Legal

Privacy Notice

How Zama Travel collects, uses and protects your personal data.

Notice: This document summarises our current operating policy. The Spanish version prevails in case of discrepancy. For binding legal questions, contact legal@zama-travel.com.

Last updated: April 19, 2026

1. Who is responsible for your data

Zama Travel ("Zama", "we", "us") operates the pre-booked private-transfer booking platform at zama-travel.com. We are based in Cancún, Quintana Roo, México. In compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP"), Zama is the Data Controller (Responsable) of the personal data you provide through this website and through our booking and support channels.

Contact for privacy matters: privacy@zama-travel.com.

2. What data we collect

We collect the minimum data required to process your transfer booking and operate our service:

  • Identification: full name and passenger count.
  • Contact: email, phone number and WhatsApp.
  • Trip details: pickup / drop-off locations, dates, times, flight number, airline, hotel name.
  • Payment: billing name, country and the transaction reference returned by PayPal. Full card numbers are never stored on our servers.
  • Technical: IP address, device type, browser, pages visited, cookie identifiers (see Section 7).
  • Support correspondence: emails and WhatsApp messages related to your booking.

3. How we use your data (primary purposes)

  • Process, confirm, modify and cancel transfer bookings.
  • Dispatch your booking to a validated transport carrier so the physical service can be performed.
  • Send transactional emails and messages (confirmation, reminders, driver contact, cancellation, post-service).
  • Process payments and issue invoices when requested.
  • Respond to your support questions.
  • Meet our legal, tax and accounting obligations in México.

4. Secondary purposes (optional)

With your separate consent, we may also use your data to:

  • Send quality / feedback surveys.
  • Offer promotions, discounts or loyalty benefits from Zama.
  • Produce anonymised analytics to improve the platform.

You may refuse secondary uses at any time by writing to privacy@zama-travel.com. Declining secondary uses will not affect the services you book.

5. Who we share your data with

To operate the booking and the physical transfer, we share strictly the necessary data with the following categories of recipients:

  • Validated transport carriers: name, passenger count, pickup / drop-off details, flight number, phone / WhatsApp — so they can perform the service and contact you.
  • Payment processor: PayPal processes your payment under its own privacy policy.
  • Infrastructure & email providers: hosting, transactional email and WhatsApp Business messaging.
  • Authorities: when required by a valid legal, regulatory or judicial order (SAT, PROFECO, courts).

All recipients are bound by confidentiality and data-protection obligations equivalent to this notice. We do not sell your personal data.

6. Your ARCO rights

Article 28 of the LFPDPPP grants you four rights regarding your personal data:

  • Access: know what data we hold and how we use it.
  • Rectification: correct inaccurate or outdated data.
  • Cancellation: request deletion from our databases when it is no longer needed.
  • Opposition: object to specific processing of your data.

To exercise an ARCO right, send a request to privacy@zama-travel.com including: (a) your full name and a reply email / address; (b) a copy of an official ID (INE, passport) or legal representation; (c) a clear description of the right being exercised and the specific data involved. We will respond within 20 business days of receiving a complete request.

You may also revoke consent at any time. Please note that some data must be retained when required by law (e.g., tax invoicing for 5 years under Mexican fiscal law) or to defend legal claims.

7. Cookies and tracking

We use the following categories of cookies and similar technologies:

  • Essential: language preference, session, cart / booking in progress. Cannot be disabled.
  • Analytics (optional): aggregate usage statistics to improve the site.
  • Marketing (opt-in): only when you accept, for retargeting or campaign attribution.

You can clear cookies or opt out at any time through your browser settings.

8. Data retention

  • Booking records: 5 years after the trip date (Mexican tax / commercial law).
  • Payment references: 5 years.
  • Support correspondence: 2 years after the last interaction.
  • Marketing preferences: until you opt out, plus 12 months of suppression history.
  • Account / customer profile: until you request deletion, subject to legal minimums above.

9. Security

We apply physical, technical and administrative measures to protect your data, including TLS encryption in transit, encrypted backups, least-privilege access controls, and PCI-DSS-certified payment processing through PayPal.

10. International transfers

Some of our infrastructure providers (hosting, email, WhatsApp Business) may process data outside of México. Transfers are carried out under contractual safeguards equivalent to LFPDPPP standards.

11. Changes to this notice

We may update this Privacy Notice to reflect legal or operational changes. The current version is always published on this page with a "Last updated" date. Continued use of the service after publication means you accept the updated notice.

12. How to contact us