Full privacy notice

1. Controller and contact

MARPLAN TRAVEL OPERADORA TURISTICA, S.A. de C.V., trading as Marplan Travel, is the controller of the personal data described in this notice. Its address is Artículo 123 No. 97, oficina 305, Col. Centro, Cuauhtémoc, Ciudad de México, México, postal code 06050.

The Privacy Area can be contacted at ventas@marplantravel.com and the office phone +52 55 9135 9995. This notice is governed by Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), enacted in 2025, and applicable provisions.

2. Scope and personal data

This notice covers the data of contacts at travel agencies, wholesalers, organizers and companies, as well as individuals requesting transportation, and traveler data we receive to coordinate bookings and deliver contracted services.

Initial forms may include name, company, email address, country and optional phone number; preferences, destinations or routes, approximate dates and times, estimated passenger count, language, request type and comments, depending on the form used. For bookings and contracted services, we may receive traveler names and passport numbers when needed for the service.

Do not include passport numbers or copies, children’s data or health information in initial forms. These forms do not request declarations of faith or health data. Traveler information needed for a booking will be handled through the specific channel communicated for that service.

3. Necessary purposes

We process the data needed to respond to inquiries, prepare quotes, coordinate bookings and contracted services, maintain operational communications, follow up on service matters and meet applicable legal obligations. Processing is limited to what is necessary for each purpose and requested service.

4. Promotions: an optional secondary purpose

Advertising or promotions sent to agency contacts are a secondary purpose, separate from responding to inquiries and delivering services. You may decline now or unsubscribe by emailing ventas@marplantravel.com with the subject “Baja promociones”. Declining does not affect quotes or requested or contracted services. We do not direct advertising to children.

The form checkbox only acknowledges that the notice has been read and accepts contact regarding the inquiry; it is not marketing consent or authorization to process sensitive data.

5. Third-party data and children

Agencies and organizers providing data about travelers or other third parties must make this notice available to them and have the applicable legal basis, consent or authority to disclose their data and request services. They must provide only the minimum information necessary.

Data about accompanied children is handled through their parents or guardians, with the appropriate authority and only to the extent needed for the trip. We do not request consent directly from children or collect their data through the initial form.

6. Sensitive information

Participation in a pilgrimage may reveal religious beliefs, even though we do not request a declaration of faith. If a service requires processing sensitive personal data, specific information about that processing will be provided in advance and the applicable express written consent will be obtained through a dedicated channel before receiving or processing it, unless a legal exception applies. The generic form acknowledgement does not cover such processing.

7. Transfers and processors

The requested or contracted service may require domestic or international transfers to hotels, transportation providers, guides, activity operators and the contracting agency, as well as to authorities when legally required. Only the information necessary to coordinate or deliver the service, or comply with the applicable obligation, will be disclosed. When data is disclosed, the recipient will receive this notice and the relevant purposes and must assume the applicable data protection obligations.

Where a transfer is not covered by a legal exception, information will be provided and the required consent obtained before the transfer takes place. Browsing the website or checking the inquiry acknowledgement box does not constitute general authorization for transfers.

Technology providers processing data on Marplan’s behalf and under its instructions act as processors, subject to confidentiality and data protection obligations. Such processing is distinct from transfers to third parties acting for their own purposes.

8. ARCO rights and procedure

You may exercise rights of access (to learn about your data and its processing), rectification (to correct inaccurate or incomplete data), cancellation (to request that processing cease and, where applicable, that data be blocked and deleted) and opposition (to object to processing in the circumstances provided by law).

Send your request to the Privacy Area at ventas@marplantravel.com with the subject “Privacidad/ARCO”, stating your name, your preferred response channel, the right you wish to exercise and the data or details that allow the information to be located. Identity or authority verification will be arranged through a secure channel; do not send identity documents through the initial form. For rectification, specify the correction and provide supporting evidence through the agreed channel.

We will communicate the decision within a maximum of 20 business days after receiving the request. If granted, it will be implemented within 15 business days after the response is communicated. Each period may be extended once for an equal period where circumstances justify it and you are notified of the extension. Requests are subject to identity verification and applicable legal requirements and exceptions.

9. Withdrawal and limitation

You may request withdrawal of consent or limitation of the use or disclosure of your data through the same Privacy Area contact channel. Withdrawal is not retroactive and may be limited by legal obligations or processing that must continue under the law. We will explain its scope and any consequences for the requested service. Declining or unsubscribing from promotions is handled separately and does not affect services.

10. Retention and security

We retain data only for as long as necessary for the stated purposes, applicable obligations and relevant limitation periods. Where appropriate, data will be blocked and subsequently deleted in accordance with the law. No single retention period applies to every operation.

Processing requires administrative, technical and physical safeguards appropriate to the data and risks, together with access limited to authorized personnel and confidentiality obligations. No safeguard provides an absolute security guarantee. Inquiries received through this website are stored privately with restricted access.

11. Technology and form status

While preparing an inquiry, fields remain in the memory of the current visit and are retained when switching between Spanish and English using the website’s language selector. The application does not save the draft to the browser’s local or session storage; reloading or closing the page clears it. When you select “Submit inquiry”, the data is transmitted to the server for validation and storage.

Inquiries are stored privately in Lovable Cloud: a copy of the minimum contact and inquiry details, with the date and acknowledged notice version, to respond and prevent loss. Access is restricted to authorized personnel through Cloud access controls; there is no public read access. After the inquiry is saved, a notification is sent only to ventas@marplantravel.com through Lovable’s email service, from the verified sender noreply@notify.marplantravel.mx with the applicant’s validated email as the reply address. Acceptance by the email service does not guarantee inbox receipt. If notification fails, the private copy is retained for manual handling by authorized personnel. Retention follows the criteria in section 10.

Protection against automated submissions includes validation, a honeypot field and a custom limit of three inquiries per fifteen minutes per technical identifier. The IP address received by the infrastructure is used to derive an identifier using a private key, without storing the original address in the application. These identifiers stop counting when their fifteen-minute window expires, and expired entries are deleted on the next submission attempt; they are not used for advertising or browsing tracking. This protection does not guarantee prevention of distributed attacks.

The page requests fonts from Google to display its text, creating a connection with that provider and exposing the usual technical data of a web request, such as the IP address and browser information. The location link opens Google Maps only if you choose to follow it.

The code of this version does not integrate audience analytics or advertising tracking. The preview has error-diagnostic mechanisms that may communicate technical information, such as the error message and page path. This is not a statement that the infrastructure serving the site has no cookies, logs or technical processing. Technology changes affecting the processing described here will be reflected in this notice.

12. Authority and legal scope

If you believe your right to personal data protection has been infringed, you may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno through the legally applicable procedures. This notice relates to Marplan’s Mexican operations; rights under other jurisdictions will be addressed where legally applicable, without claiming global compliance with foreign regimes.

13. Changes to this notice

Updates will appear on this same page with their update date. Material changes will be communicated through available contact channels and new consent will be obtained where required by law. This notice was updated on 20 October 2026.