Mobile Sail Technologies, S.A. de C.V.

The legal entity Mobile Sail Technologies, S.A. de C.V., who operates the web site Totoura.com, domiciled at Paseo Cocoteros S/N, interior local 170, Hotel Marival Emotions Resort & Suites, Nuevo Vallarta, Nayarit, Mexico, Código Postal 63732, web site totoura.com and mobilesail.com. Totoura.com, manages a service that allows users to search, find and book travel experiences around the world. The services are made available for the web site Totoura.com (and/or related domains), apps and telephone services.

Mobile Sail Technologies, S.A. de C.V., is responsible for the use and protection of personal data, and in that regard we inform you the following:

1. For what purposes will we use your personal data?

Personal data provided by you will be used for the following purposes, which are necessary for the requested service:

a) In your capacity as Client, Provider or Employee or user of our web site, Mobile Sail Technologies, S.A. de C.V., will use your personal data for the following primary purposes:

I. For identification, verification and contact.
II. Hiring, processing, administration, operation and reservation of services contracted with us that can refer to tours, excursions, coordination of land transport and complementary tourist services.
III. To manage your registration, your account, including access to and use of our web site www.totoura.com, publish your reviews, ratings and photographs, contact you about your account or your use of our site and our services, answer or follow up on your comments and questions.
IV. Offer you customer service; notify you about changes in our conditions or in our privacy policy.
V. Billing and collection of the agreed price for the services provided, and other considerations that result at its own expense.
VI. For your safety during your stay at the Mobile Sail offices, we establish security and surveillance measures for the facilities, including monitoring, video cameras, physical and logical access monitoring and control.
VII. For your safety during your stay at the Mobile Sail offices, we establish security and surveillance measures for the facilities, including monitoring, video cameras, physical and logical access monitoring and control.
VIII. For your attention in case of health or safety incidents.
IX. Any other form of data processing derived from your capacity as client, user of our web pages, or supplier, such as billing, order processing and integration of administrative records as documentary support or other support regarding the existing commercial relationship with you.

b) Particularly, as employee or aspirant to get a job with Mobile Sail Technologies, S.A. de C.V., the following primary purposes will also apply:

• Integration of your employee file.
• For hiring and/or job promotion processes.
• To carry out socio-economic and psychometric studies.
• For the granting of work benefits.

c) Particularly, as a Supplier of Mobile Sail Technologies, S.A. de C.V., will also apply the following primary purposes:

• For the preparation of contracts for the provision of services.
• For the fulfillment of contractual obligations.
• For the payment processes, reception and/or return of acquired goods and services.
• For order processing and integration of administrative files as documentary support or other support regarding the existing commercial relationship with you.

Additionally, we use your personal data for the following secondary purposes that are not necessary for the requested service, but that allows us and make it easier to provide better service:

• Marketing or advertising
• Commercial research
• Quality control
• Definition of consumption patterns
• Conducting of feedback campaigns and data update.

In case you do not want your personal data to be used for these secondary purposes, we ask that you let us know using the option that is applicable:

• In case you provide your data directly, let our collaborator know at that moment and request the latter to provide the corresponding format to document your refusal.
• If you provide your information using our website, a mobile application or travel agent/agency, you must send an email to the following E-mail privacy@totoura.com.

Refusal to use your personal data for these secondary purposes may not be a reason for us to deny you the services and products that you request or contract with us.

