Privacy Policy
XINALANI RETREAT
www.xinalaniretreat.com | www.mixto.mx
Effective Date: May 2026 | Last Updated: May 2026
Applicable Law: CCPA (California) | CPRA (California) | PIPEDA (Canada) | LFPDPPP (Mexico)
1. WHO WE ARE
This Privacy Policy applies to the boutique hotel and retreat properties operated by:
ADMINISTRACION Y DESARROLLO DE SERVICIOS TURISTICOS Y COMPLEMENTARIOS S.C. de R.L. de C.V.
Registered address: Calle Maria Montessori #650 Int: Casa 1, Colonia Aramara
Puerto Vallarta, Jalisco, Mexico, ZIP 48314
Property address: Playa Xinalani, Quimixto, ZIP 48399, Puerto Vallarta, Jalisco, Mexico
Contact email: reservations@xinalani.com
We operate two boutique properties under the brands Xinalani Retreat (www.xinalaniretreat.com) and Mixto (www.mixto.mx). References to “we,” “us,” or “the Hotel” in this Policy refer to both properties collectively.
2. SCOPE OF THIS POLICY
This Privacy Policy describes how we collect, use, share, and protect the personal information of:
- Guests who book or stay at our properties
- Visitors to our websites and digital platforms
- Individuals who contact us by email, phone, or social media
- Subscribers to our newsletters or marketing communications
This Policy is designed to comply with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and Mexico’s Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares (LFPDPPP).
3. INFORMATION WE COLLECT
We collect the following categories of personal information:
3.1 Identifiers
- Full name, date of birth, nationality
- Passport or government-issued ID number
- Email address, phone number, mailing address
- IP address, cookie identifiers, device identifiers (collected automatically through our websites)
3.2 Financial Information
- Credit or debit card number and type (for payment processing and deposit guarantees)
- Billing address
3.3 Sensitive Personal Information
- Health or medical conditions relevant to spa, yoga, or wellness treatment selection
- Food allergies and dietary restrictions
- Accessibility needs for guests with disabilities
| Note: Sensitive personal information is collected only with your express consent and solely for the purpose of providing appropriate services during your stay. We do not sell or share sensitive personal information. |
3.4 Commercial Information
- Reservation history, services purchased, preferences and special requests
3.5 Internet or Electronic Network Activity
- Browsing history on our websites, pages visited, search queries, time spent on pages
- Communications with us via email, chat, or contact forms
3.6 Visual and Audio Information
- CCTV/video footage captured in common areas of our properties for security purposes
- Photos or videos shared voluntarily by guests (e.g., for testimonials or social media features)
3.7 Inferences
- Guest preferences and profiles drawn from the above categories to personalize your experience
4. HOW WE COLLECT YOUR INFORMATION
We collect personal information through the following methods:
- Directly from you: reservation forms (website, phone, email), check-in registration, spa intake forms, concierge requests
- Automatically: cookies, web beacons, analytics tools when you visit our websites
- From third parties: online travel agencies (OTAs), travel advisors, and booking platforms that facilitate your reservation
Cookies and Tracking Technologies
Our websites use cookies and similar technologies for purposes including website functionality, analytics, and marketing. You may manage cookie preferences through your browser settings or our cookie consent banner. Disabling certain cookies may limit site functionality.
5. HOW WE USE YOUR INFORMATION
We use your personal information for the following purposes:
Service Delivery (always required)
- Processing and confirming reservations
- Managing your stay, payments, and billing
- Selecting and personalizing spa, yoga, and wellness services
- Arranging concierge services (tours, restaurants, transportation) on your behalf
- Responding to inquiries and providing customer support
- Ensuring security of guests, staff, and property through CCTV
- Complying with legal and tax obligations
Marketing and Analytics (opt-out available)
- Sending promotional emails, special offers, and newsletters
- Personalizing marketing content based on your preferences and stay history
- Conducting internal analytics to improve our services and website
- Remarketing through digital advertising platforms (e.g., Google Ads, Meta Ads)
You may opt out of marketing communications at any time by clicking the unsubscribe link in any email, or by contacting us at reservations@xinalani.com.
