Xelbor Transfer Privacy Notice

Xelbor Transfer S.A. de C.V. is responsible for the processing of your personal data. For privacy requests, ARCO rights, consent withdrawal, use limitation or questions about this notice, you may email reservas@xelbortransfer.com, call +52 998 649 9679 or submit a written request at the address listed in this notice.

For recruitment matters you may also use rh2@xelbortransfer.com. For invoicing matters, use the invoicing portal or email published by Xelbor Transfer: facturacion@xelbortransfer.com.

Data is collected directly when you provide it through booking, contact, quote, shared taxi, invoicing or job forms; by phone, email, WhatsApp, official social media, airport terminals, sales agents, business partners, travel agencies, hotels, payment platforms or technology services needed to operate the website.

Depending on your relationship with Xelbor Transfer, we may process:

• Identification and contact data: name, phone, email, country or phone code, service language and social media username when you contact us through those channels.
• Travel and service data: origin, destination, hotel, Airbnb or drop-off address, date, time, flight number, airline, terminal, passengers, luggage, vehicle type, operational notes, coordination needs and booking references.
• Payment and invoicing data: amount, currency, payment reference, transaction status, ticket, folio, RFC tax ID, legal name, tax regime, fiscal postal code, CFDI use and email for PDF/XML delivery.
• Customer support data: messages, complaints, clarifications, requests, contact history, communication preferences and evidence needed for follow-up.
• Website technical data: IP address, device or browser identifiers, visited pages, access date and time, cookies, similar technologies and data generated by maps, place search, security or analytics tools.
• Recruitment data: experience, desired position, license, availability, city of residence, resume, references, employment data and documents required to evaluate sales, logistics, operations or professional driving roles.

As a general rule, Xelbor Transfer does not request sensitive personal data. If you voluntarily provide information related to health, mobility, pregnancy, disability, special assistance, minors or any condition required for transfer or tour safety, that information will be used only to coordinate the service, comply with applicable obligations and protect passengers.

In recruitment processes for operating or driving roles, we may request documents or certificates required by applicable regulations, such as licenses, skills or certificates needed to operate vehicles. When those documents include sensitive data, they will be handled with additional confidentiality and only to assess safety, legal compliance and job suitability.

If you provide data about companions, passengers, minors, corporate customers or third parties, you represent that you are authorized to do so and agree to inform them about this notice.

Your personal data is used for purposes necessary to provide transportation, shared taxi, tour, invoicing, support and recruitment services.

• Quote, book, confirm, modify, cancel and operate transfers from or to airports, hotels, terminals, destinations in the Riviera Maya, Merida, Yucatan and other service areas.
• Identify and contact you, and send confirmations, meeting instructions, tickets, receipts, operational notices, reminders, itinerary changes or information about your service.
• Coordinate drivers, vehicles, terminal reception, routes, schedules, luggage, passengers, special needs, shared services and flight tracking when you provide flight data.
• Process payments, antifraud validations, refunds, clarifications, chargebacks, reconciliation and service receipts.
• Issue invoices and comply with tax, accounting, administrative, commercial, transportation, security and any authority requirements.
• Respond to questions, complaints, claims, comments, warranties, information requests, post-service follow-up and customer experience improvements.
• Manage job applications, interviews, profile validation, references, vacancy communication and, where applicable, hiring processes.
• Maintain website security, prevent abuse, diagnose errors, protect our systems and keep evidence of operations or consents.

We may also use your data to send promotions, discounts, transfer or tour updates, satisfaction surveys, informative content, business analytics, audience segmentation and prospecting related to tourism, mobility or travel experiences.

You may object to these secondary purposes at any time by emailing reservas@xelbortransfer.com. Refusing these purposes will not affect the service you booked.

When you make an online payment, card data, bank authentication and other financial data may be processed directly by payment processors, banks, acquirers or platforms such as Stripe or other providers. Xelbor Transfer does not need to store full card numbers, security codes or bank credentials to operate your booking.

Financial data you provide for payment, refund, invoicing or clarification will be processed with your consent and only for the necessary purposes described in this notice.

We may share personal data with processors and providers acting on behalf of Xelbor Transfer, under confidentiality and security obligations, to operate bookings, payments, invoicing, technology hosting, messaging, email, WhatsApp, CRM, maps, analytics, support, storage or site administration.

We may also transfer data when necessary to perform the service or comply with legal obligations.

• Drivers, coordinators, airport staff, logistics operators, transportation partners, hotels, agencies, tour operators or activity providers when required to coordinate your service.
• Payment processors, banks, antifraud platforms, invoicing providers, accountants, auditors and tax authorities such as SAT to issue CFDI invoices and comply with accounting obligations.
• Administrative, judicial, tax, transportation, security or civil protection authorities when there is a legal obligation, valid request or defense of rights.
• Affiliated, controlling, subsidiary companies or business partners related to Xelbor Transfer when they operate under compatible privacy and confidentiality policies.

You may request access, rectification, cancellation or opposition regarding your personal data, and may withdraw consent or limit use and disclosure when legally applicable.

Requests must be sent in Spanish to reservas@xelbortransfer.com or submitted in writing at the controller's address. Include full name, response channel, a clear description of the right you want to exercise, the data involved and a legible copy of official ID. If acting through a representative, include proof of representation.

If the information provided is insufficient, we may request additional elements to verify identity or locate your data. The response on admissibility will be provided within the timeframes set by applicable regulations; as an operating reference, Mexican law contemplates an ordinary period of up to 20 business days to respond and, if applicable, up to 15 additional business days to execute the request.

We keep personal data for as long as necessary to fulfill the purposes described, maintain the legal or commercial relationship, handle clarifications, keep operational evidence, comply with tax, accounting, administrative or legal obligations and defend rights.

When data is no longer necessary, it will be deleted, anonymized or blocked according to our internal procedures and applicable regulations. Some data may remain blocked during legal limitation, audit or compliance periods.

Xelbor Transfer applies reasonable administrative, technical and physical measures to protect personal data against loss, damage, alteration, destruction, unauthorized use, access or processing. These measures include access controls, personnel confidentiality, provider review, information safeguards, encryption where the provider supports it and security practices in systems and communications.

No system is absolutely invulnerable. If we detect a relevant incident that may affect your economic or moral rights, we will act in accordance with applicable regulations.

The website may use cookies, local storage, server logs, maps, place search, analytics, security, conversion measurement and third-party components to remember preferences, improve navigation, calculate routes, detect errors and understand website use.

You can block or delete cookies from your browser settings. Some functions, such as forms, language selector, destination search, maps or payments, may not work properly if certain technologies are disabled.

Xelbor Transfer may modify this notice due to legal, operational, commercial, technological changes or new services. Updates will be published on this website and, when necessary, communicated by reasonable means such as email, visible website notices, support messages or direct communication.

By providing personal data through Xelbor Transfer channels and not objecting under this notice, you consent to the processing of your data for the primary purposes described here. For secondary purposes, sensitive data or financial data when legally required, the corresponding consent will be requested.