2. What personal data will we use for these purposes?

• Identification data: Name, surnames, signature, photo ID, Unique Population Registration Code (CURP in Spanish).
• General data: Full address, whether private or work, personal or work email address; home or work phone number; cell phone number, Nextel ID (if applicable) and fax number; date of birth; age, marital status and nationality.
• Tax data: Federal Taxpayers Registry Key (RFC in Spanish), as well as fiscal domicile and tax regime (if applicable).
• Bank account data: Numbers linked to bank accounts, credit and/or debit cards, name of the account or card holder, account number and home bank, Standardized Bank Code (CLABE in Spanish) (if applicable), credit or debit card number; Card expiration date, card type and security code. All these data is stored with your express consent and if you let us know your opposition we may be prevented from providing the contracted services because it may not be possible to process the corresponding payment.
• Sensitive personal data: Except for the medical services and work records, Mobile Sail Technologies, S.A. de C.V., does not collect or process sensitive personal data. However, you should keep in mind that some tour or product providers and some of our affiliates and distributors may need additional personal data or other information (such as information about physical activity or health) to determine if you can participate in an activity or not. In this case, this information is subject to the Privacy Notice of the supplier or distributor, and is not collected by Mobile Sail Technologies, S.A. de C.V.
• Personal data from sources of public access and received via consensual transfers: from public records, directories, social networks and other lawful sources available in the market, as well as personal data that has been shared by third parties which had been previously authorized.
• Personal data from social networks: Mobile Sail may collect or process personal data and information that has been shared in social networks to Totoura (such as Facebook®, Instagram ®, Pinterest®, Foursquare®, Google® y Twitter®, among others), particularly the information shared in Totoura.com profile, in such social networks or in the profile of other companies related to Mobile Sail Technologies, S.A. de C.V., including the information that you have shared as “public”, as provided by the terms and conditions of use and their policies and statements.
• Personal data from travel agencies: Mobile Sail Technologies, S.A. de C.V., could receive your personal data when you make your reservation for excursions, land transfers, as well as the hiring of other complementary services that from time to time you contract through our conduit; either through a retail or wholesale travel agency with domicile in national territory or abroad, as well as other platforms that market the services of MOBILE SAIL, (internet sites, airline vacation programs, travel clubs, benefits and rewards programs, and other similar ones known).
• Information about other people or referrals: In case you use the option “Recommend a friend” or buy products or services for another person through Totoura.com, you will have to send the personal data of that person. You must obtain the consent of these other persons, before providing us with personal information about them.
• Personal data from affiliates or subsidiary companies with which you already have a contractual relationship and to which you have expressed your consent to be transferred to Mobile Sail Technologies, S.A. de C.V.
• Information about location and other data from devices: When you use the Totoura.com app, on a mobile device, we will collect and use information about you, in general, in the same manner and for the same purposes as when you use the website of Totoura.com. In addition, if we have your consent, we may collect information about your location if you have set your Device to send such information to the Application through the Device’s privacy settings, or if you have uploaded tagged photos with location information. For example, we may use your location to show you tours or excursions that are organized near you when you travel. You may change the privacy settings of your Device at any time in order to disable the functionality to share location information with the Application and/or the functionality to tag your photos with location information. Please note that disabling location sharing may affect certain features of our Application. If you have any questions about the privacy settings of your Device, we suggest you contact the manufacturer of the Device or your mobile service provider for help.
• Automatic information gathering: We automatically collect certain information from your computer or mobile device when you visit Totoura.com, or any of the websites of our affiliates hosted by us. For example, we collect your IP address, your web browser software and the reference website. To help us analyze the use of our websites and related services, and to send you more relevant communications, we also collect and keep track of your online activity, such as the content you consult, the pages you visit and the searches and reservations that We provide and performs.

The personal data described in the subparagraphs above of this subsection, are collected through: i) the use of printed formats or documents; ii) the use of emails and/or iii) the voluntary supply of information and personal data when you register on our websites, acquire our services, present in our facilities, when you communicate by phone with us or with our collaborators (including the customer service area); iv) via our website www.totoura.com, chat applications as well as v) the use of public access sources and other sources available in the market.

How do we protect your personal data?

The personal data collected by Mobile Sail Technologies, S.A. de C.V., is protected by adequate security, administrative and physical measures against damage, loss, alteration, destruction, use, access or unauthorized or illegal treatment, disclosure, and against loss, damage or accidental alteration or destruction, in accordance with the provisions in the Federal Law for the Protection of Data in Possession of Private Companies or Individuals and its Regulations. To learn more about our security measures, please contact us at privacy@totoura.com.

We strive to store your personal data in secure operating environments that are not accessible to the general public, and to apply security measures in our physical facilities to protect against the loss, misuse or alteration of your personal data by our employees or third parties.

Nevertheless, it is not possible to guarantee 100% the security of any data transmission over the Internet or of any data storage environment, so that we cannot assure you in absolute terms that the personal data you provide us is protected at all times. Mobile Sail Technologies S.A. de C.V., trusts that you inform us if you experience any unusual event that may indicate a violation of the security of your information. In that case, we will endeavor to investigate if this fact was related to the transmission of data whose origin or destination is Totoura.com, and we will inform you about the measures you can take and that have been taken to help correct the problem.

Information related to minors:

Totoura.com is a site for the general public, and does not offer services aimed at minors. In case Totoura.com is informed that a person under 13 has sent us personal information, we will delete or destroy such information as soon as reasonably possible. If you know a minor who is enrolled in the website of Totoura.com, please inform us via email at privacy@totoura.com, in order to delete that information.

