Privacy Notice

Last updated: November 1, 2026. This is how Casa Aureum handles your personal data when you browse this site, book an experience or apply to our partner program.

Who is responsible

Casa Aureum, based in Isla Mujeres, Quintana Roo, Mexico, is responsible for your personal data. You can reach us at Casa.aureum.ca@gmail.com or on WhatsApp.

What data we collect

When you book or request a quote: your name, email, WhatsApp number, where you are staying, date and number of people, how you found us, any discount code and the notes you choose to write.

When you apply as a partner: business name and type, contact person, WhatsApp, email, area and your message. If you book for a guest through the partner portal, the guest details you enter.

While you browse: language, theme, cart and cookie choice stored in your browser, and the source of your first visit (for example a search engine or social network, with no personal data) for up to 30 days.

Payments are processed by PayPal. We do not receive or store your card number.

Sensitive data

We do not ask for sensitive data. If you choose to tell us something about your health so we can look after you during an experience (for example a medical condition before diving), we use it only for your safety and for that experience. By writing it in the form you give your express consent for that purpose. Please do not send other sensitive information.

What we use it for

Necessary purposes: process your booking and payment, coordinate your experience with the operators who provide it, send confirmations and reminders, answer your questions, manage and pay partner commissions, and meet legal and tax obligations.

Optional purpose: measure how the site is used with Google Analytics, only if you accept analytics cookies. You can say no and still book normally. We do not sell your data and advertising measurement is turned off.

Who we share it with

• Operators and suppliers that provide the experience you booked (boats, diving, transport). Needed to fulfil your booking.
• PayPal, for payments.
• Supabase, where bookings are stored.
• Hostinger, for hosting and email.
• Telegram, for internal notices to our team about new bookings.
• Google Analytics, only with your acceptance.
• The partner (hotel, rental or agency) that referred you, who can see the basic status of that booking and their commission.
• Authorities, when the law requires it.

We do not transfer your data to anyone else without your consent.

Cookies and local storage

Essential storage keeps your language, theme, cart and cookie choice in your browser. Analytics cookies are used only if you accept them. If you accept, Google receives browsing events and browser identifiers; we never send it your name, email, phone, notes or private booking links. You can change your choice any time with the “Privacy & cookies” button at the bottom of the page.

Your rights (ARCO) and how to withdraw consent

You can access your data, correct it, delete it or object to its use, withdraw your consent, or ask us to limit how we use it. Write to Casa.aureum.ca@gmail.com with your name, how to reach you, what you are asking for and a copy of an official ID. We answer within 20 days and, if your request is approved, carry it out within 15 more days. It is free of charge.

If you stop wanting non-essential messages from us, tell us at the same address.

Security and retention

The site uses HTTPS, and the admin panel and partner portal are access-restricted. We keep your data for as long as needed for the purposes above and for legal and tax obligations.

Changes to this notice

If we change this notice we publish the new version on this page with its date. If we start using your data for a new purpose we will ask for your consent again.

Authority

If you believe your rights were not respected, you can go to the Secretaría Anticorrupción y Buen Gobierno, Mexico’s data protection authority.