6. SHARING YOUR INFORMATION
We do not sell your personal information for monetary compensation. We may share your information with the following categories of third parties for the purposes described:
- Service Providers: payment processors, IT service providers, email marketing platforms, analytics providers – who process data on our behalf under confidentiality agreements
- Tourism Partners: local tour operators, restaurants, and activity providers, only to fulfill concierge bookings you request
- Financial Institutions and Insurers: for payment processing and insurance coverage
- Legal and Government Authorities: when required by applicable law, regulation, legal process, or governmental request
- Business Transfers: in the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity
| Do Not Sell or Share My Personal Information: We do not sell your personal information as defined under the CCPA/CPRA. We do not share your personal information with third parties for cross-context behavioral advertising without your consent. California residents may submit a Do Not Sell or Share request at any time — see Section 8 for details. |
7. DATA RETENTION
We retain your personal information only as long as necessary for the purposes described in this Policy, or as required by applicable law. Typical retention periods:
- Reservation and billing records: 7 years (tax and accounting requirements)
- Guest preference profiles: 3 years from last stay
- CCTV footage: 30 days unless subject to an active security investigation
- Marketing opt-in records: until you withdraw consent
- Website analytics data: 26 months (Google Analytics default)
8. YOUR PRIVACY RIGHTS
Depending on your jurisdiction, you may have the following rights regarding your personal information:
| RIGHT | DESCRIPTION |
|---|---|
| Right to Know | Request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the third parties with whom we share it. |
| Right to Access | Obtain a copy of the personal information we hold about you. |
| Right to Delete | Request deletion of your personal information, subject to certain legal exceptions (e.g., active reservations, legal obligations). |
| Right to Correct | Request correction of inaccurate personal information we hold about you. |
| Do Not Sell or Share | Opt out of the sale or sharing of your personal information for cross-context behavioral advertising. (California residents – CCPA/CPRA) |
| Limit Sensitive Data Use | Restrict our use of your sensitive personal information to service delivery purposes only. (California residents – CPRA) |
| Right to Portability | Receive your personal information in a structured, commonly used, machine-readable format. (Canada – PIPEDA / California – CPRA) |
| Right to Non-Discrimination | We will not discriminate against you for exercising any of these rights. You will receive the same quality of service regardless. |
| Right to Opt Out of Marketing | Withdraw consent to marketing communications at any time. |
How to Submit a Request
To exercise any of the rights above, please contact us through one of the following methods:
- Email: reservations@xinalani.com (subject line: “PRIVACY REQUEST”)
- Postal mail: Privacy Officer, Calle Maria Montessori #650 Int: Casa 1, Colonia Aramara, Puerto Vallarta, Jalisco, Mexico, ZIP 48314
Your request must include: your full name, email address or mailing address for our response, a description of the right you wish to exercise, and a copy of a valid government-issued ID to verify your identity. If you are submitting on behalf of another person, you must provide proof of authorization.
Response Timeframes
We will acknowledge your request within 10 business days and respond substantively within:
- 45 calendar days for California residents (CCPA/CPRA) – extendable by an additional 45 days with notice
- 30 calendar days for Canadian residents (PIPEDA)
- 20 business days for Mexico residents (LFPDPPP) – extendable by an additional 20 days
We will not charge a fee for processing your request unless it is manifestly unfounded or excessive.
9. DO NOT SELL OR SHARE MY PERSONAL INFORMATION
As required by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), we provide California residents with the right to opt out of the sale or sharing of their personal information for cross-context behavioral advertising.
We currently use third-party analytics and advertising tools (such as Google Analytics and Meta Pixel) on our websites. The data exchanged with these platforms may constitute “sharing” under the CPRA. California residents may opt out of this sharing by:
- Submitting a Do Not Sell or Share request by email to reservations@xinalani.com with subject line: “DO NOT SELL OR SHARE MY INFO”
- Using the Global Privacy Control (GPC) signal in your browser – we honor GPC signals as required by California law
- Adjusting your cookie preferences through our website cookie settings banner
| We do not sell personal information to data brokers or third parties in exchange for monetary compensation. |
10. ADDITIONAL RIGHTS FOR CANADIAN RESIDENTS (PIPEDA)
If you are a resident of Canada, the following additional provisions apply under the Personal Information Protection and Electronic Documents Act (PIPEDA):
- We collect, use, and disclose your personal information only with your knowledge and consent, except where required or permitted by law.
- We identify the purposes for which personal information is collected at or before the time of collection.
- You may withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice.
- You have the right to access your personal information and challenge its accuracy and completeness.
- We may transfer your personal information to service providers in Mexico or the United States. By using our services, you acknowledge that your information may be subject to the laws of those jurisdictions.
To submit a PIPEDA access or correction request, contact us at reservations@xinalani.com with subject line: “PIPEDA PRIVACY REQUEST”. We will respond within 30 calendar days.
11. CHILDREN’S PRIVACY
Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at reservations@xinalani.com and we will promptly delete it.
For guests who are minors (under 18), personal information is collected as part of the family reservation managed by a parent or legal guardian, who provides consent on the minor’s behalf.
12. SECURITY OF YOUR INFORMATION
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These include:
- Encrypted transmission of data via SSL/TLS on our websites
- Restricted access to personal data on a need-to-know basis
- Confidentiality obligations for all staff and service providers who handle personal data
- Physical security measures at our property locations
No method of transmission over the internet is completely secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights, we will notify affected individuals as required by applicable law.
13. THIRD-PARTY LINKS AND SERVICES
Our websites may contain links to third-party websites or integrate third-party services (such as booking platforms, social media plugins, or payment gateways). We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you interact with.
14. UPDATES TO THIS PRIVACY POLICY
We may update this Privacy Policy periodically to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:
- Post the updated Policy on our websites with a revised effective date
- Display a notice in our properties
- Send an email notification to guests with an active account or reservation, where feasible
We encourage you to review this Policy periodically. Your continued use of our services after changes take effect constitutes your acceptance of the updated Policy.
15. CONTACT US
If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact our Privacy Officer:
Xinalani Retreat
Email: info@xinalaniretreat.com
Subject line: “PRIVACY INQUIRY”
Postal address: Calle Maria Montessori #650 Int: Casa 1, Colonia Aramara, Puerto Vallarta, Jalisco, Mexico, ZIP 48314
If you are a California resident and are not satisfied with our response, you may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov or the California Attorney General’s office. If you are a Canadian resident, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Effective Date: May 2026 | Last Updated: May 2026
ADMINISTRACION Y DESARROLLO DE SERVICIOS TURISTICOS Y COMPLEMENTARIOS S.C. de R.L. de C.V.
Playa Xinalani | Quimixto, Puerto Vallarta, Jalisco, Mexico