Golden Cabo Transportation
This Privacy Notice is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations and the applicable Privacy Notice Guidelines. Please read it before using this website or booking our services. The Spanish version is the only legally binding one; this English text is provided as a courtesy translation.
1. Identity and address of the data controller
CEUR Transportation S. de R.L. de C.V., trading as Golden Cabo Transportation (the "Controller", "we" or "the Company"), with address at Calle Huanacastle Esq. Eucalipto Mza 70 lte 1, Col. Las Veredas, CP 23436, San José del Cabo, BCS, is responsible for the processing of your personal data.
For any matter regarding your personal data, contact our Departamento de Datos Personales:
- Email: goldencabotransportation@gmail.com
- Phone: (+52) 624 121 6527
- Address for notices: as stated above.
2. Personal data we collect
2.1 Data you provide directly
When you request a booking, quote a transfer, book a tour or write to us, we collect:
- Identification data: first and last name.
- Contact data: email address, phone number and, where applicable, messaging handle.
- Service data: hotel or destination address in Los Cabos, flight number, airline, arrival and departure date and time, number of passengers, special luggage and specific trip requirements.
- Transaction data: order number, service type, zone, assigned vehicle, amount and receipts.
- Financial or asset data: none. The site does not process online payments; the service is settled in cash directly with the driver. We will not ask you for card numbers, security codes or bank accounts through the site or our forms. Only if you request a tax invoice will we collect your tax details, and solely to issue it.
About addresses. The only address we collect is the pick-up or drop-off location of the transfer — usually your hotel — because the service cannot physically be provided without it. We do not collect, and do not attempt to infer, your home address from your browsing.
2.2 Data collected automatically while you browse
By the mere fact of visiting this website, our servers automatically record:
- The IP address you connect from.
- Approximate geographic location derived from that IP address: country, state or region, city and, where the provider determines it, postal code and the coordinates of that city's centre.
- Technical device data: device type, operating system, browser, configured language and internet service provider.
- Browsing data: pages visited, date and time of the visit, the site or campaign you arrived from, and campaign parameters (UTM).
Accuracy of location. Location derived from an IP address is approximate and not always accurate: it identifies your connection's exit point to the internet — typically a carrier facility or your hotel's Wi-Fi — not your actual physical position. It cannot reveal your home address or your exact position, and we do not use your device's GPS unless you expressly authorise it in your browser.
Until you accept analytics in our cookie banner, your IP address is stored only in pseudonymised form, through an irreversible cryptographic function that allows us to count visitors without retaining the value in the clear, and no geolocation lookup is performed.
3. Sensitive personal data
We do not collect sensitive personal data — racial or ethnic origin, health status, genetic information, religious or philosophical beliefs, union membership, political opinions or sexual preference — for the ordinary purposes of this website.
Exceptionally, if you choose to inform us of a health, mobility or disability condition so that we can adapt the vehicle or the service (for example, wheelchair space), that data is sensitive and will be processed solely to provide the requested service, with access restricted to essential operational staff, on the basis of your express consent, which is understood to be given when you voluntarily provide it for that purpose. You may omit that information and request the adjustment by phone instead.
4. Primary purposes
Your data is necessary for the following purposes, without which we cannot provide the service:
- Managing, confirming, amending and cancelling your transfer bookings and tours.
- Coordinating operations: vehicle and driver assignment, meeting point and time, and flight tracking.
- Issuing and sending your booking voucher.
- Communicating with you by email, phone or messaging about the contracted service.
- Handling your questions, requests, complaints and claims.
- Invoicing and collection, and complying with tax, accounting and administrative obligations.
- Complying with requirements from competent authorities and legal obligations applicable to tourist transport.
- Ensuring site security: preventing fraud, form abuse and automated attacks.
5. Secondary purposes
Additionally, and only with your consent, we will process your data — including browsing data, IP address and approximate location — for the following purposes, which are not necessary for the contracted service:
- Audience measurement: knowing how many people visit the site, from which countries and cities, which pages they view and which channels they arrive from, in order to improve the site and our services.
- Commercial and marketing purposes: producing market statistics, identifying peak zones and seasons, adjusting our routes, rates and tour offering, and assessing the performance of our advertising campaigns.
- Commercial prospecting and advertising: sending you promotions, seasonal offers and news about our services, and showing you more relevant advertising.
- Quality surveys and customer experience assessment.
You may refuse right now. If you do not want your data processed for these secondary purposes, you have three equally valid, cost-free options:
- Choose "Essential only" or configure your preferences in the cookie banner shown on your first visit.
- Email goldencabotransportation@gmail.com with the subject "Refusal of secondary purposes".
- Use the unsubscribe link included in any promotional message we send you.
Your refusal is never a reason to deny you services you have booked, and does not affect service quality in any way.
6. Legal basis and consent
Processing for primary purposes is based on the legal relationship you enter into with us when you request or book a service, and on our compliance with legal obligations; under article 10 of the LFPDPPP, your consent is not required in these cases.
Processing of strictly necessary browsing data for the site to function and remain secure is based on your tacit consent: the LFPDPPP permits this for data that is not sensitive, financial or asset-related, provided this Notice is made available to you and you do not object. We make this Notice available through a visible link on every page of the site and through the banner displayed on your first visit.
Processing for the secondary purposes described in section 5 — including retaining your IP address in the clear and determining your approximate location — is carried out only with your consent, given when you click "Accept" in the cookie banner or enable the corresponding categories in your preferences panel. We keep a record of that choice, its date and the version of this Notice in force at that time.
