IS RESPONSIBLE FOR YOUR DATA
Boutique Concierge DTE MX, of Calle Almendros, Selvanova 6, Playa del Carmen, Quintana Roo, México 77725, is responsible for the personal data described in this notice. Questions, requests and complaints may be addressed to info@boutiqueconciergemx.com. This notice explains what we collect, why, who we share it with, how long we keep it, and the rights you may exercise. It applies to clients, their guests and family members, authorised contacts, and prospective clients.

WHAT WE COLLECT

Identity and contact — Full name, date of birth, nationality, phone, email, preferred messaging channel
Addresses — Home and billing address, temporary and travel addresses, property details
Payment — Billing name, card type and last four digits, transaction records, invoices. Full card numbers are handled by our payment processor and are not stored by us.
Health and dietary — Allergies, dietary restrictions, mobility needs, medical conditions relevant to safety, wellness preferences
Family and household — Names and ages of travelling companions and children, staff and household contacts, occasions and anniversaries
Itinerary and location — Flight and transfer details, reservations, dates of travel, pick-up points, whereabouts during an active itinerary
Preferences — Hotel, seating, cuisine, wine and service preferences; past bookings and feedback
Images and handles — Photographs you send us for a booking, social media handles you provide
From third parties — Data shared with us by vendors, your assistant, employer, family office, or the person who booked on your behalf
Where you give us data about another person — a guest, a child, a colleague — you confirm that you are entitled to do so and that they are aware of this notice.

WHY WE USE IT

To fulfil your Service Requests: making bookings, issuing instructions to vendors, arranging transport, and building itineraries.
To keep you safe: passing allergy, medical and mobility information to restaurants, villas, drivers and medical providers so that they can accommodate you.
To bill and to keep accounting, tax and legal records.
To personalise service by remembering your preferences between engagements.
To communicate with you about active requests, and — only with your consent — about our services.
To respond to emergencies, resolve disputes and defend legal claims.

We rely on the performance of our agreement with you, our legitimate interest in operating and improving the service, compliance with legal obligations, and — for sensitive data and for marketing — your express consent. We do not sell personal data, and we do not use it for automated decision-making or profiling that produces legal effects.

SENSITIVE DATA

Health, allergy, dietary and disability information is sensitive. We collect it only where you volunteer it or where it is necessary to arrange a service safely, we use it only for that purpose, we share only the specific detail a vendor needs, and we keep it separately access-restricted. You may ask us to delete it at any time, understanding that we may then be unable to arrange certain services

WHO WE SHARE IT WITH

Third-Party Providers, on a strict need-to-know basis and only the fields required for the booking. Once shared, that provider handles your data under its own privacy policy.
Payment processors, who receive card data directly. We receive only a tokenized reference and the last four digits.
Service infrastructure — email, messaging, cloud storage, booking and accounting platforms — under contracts restricting their use of your data to providing the service to us.
Professional advisers and authorities, where required by law, court order, or to protect life.

Because travel is international, your data may be transferred to and processed in countries other than your own, including where a vendor or platform is located. We take reasonable steps to require appropriate safeguards and confidentiality from recipients.

HOW LONG WE KEEP IT

Active client records are kept for the duration of the relationship and for 5 years afterwards, to serve returning clients and to defend claims. Financial and tax records are kept for the period required by law. Sensitive health data is deleted on request or when it is no longer needed for a planned service. Marketing consents are kept until withdrawn. Data no longer needed is deleted or irreversibly anonymised.

HOW WE PROTECT IT

We apply access controls on a need-to-know basis, encrypted storage and transmission, multi-factor authentication on business accounts, written confidentiality undertakings from every employee and contractor, vendor due diligence, and periodic review of what we hold. Discretion is a core part of our service, and our internal practice is to record only what a request genuinely requires. No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the relevant authority without undue delay, describing what happened, what data was involved, and what we are doing about it.

YOUR RIGHTS
Subject to the law applicable to you, you may ask us to:

Access the personal data we hold about you and how we use it;
Rectify data that is inaccurate or incomplete;
Cancel or delete data we no longer need to hold;
Object to or restrict particular uses, including marketing;
Withdraw consent at any time, without affecting processing already carried out;
Port your data to another provider in a structured, commonly used format;
Complain to your national data protection authority.