3. With whom do we share your personal information and for what purposes?

• We inform you that your personal data may be transferred to third parties inside and outside the national territory in case it is necessary to carry out the purposes set forth in this privacy notice.
• We also inform you that Mobile Sail Technologies, S.A. de C.V., is a member of a corporate group commercially known as “MARIVAL® GROUP” and may transfer your personal data with other companies of the same group, pursuant to the provisions in Article 37 of the Federal Law for the Protection of Data in Possession of Private Companies or Individuals, in force in Mexico, regarding the related parties. The companies that are members of the group are:
  • Rinoval de México, S.A. de C.V.,
  • Administraciones Profesionales de Vallarta, S.A. de C.V.,
  • Vacation Club Services, S.A. de C.V.,
  • Operadora y Comercializadora Turística, S.A. de C.V.,
  • Destiladeras Resort Operations, S.A. de C.V.,
  • Desarrollo Transimar, S.A. de C.V.,
  • Constructores y Desarrolladores Inmobiliarios de la Bahía, S.A. de C.V.,
  • Comercializadora Access del Puerto, S.A. de C.V.,
  • Serviventas de México, S.A. de C.V., and
  • Servicios Terrestres del Nayar, S.A. de C.V.,
  • DMC Leisure, S.A. de C.V.
  • Travel Marketing 500, S. de R.L. de C.V.

• We will also share your personal data with independent third parties with whom we require to interact to carry out the purposes set forth herein, for example:

• Service providers: Some of the personal data we collect is shared with our service providers (for example, tour operators), who are directly involved in carrying out the purchases you make through us. We only provide our service providers with the necessary information (for example, the name of the hotel to be picked up or taken to, your local phone number, your mobile phone number, your email address, arrival and departure date). We recommend that you read the privacy policy of the service provider to determine how it may use or disclose your personal data.
• Referred websites: If you were referred to Totoura.com, from another website, we may share your registration information with the said referred website, such as your name, your email address, your postal address, your telephone number and your travel preferences. We have not limited the use that the referred websites make of your personal data, and we recommend that you review the privacy policies of any website that has sent you to Totoura.com.
• Third-party providers: We also share your personal data with third-party providers that offer services or functions on our behalf, such as commercial analysis, payment processing, customer service, marketing, public relations, distribution of surveys or sweepstakes programs, and fraud prevention. In addition, we may authorize third-party providers to collect personal data on our behalf, which includes, for example, those that are necessary to handle the functions of our websites or Applications, or to provide the online advertising distribution adapted to your interests. The third-party providers have access and may collect personal data only when necessary t carry out their duties, and they cannot share or use personal data with any other purpose. Currently, we hire different third-party providers online to help us manage and improve our communications and our Internet activity. We use the services of third-party marketing companies to help us measure the effectiveness of our advertising and know how our visitors use our web site.
• The said independent third parties especially include banking institutions to process your payments. This transfer will always be optional and you can object at any time. The third parties with whom we will share your personal data can be:
• Servicios terrestres del Nayar, S.A. de C.V.,
• DMC Leisure, S.A. de C.V.
• Travel Marketing 500, S. de R.L. de C.V.
• We will also share your personal data with independent third parties with whom we require to interact to carry out the purposes set forth herein, for example:
• Service providers: Some of the personal data we collect is shared with our service providers (for example, tour operators), who are directly involved in carrying out the purchases you make through us. We only provide our service providers with the necessary information (for example, the name of the hotel to be picked up or taken to, your local phone number, your mobile phone number, your email address, arrival and departure date). We recommend that you read the privacy policy of the service provider to determine how it may use or disclose your personal data.
• Referred websites: If you were referred to Totoura.com, from another website, we may share your registration information with the said referred website, such as your name, your email address, your postal address, your telephone number and your travel preferences. We have not limited the use that the referred websites make of your personal data, and we recommend that you review the privacy policies of any website that has sent you to Totoura.com.
• Third-party providers: We also share your personal data with third-party providers that offer services or functions on our behalf, such as commercial analysis, payment processing, customer service, marketing, public relations, distribution of surveys or sweepstakes programs, and fraud prevention. In addition, we may authorize third-party providers to collect personal data on our behalf, which includes, for example, those that are necessary to handle the functions of our websites or Applications, or to provide the online advertising distribution adapted to your interests. The third-party providers have access and may collect personal data only when necessary t carry out their duties, and they cannot share or use personal data with any other purpose. Currently, we hire different third-party providers online to help us manage and improve our communications and our Internet activity. We use the services of third-party marketing companies to help us measure the effectiveness of our advertising and know how our visitors use our web site.
• The said independent third parties especially include banking institutions to process your payments. This transfer will always be optional and you can object at any time. The third parties with whom we will share your personal data can be:

Finally, we indicate that we will transfer your data in the cases provided in Article 37 of the Federal Law for the Protection of Data in Possession of Private Companies or Individuals, in force in Mexico, which expressly establishes the possibility of sharing your data with competent authorities and controlling companies, subsidiaries or affiliates under the common control of the person in charge, or to a parent company or any company thereof, which are:

I. When the transfer is foreseen in a Law or Treaty in which Mexico is a party;
II. When the transfer is necessary for prevention or medical diagnosis, the provision of health care, medical treatment or the management of health services;
III. When the transfer is made to controlling companies, subsidiaries or affiliates under the common control of the person in charge, or to a parent company or to any company of the same group of the person responsible operating under the same internal processes and policies;
IV. When the transfer is necessary by virtue of a contract concluded or to be concluded in the interest of the holder, by the person responsible and a third party;
V. When the transfer is necessary or legally required for the safeguarding of a public interest, or for the procurement or administration of justice;
VI. When the transfer is necessary for the recognition, exercise or defense of a right in a judicial process, and
VII. When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the person in charge and the holder

Conservation periods:

Mobile Sail Technologies, S.A. de C.V., will keep the personal data as long as necessary to comply with the purposes for which it collected the information, including the purposes to comply any legal, accounting, and reporting requirements, in accordance with the provisions in Article 37, the Regulation of the Federal Law for the Protection of Data in Possession of Private Companies or Individuals, in force in Mexico.

In order to determine the appropriate retention period, we take into account the amount, nature and degree of confidentiality of the personal data, the potential risk of damage caused by the unauthorized use or disclosure of your personal data, the purposes for those that process the said data and if we can achieve the said purposes by other means, as well as the legal provisions in force.

4. How can you access, rectify or cancel your personal data, or oppose its use?

You have the right to know what personal data we have about you, what we use it for and the conditions of use we give them (Right of Access). Likewise, it is your right to request the correction of your personal information in case it is outdated, inaccurate or incomplete (Right of Rectification); that we remove it from our records or databases when you consider that it is not being used properly (Right of Cancellation); as well as oppose the use of your personal data for specific purposes (Right of Opposition). These rights are known as ARCO rights.

In relation to the procedure and requirements for the exercise of your ARCO rights, we inform you the following:

a) What information, documentation and requirements should the application contain?

In regards to the general requirements that the application shall cover are the followings:

• Name of the holder of the personal data.
• Documents proving the identity of the holder (passport, voting credential issued by the National Electoral Institute, state or federal professional ID or driver’s license).
• If applicable, name of the holder’s representative and documents to prove their identity and personality. In the case of proxies of individuals, the representation shall be accredited by the following 3 options: a) public instrument (document signed by a Notary Public), b) power of attorney signed before two witnesses (attaching a simple copy of their official identifications), c) by appearing personally with your representative to testify in the appearance of the person in charge presenting official identification (passport, voter card issued by the National Electoral Institute, state or federal professional ID or driver’s license).
• Domicile or any or any means to receive notifications.
• Clear and precise description of personal data and the right to be exercised or of what is requested.
• The data or documents that facilitate identifying the information subject matter of the application (for example, membership number, date of stay, reservation number, dates of lodging, etc.).

In addition, in relation to the kind of request, we also require to please indicate the following additional information so that your request can be handled more efficiently:

• Right of Access:
  • Indicate the modality in which you prefer that the requested personal data be reproduced.
• Right of Rectification:
  • Specify the requested modifications to personal data, as well as provide the documents that support the request.
• Right of Cancellation:
  • Point out the causes that motivate the request to delete the data of the files, records or databases of the person responsible.
• Right of Opposition:
  • In the event that the request refers to a particular treatment, the specific purposes for which the exercise of the right is requested must be indicated.
• Revocation of consent:
  • You can revoke the consent that, in your case, you have granted us for the treatment of your personal data. However, it is important that you keep in mind that not in all cases we will be able to attend your request or terminate the use immediately, since it is possible that for some legal obligation we require to continue treating your personal data. Likewise, you should consider that, for certain purposes, the revocation of your consent will imply that we cannot continue to provide the service you requested, or the conclusion of your relationship with us.

b) Through what means can the holder and, where appropriate, its representative, prove its identity as well as its personality?