If you continue browsing without stating a choice, we will understand tacit consent to have been given for the primary purposes and the basic audience measurement described in section 2.2, but not for the secondary purposes, which remain disabled until you expressly accept them.
7. Cookies, web beacons and other tracking technologies
This website uses cookies and equivalent technologies. Details of each one — name, purpose, duration and owner — and the means to disable them are set out in our Cookie Notice, which forms an integral part of this Privacy Notice.
8. Data transfers and remittances
We do not sell, rent or trade your personal data.
To operate, we share data with suppliers acting as processors, meaning they process it exclusively on our behalf and under our instructions, never for their own purposes. Under article 36 of the LFPDPPP, these remittances do not require your consent:
| Processor | Purpose | Data involved |
|---|---|---|
| Web hosting and email provider | Running the site, the database and confirmation emails | All data collected |
| IP geolocation provider | Determining approximate country, state and city | IP address |
| Drivers and service operators | Performing the contracted transfer | Name, phone, hotel, flight, schedule |
| Accountant and invoicing provider | Issuing tax receipts | Tax and transaction data |
In addition, your data may be transferred without your consent in the cases set out in article 37 of the LFPDPPP, in particular: where required by law or treaty, where requested by a competent authority, where necessary for the recognition or defence of rights in legal proceedings, or where indispensable to perform the contract entered into with you. Any other transfer requires your prior consent.
Some of our technology providers are located outside Mexico. In those cases we contractually require protections equivalent to those provided by Mexican law.
9. ARCO rights
You, or your duly accredited legal representative, have the right to:
- Access the personal data we hold about you and know the conditions of its processing.
- Rectify it where it is inaccurate or incomplete.
- Cancel it where you believe it is not required for any of the stated purposes or is being processed in breach of the law.
- Object to processing for specific purposes, including audience measurement and marketing.
How to exercise them
Send your request to goldencabotransportation@gmail.com or submit it in writing at our address, stating:
- Your full name and an address or email where we can send our reply.
- A copy of your valid official ID (and of the power of attorney, if acting through a representative).
- A clear description of the data concerned and the right you wish to exercise.
- Any element helping us locate your data (order number, the email you booked with, service date). To exercise your rights over browsing data, please give us the IP address you browsed from and the approximate date: it is the only identifier by which those records can be located.
Deadlines
We will notify you of our decision within a maximum of 20 business days from receipt of your request and, where the request is granted, will implement it within the following 15 business days. Both periods may be extended once for an equal period where circumstances justify it, which would be notified to you. Exercising these rights is free of charge; you would only cover shipping or reproduction costs, if any.
Your request may be refused in the cases set out in article 34 of the LFPDPPP, for example where you are not the data subject, where legal provisions require us to retain the data, or where the rectification or cancellation would affect third-party rights.
10. Withdrawal of consent
You may withdraw your consent at any time, through the same channel described above or, for cookies and analytics, by reopening the preferences panel from the "Cookie preferences" link in the footer. Withdrawal takes effect going forward and does not affect the lawfulness of processing carried out beforehand.
Please note that withdrawal may prevent us from continuing to provide an ongoing service where the withdrawn data is indispensable to perform it.
11. Limiting use or disclosure
To limit the use or disclosure of your data you may, at no cost:
- Request registration in our internal advertising exclusion list by writing to goldencabotransportation@gmail.com. We will confirm your registration within 5 business days.
- Adjust your cookie preferences from the site's panel.
- Register with the Public Registry to Avoid Advertising of Mexico's consumer protection agency (repep.profeco.gob.mx).
12. Retention period
- Booking and contact data: for the duration of the service and thereafter for as long as needed to address liabilities arising from the relationship and comply with tax obligations, which under Mexico's Federal Tax Code is 5 years.
- Browsing records (IP, approximate location, pages visited): 365 days, matching the stated purpose of comparing traffic against the same period the previous year. They are deleted once that period expires.
- Consent records: while consent remains in force and for up to 2 years after its withdrawal, as evidence of legal compliance.
Once these periods end, data is deleted through secure blocking and erasure procedures.
13. Security measures
We have implemented administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorised use, access or processing, including: HTTPS traffic encryption, role- and permission-based access control within our admin panel, pseudonymisation of IP addresses where no consent exists, access logs, strong passwords with session expiry, and periodic backups.
In the event of a security breach that significantly affects your economic or moral rights, we will inform you without delay so you can take appropriate measures, as required by law.
14. Minors
Our services are aimed at adults. We do not collect minors' data directly; when a minor travels as a passenger, their data — name and age, for child seat and insurance purposes — is provided by the contracting adult, who represents that they are entitled to do so. If we detect that we have collected a minor's data without such involvement, we will delete it.
15. Changes to this Notice
We reserve the right to amend this Privacy Notice to reflect legislative developments, internal policies or new services. Any amendment will be published on this same page, with the version date at the foot updated, and — where the change is substantial — communicated to you through a prominent notice on the home page and, if we hold your email address, by that channel. We recommend checking this page periodically.
Version in force: 2026-08-13.
16. Data protection authority
If you believe your right to personal data protection has been harmed by any act or omission on our part, or you suspect a breach of the LFPDPPP, you may file a complaint with the competent Mexican authority for the protection of personal data held by private parties, within the deadlines set by that law. We would be grateful for the opportunity to address your concern first by writing to goldencabotransportation@gmail.com.
Last updated: 2026-08-13 · CEUR Transportation S. de R.L. de C.V. · Calle Huanacastle Esq. Eucalipto Mza 70 lte 1, Col. Las Veredas, CP 23436, San José del Cabo, BCS