Write to info@boutiqueconciergemx.com with enough detail to identify yourself and your request. We respond within 20 business days at no charge. Where a request would prevent us from delivering a service you have booked, we will tell you before acting.

MINORS

We do not offer services directly to minors. Where a booking involves children, we collect their details from the parent, guardian or authorised adult, limit collection to what the booking requires (name, age, dietary and safety needs), and delete it on the same schedule as the related engagement.

CHANGES TO THIS NOCTICE

We may update this notice as our services and obligations change. The current version and its effective date are always available on request and at boutiqueconciergemx.com/privacy. Material changes will be notified to active clients by email.

PRIVACY NOTICE

Boutique Concierge DTE MX · Quintana Roo, México Effective 6 September 2026 Applies to: clients, guests and contacts

WHAT WE COLLECT

Identity and contact — Full name, date of birth, nationality, phone, email, preferred messaging channel

Addresses — Home and billing address, temporary and travel addresses, property details

Payment — Billing name, card type and last four digits, transaction records, invoices. Full card numbers are handled by our payment processor and are not stored by us.

Health and dietary — Allergies, dietary restrictions, mobility needs, medical conditions relevant to safety, wellness preferences

Family and household — Names and ages of travelling companions and children, staff and household contacts, occasions and anniversaries

Itinerary and location — Flight and transfer details, reservations, dates of travel, pick-up points, whereabouts during an active itinerary

Preferences — Hotel, seating, cuisine, wine and service preferences; past bookings and feedback

Images and handles — Photographs you send us for a booking, social media handles you provide

From third parties — Data shared with us by vendors, your assistant, employer, family office, or the person who booked on your behalf

Where you give us data about another person — a guest, a child, a colleague — you confirm that you are entitled to do so and that they are aware of this notice.

WHY WE USE IT

To fulfil your Service Requests: making bookings, issuing instructions to vendors, arranging transport, and building itineraries.

To keep you safe: passing allergy, medical and mobility information to restaurants, villas, drivers and medical providers so that they can accommodate you.

To bill and to keep accounting, tax and legal records.

To personalise service by remembering your preferences between engagements.

To communicate with you about active requests, and — only with your consent — about our services.

To respond to emergencies, resolve disputes and defend legal claims.

SENSITIVE DATA

WHO WE SHARE IT WITH

Third-Party Providers, on a strict need-to-know basis and only the fields required for the booking. Once shared, that provider handles your data under its own privacy policy.

Payment processors, who receive card data directly. We receive only a tokenized reference and the last four digits. ​

Service infrastructure — email, messaging, cloud storage, booking and accounting platforms — under contracts restricting their use of your data to providing the service to us.

Professional advisers and authorities, where required by law, court order, or to protect life.

Because travel is international, your data may be transferred to and processed in countries other than your own, including where a vendor or platform is located. We take reasonable steps to require appropriate safeguards and confidentiality from recipients.

HOW LONG WE KEEP IT

HOW WE PROTECT IT

YOUR RIGHTS Subject to the law applicable to you, you may ask us to:

Access the personal data we hold about you and how we use it;

Rectify data that is inaccurate or incomplete;

Cancel or delete data we no longer need to hold;

Object to or restrict particular uses, including marketing;

Withdraw consent at any time, without affecting processing already carried out;

Port your data to another provider in a structured, commonly used format;

Complain to your national data protection authority.

Write to info@boutiqueconciergemx.com with enough detail to identify yourself and your request. We respond within 20 business days at no charge. Where a request would prevent us from delivering a service you have booked, we will tell you before acting.

MINORS

We do not offer services directly to minors. Where a booking involves children, we collect their details from the parent, guardian or authorised adult, limit collection to what the booking requires (name, age, dietary and safety needs), and delete it on the same schedule as the related engagement.

CHANGES TO THIS NOCTICE

We may update this notice as our services and obligations change. The current version and its effective date are always available on request and at boutiqueconciergemx.com/privacy. Material changes will be notified to active clients by email.

Payment processors, who receive card data directly. We receive only a tokenized reference and the last four digits.

YOUR RIGHTS
Subject to the law applicable to you, you may ask us to: