Beyond the Reef Mexico
Privacy Policy
Last updated: October 2026
At Beyond the Reef Mexico we take your privacy seriously. This policy explains what personal information we collect when you browse our website, request a tour or make a payment, how we use and protect it, and the choices you have. By using this website you agree to the practices described here.
Secure payments & website security
This website is served over HTTPS with an SSL/TLS certificate, so everything you send between your browser and our site is encrypted in transit. Card payments are processed by Stripe, a PCI DSS Level 1 certified payment processor: your card number is entered on Stripe’s secure form and goes directly to Stripe. We never see, receive or store your full card details. We accept Visa, Mastercard, American Express and Discover. Our forms are protected against spam and bots by Cloudflare Turnstile; its use is described in the Cloudflare Turnstile Privacy Addendum.
Information we collect
We collect only what we need to organise your experience: your name, email address, phone / WhatsApp number, hotel or pickup location, travel dates, number of guests and any notes you send us through our booking, contact and “Build Your Own Experience” forms. When you pay online, Stripe shares with us the payment status, the amount, the card brand and the last four digits of your card (never the full number). We also receive limited technical data such as your IP address, browser type and the pages visited, to keep the site secure and working properly.
How we use your information
We use your information to confirm and manage your reservation, arrange pickup, contact you by email or WhatsApp about your tour, process deposits, balances and refunds, answer your questions, improve our website and tours, prevent fraud and abuse, and comply with legal obligations. We do not sell your personal information and we do not use it for automated decisions that significantly affect you.
Who we share it with
We share information only with trusted providers that help us run the service, and only what each needs: Stripe (payment processing), Cloudflare (Turnstile bot protection), our hosting and database providers (website hosting and secure storage of reservations), Vercel (privacy-friendly website analytics), and the local tour operators, guides and drivers who deliver your experience (name, group size, date and pickup details). We may also disclose information when required by law or to protect our rights and the safety of our guests.
Cookies & analytics
We use only the essential storage needed for the site to work (for example, remembering your reservation details while you check out) and aggregated, privacy-friendly analytics to understand how the site is used. We do not use advertising cookies or sell data to advertisers. Embedded content such as Vimeo videos and Google reviews may set their own cookies once you interact with it; please see those providers’ policies.
How we protect your data
We use industry-standard safeguards: encryption in transit (HTTPS/TLS), access limited to authorised people, secure cloud infrastructure with encrypted storage, administrator accounts protected by multi-factor authentication, and bot and abuse protection on our forms. No method of transmission or storage is 100% secure, but we work continuously to keep your information safe and we will notify you and the authorities if a breach affecting you ever occurs, as required by law.
How long we keep it
We keep reservation and payment records for as long as needed to provide the service and to meet accounting, tax and legal requirements, and delete or anonymise personal information that is no longer needed. Messages and enquiries that do not become a booking are deleted within a reasonable period.
Your rights
Depending on where you live, including under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and, for visitors from Europe, the GDPR, you may have the right to access, correct, delete or restrict the use of your personal information, to object to certain processing, to withdraw consent, and to request a copy of your data. To exercise any of these rights, write to us at the email below and we will respond promptly.
International visitors & transfers
Our guests come from all over the world. Your information may be processed by our service providers in countries other than your own (for example the United States), always under appropriate contractual and security safeguards.
Children
Our website is intended for adults. Children join tours only under the supervision of a parent or guardian who makes the reservation, and we do not knowingly collect personal information directly from children.
Changes to this policy
We may update this policy from time to time to reflect changes in our services or the law. The date at the top shows when it was last revised. Continued use of the website after an update means you accept the revised policy.
Contact us
Questions about your privacy or want to exercise your rights? Email us at info@beyondthereefmexico.com or message us on WhatsApp. Responsible: Beyond the Reef Mexico, Quintana Roo, Mexico.