To exercise any of the ARCO rights, you must submit the respective application through the following means:

Through email to the following address privacy@totoura.com or you can also contact our Personal Data Department to process your request, provide guidance and provide the corresponding format. The domicile of our Personal Data Department is Paseo de los Cocoteros s/n, hotel Marival^® Emotions Resort & Suites, fraccionamiento Nuevo Vallarta, municipio de Bahía de Banderas, Nayarit, código postal 63732, phone number 322-2268200 (extension 4493).

You may request the official format for following up ARCO’s requests for Mobile Sail Technologies, S.A. de C.V., to the following email address privacy@totoura.com.

c) In how many days will we answer your request?

20 business days

d) By what means will we communicate the response to your request?

By email or by postal service.

e) On what means can the personal data that you request be reproduced?

In the same way that they have been provided by the client.

f) We put at your disposal the following forms or systems to facilitate the exercise of ARCO rights:

The corresponding forms or systems and guidance on the exercise of ARCO rights can be obtained by contacting our Personal Data Department at the email address: privacy@totoura.com, or in its physical address located in Paseo de los Cocoteros s/n, hotel Marival^® Emotions Resort & Suites, fraccionamiento Nuevo Vallarta, municipio de Bahía de Banderas, Nayarit, código postal 63732, phone number 322-2268200 (extension 4493). You may also directly download the form right aquí.

g) Is there a cost for the exercise of my ARCO rights?

The exercise of ARCO rights is free. However, you may be required to cover justified shipping costs or the cost of reproduction in copies or other formats. In the same way, if the same person reiterates his/her request in less than twelve months, the costs will not be greater than three days of the Minimum General Wage in Force in the Federal District, unless there are substantial modifications to the privacy notice that motivate new queries

h) What happens if an application is incomplete or not all the data included in the procedure is attached?

In case that your request does not have the information described in section 4 Requirements (subparagraphs a and b), or, is not clear, wrong or incomplete, Mobile Sail Technologies, S.A. de C.V., may request the holder to provide the missing information to handle his/her request within the following 5 business days of receiving the request, if the request is not answered, it will be considered as not submitted.

The holder will have 10 business days to address the requirement by Mobile Sail Technologies, S.A. de C.V., as of the following day in which it was received. In case the holder answers the information requirement, the deadline for the person responsible to respond will start running the day after the holder has met the requirement.

For additional information about the procedure, we put at your disposal the following means:

• E-mail: privacy@totoura.com
• Contact our data protection department, which is in charge of addressing the Arco rights requests, are the following:
• Name of the person or personal data department: Personal Data Department Grupo Marival.
• Domicile: Paseo de los Cocoteros s/n, interior Marival^®Emotions Resort & Suites, en el fraccionamiento Nuevo Vallarta, municipio de Bahía de Banderas, Nayarit, México, 63732.
• E-mail: privacy@totoura.com
• Phone number: 322-2268200

6. How can you limit the use or disclosure of your personal data?

In order for you to be able to limit the use or disclosure of your personal information, we offer the following means: the client can limit the use or disclosure of their persona data by sending an email where you make the specific approach to the email address: privacy@totoura.com

Additionally, we inform you that we have the following exclusion listings, in which you can register or, unsubscribed in our shipping platforms, so that your personal data is not treated for certain purposes (mainly secondary):

7. Use of tracking technologies in our internet portal

We inform you that in our web site we use cookies, or other technologies, through which it is possible to monitor your behavior as an internet user, as well as provide you with a better service and experience when browsing our page. The personal data that we collect through these technologies will be use for the following purposes:

To monitor and prevent the misuse of digital platforms; to improve our digital tools and update them as technology evolves; and to offer personalized content.

The personal data we obtain from these tracking technologies are the following:

• Identifiers, username and passwords of a session.
• Language preferred by the user.
• Region in which the user is located.
• User’s type of browser.
• User’s type of operating system.
• Web pages visited by a user.
• Searches made by a user.
• Reviewed advertising by user.

For more information, it is suggested you visit our Cookies Policy (Política de Cookies):

8. How can you know the changes in this privacy notice?

This privacy notice may undergo modifications, changes or updates derived from new legal requirements; of our own needs for the products or services we offer; of our privacy practices; changes in our business model, or other causes.

We promise to keep you informed about the changes that this privacy notice may undergo, through:

Sending an email and on the website totoura.com

The procedure through which notifications about changes or updates to this privacy notice will be carried out is as follows:

Changes or updates to the privacy notice will be announced by the means described in this policy and will take effect 1 week later. In case of doubts or comments, clients should contact privacy@totouta.com

Last update: 18/09/2019