Privacy Policy / Aviso de Privacidad

[LEGAL ENTITY NAME], with its registered address at Esquina Calle San Felipe, Smza 8, Isla Mujeres, C.P. 77400, Quintana Roo, Mexico ("DeNuccio's Estate," "we," "us"), is the party responsible (responsable) for the processing of your personal data, as that term is used in the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP").

This notice explains what personal data we collect through denucciosestate.com, why we collect it, who we share it with, where it goes, and how you can control it.

Questions about this notice, or requests relating to your data, go to stay@denucciosestate.com.

When you make a reservation:

• Full name
• Email address
• Telephone number
• Country or city of residence
• Number of guests and names of additional guests in your party, if you provide them
• Arrival and departure dates and the accommodation configuration you select
• Any notes, special requests, or accessibility needs you choose to share with us

When you pay:

We do not collect or store your full payment card number, expiration date, or security code. Payment is processed by our payment provider, and card details are entered directly into their systems. We receive only a transaction reference, the amount, the payment status, and the last four digits of the card used.

When you contact us:

The contents of messages you send through our contact form or by email, and our replies.

Automatically, when you visit the site:

• IP address
• Browser type and version, device type, and operating system
• Pages viewed, time spent, and the site or search that referred you
• Cookie and similar identifiers (see Section 9)

We do not intentionally collect sensitive personal data as defined by the LFPDPPP (health, religious or political beliefs, ethnic origin, sexual orientation, and similar). Please do not include such information in free-text fields unless it is genuinely necessary for us to accommodate you — for example, an accessibility requirement. If you do, you are giving us your express consent to use it for that purpose only.

Primary purposes — these are necessary to provide the service you asked for, and we cannot deliver your reservation without them:

• Creating, confirming, modifying, and cancelling your reservation
• Processing payments, deposits, balances, and refunds
• Sending transactional email: reservation confirmations, balance reminders, arrival instructions, and receipts
• Communicating with you about your stay before, during, and after it
• Preparing the property and arranging staffing for your arrival
• Keeping accounting and tax records required by Mexican law
• Detecting and preventing fraud, chargebacks, and misuse of the site
• Resolving disputes and enforcing our Terms and Conditions

Secondary purposes — these are not necessary to provide your reservation, and you may refuse them without affecting your booking in any way:

• Sending you occasional email about availability, seasonal rates, or property news
• Inviting you to leave a review after your stay
• Analyzing site traffic in aggregate to improve the website

To refuse the secondary purposes, email stay@denucciosestate.com with the subject line "Limitación de uso" at any time, or use the unsubscribe link in any marketing email. Refusing costs you nothing and changes nothing about your reservation.

We do not sell your personal data. We share it only with the service providers that make the website and your reservation work:

We may also disclose data where we are legally required to — to Mexican tax, immigration, or judicial authorities, or where disclosure is necessary to protect the safety of guests, staff, or the property.

DeNuccio's Ristorante operates on the same grounds but is a separate business. We do not transfer your reservation data to the restaurant except where you ask us to arrange something on your behalf, such as a dinner reservation or a private event.

Please read this section carefully. By submitting a reservation, you expressly consent to it.

The providers listed above process data on servers located outside Mexico, principally in the United States. This means your personal data will be transferred internationally. Under the LFPDPPP, cross-border transfers of this kind require your express consent, which you give by checking the consent box and submitting your reservation.

We require each provider, by contract, to protect your data to a standard consistent with this notice. If you do not consent to international transfer, we cannot process an online reservation for you — please contact us at stay@denucciosestate.com to arrange a booking by other means.

You have the right to Access the personal data we hold about you, to Rectify it when it is inaccurate or incomplete, to Cancel it when you believe it is not being handled properly, and to Oppose its use for specific purposes. You may also revoke any consent you have given.

To exercise any of these rights, send a request to stay@denucciosestate.com including:

1. Your full name and an address or email where we can reply
2. A copy of an official identification document, so we can confirm it is you (a passport or a Mexican INE is fine — you may redact anything not needed to verify identity)
3. A clear description of the data your request concerns
4. For rectification requests, the corrected information and any documentation supporting it
5. Any detail that helps us locate the data — for example, a reservation confirmation code

We will respond within 20 business days of receiving a complete request, and if we grant it we will act on it within 15 business days of our response. If we need more information to process your request, we will ask you within 5 business days.

Some requests we may have to decline in part. If you ask us to delete data we are required to retain for tax or accounting purposes, or that we need to defend a legal claim, we will keep that data and tell you why.

You may withdraw your consent to our processing of your data at any time by writing to stay@denucciosestate.com. Withdrawal is not retroactive and does not affect processing already carried out. Note that withdrawing consent for the primary purposes in Section 3 means we can no longer maintain your reservation.

• Reservation and payment records: retained for the period required by Mexican tax and commercial law, currently [5 / 10] years from the end of the fiscal year in which the stay occurred.
• Contact form submissions and general correspondence: [24] months.
• Marketing contacts: until you unsubscribe or ask us to remove you.
• Website analytics: as configured in our analytics tools, currently [14] months.

After these periods we delete the data or irreversibly anonymize it.

The site uses:

• Strictly necessary cookies, which keep your booking session and selections intact as you move between pages. The site does not work without them.
• Analytics cookies, which help us understand how visitors use the site in aggregate. [Describe your cookie banner behavior here — e.g., "These are set only after you accept them in our cookie banner."]

You can block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent you from completing a reservation.

We maintain administrative, technical, and physical safeguards intended to protect your data against loss, misuse, unauthorized access, and disclosure. These include encrypted connections (HTTPS), access controls on our reservation database, and restricting staff access to what each person needs to do their job.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach occurs that materially affects your rights, we will notify you and the competent authority as the LFPDPPP requires.

The site is not directed to children, and we do not knowingly collect personal data from anyone under 18. Reservations must be made by an adult. Children may of course stay at the estate as members of a booked party; in that case, the adult making the reservation is responsible for any information provided about them.

If you are in the European Economic Area or the United Kingdom, you may have additional rights under the GDPR, including data portability and the right to lodge a complaint with your local supervisory authority. If you are a resident of California or another U.S. state with comprehensive privacy legislation, you may have rights to know, delete, and correct your data, and to opt out of its sale or sharing — we do not sell or share personal data as those laws define it. Use the contact address in Section 6 to exercise any of these rights; we handle all such requests through the same process.

We may update this notice as our practices, our providers, or the law change. The current version is always posted at denucciosestate.com/privacy with the revision date at the top. If a change materially affects how we use your data, we will notify guests with active reservations by email.

If you believe your data protection rights have been violated, you may file a complaint with Transparencia para el Pueblo, the body under the Secretariat of Anti-Corruption and Good Governance responsible for enforcing the LFPDPPP in the private sector.