Privacy notice

1.Who is responsible for your data

AT TRANSFERS & TOURS (RFC ATA230316JG1), trading as All Transfers, with its registered address at Isla Capri, Manzana 100 Lote 3, Edificio K, SM 251/201, Paseos del Mar, C.P. 77519, Cancún, Benito Juárez, Quintana Roo, México, is the controller of your personal data under Mexico’s Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its regulations.

For anything concerning your personal data, write to hola@alltransfers.mx.

2.What we collect

Only what we need to get you to your destination and charge you for it:

• Identity and contact: first and last name, email address, and a phone number with WhatsApp.
• Trip details: flight number, pickup date and time, destination hotel or address, passenger count and vehicle class.
• Tax or identification details (RFC, CURP or passport) only when the payment processor requires them to authorize the charge, or when you request an invoice.
• If you volunteer them: children’s ages, so we fit the right seat, and accessibility needs, so we assign a suitable vehicle. We use them for that and nothing else.
• If you ask for a coupon: your email address and, if you had one on screen, the quote you were looking at (destination, vehicle, passengers and trip type), plus the language and the page you asked from. We do not ask for your name or phone number to give you one.
• If we refund a cash or SPEI payment: the bank account details you give us so we can make the transfer. We use them for that refund and nothing else.

We do not collect your card details. The number, expiry date and security code are entered into fields hosted by Mercado Pago and travel encrypted straight to their platform — they never pass through our servers and we never store them. With Apple Pay or Google Pay, your wallet hands them encrypted straight to Stripe.

We do not request sensitive personal data as defined by the LFPDPPP.

3.What we use it for

Primary purposes, necessary to provide the service you booked:

• Confirm, operate and follow up on your transfer.
• Assign a driver and vehicle, and share with them only what they need to pick you up.
• Track your flight and adjust the pickup time.
• Process the charge — or generate your payment slip, if you choose cash or SPEI — and, where applicable, the refund.
• Send you the confirmation, your reference and your driver’s details.
• Support you on WhatsApp, email or phone before, during and after the trip.
• Meet tax and accounting obligations and respond to lawful requests from authorities.

If you ask for a coupon, we use your email for three things and only those: to send you the code; to tell our team you asked for it —with your email and your quote, through an internal messaging tool— so they can follow up on your quote; and to write to you to help you quote or book if needed. If you would rather we did not write, tell hola@alltransfers.mx and we will note it.

We do not use your data for marketing beyond the coupon you ask for, we do not add you to any mailing list, and we do not sell or rent it to anyone. Each coupon request produces a single email with your code. If we ever wanted to send you more promotions, we would ask you first and separately.

4.Who we share it with

Only the parties needed for the trip to happen:

• Mercado Pago México, to process a card charge, generate your cash or SPEI payment slip, and make any refund. It receives your name, email and phone, the hotel or destination, and the trip details (route, vehicle, passengers, date and time) and, if you enter it when paying by card, your identification document.
• PayPal, when you choose to pay with PayPal instead of a card. It receives your name, email and the trip amount.
• Stripe, when you pay with Apple Pay or Google Pay, to process the charge and any refund. It receives your encrypted card from your wallet and, if your wallet shares them, your name and billing address, plus the trip amount and date.
• Your assigned driver, who receives your name, flight, time, destination and phone number — nothing more.
• Resend, which sends our emails: your booking confirmation, the payment slip if you choose cash or SPEI, and the coupon. It receives your email address and the content of the message.
• Telegram, the internal messaging tool where our team receives operations alerts: when someone asks for a coupon (your email and your quote), and when a payment slip is generated or a booking is made (the trip and contact details). Only our team reads it.
• Vercel, which hosts the site and logs technical connection data (IP address, browser) as any web server does.
• Google (Analytics), browsing data only and only with your permission — the detail is under “Cookies and tracking” below.
• Microsoft (Clarity), on the payment page only: a recording of how the form is used, with all its fields masked and under the same permission — also under “Cookies and tracking”.
• Competent authorities, where there is a legal obligation.

We make no data transfers requiring your consent under the LFPDPPP.

5.Cookies and tracking

This site uses Google Analytics 4 to understand how many people visit, where they arrive from and which pages help travelers book. It is the measurement tool for the whole site; the payment page adds a second one, explained below. There are no advertising pixels from Google Ads, Meta or anyone else, we do not track you across sites and we do not build an advertising profile of you.

We ask you first where the law requires it. If you visit from the European Economic Area, the United Kingdom or Switzerland, measurement stays switched off until you accept and no cookie is stored on your device meanwhile. From everywhere else — including Mexico, whose LFPDPPP does not require prior permission for analytics — measurement starts switched on and you can switch it off whenever you like.

With measurement on, Google Analytics sets two first-party cookies — _ga and _ga_<identifier>, lasting up to two years — which let it recognize that two visits came from the same browser.

How you got here, if you book. When you arrive we note in your browser where you came from: the domain of the site that brought you (never the specific page), any campaign parameters in the address, and the first page you saw. It lives in tab storage and is erased when you close the tab: it is not a cookie, it does not follow you between visits and it is not shared with anyone. It only leaves your browser if you start paying for a booking, traveling along with it so we know which channel it came from. If you do not book, it is never sent anywhere.

You can change your answer at any time from the “Cookies” link in the footer of any page, whether or not you were asked. Declining limits nothing: you can still get a price, book and pay.

What Google receives is browsing data — pages viewed, traffic source, approximate country and city, device type — tied to a random identifier. Your name, email, phone, hotel and flight number are never sent to it. When you complete a booking we report the reference and the amount so the conversion can be counted; that reference encodes the trip date and destination, and carries none of your contact details.

Google acts as a data processor and may process that information in the United States. Its policy is at policies.google.com/privacy, and you can block measurement on any site with Google’s opt-out add-on.

Session recording, on the payment page only. There we also use Microsoft Clarity, which records how the form is used — where the cursor moves, what is tapped, how far you get — so we can understand why someone does not finish a booking and fix it. It loads after your first interaction with the page and under the same rule as above: where the law requires it, it does not start until you accept, and if you decline later it stops. Every field in the form is masked: your name, email, phone, hotel and flight do not appear in the recording, and your card details live in fields run by the payment processor that Clarity cannot see. Clarity sets two first-party cookies, _clck and _clsk, to recognize your session. Microsoft acts as a data processor and may process that information in the United States; its policy is at privacy.microsoft.com/privacystatement. Only our team sees the recordings, and we use them to improve the site — never to identify you or for advertising.

Your answer to this question is kept in your browser’s local storage so we do not ask again. It never leaves your device and reaches no server, ours included.

If we ever add advertising or any other tracking tool, we will say so here and update this notice’s date before turning it on.

6.How long we keep it

Booking and payment records are kept for the period Mexican tax law requires — five years from the relevant fiscal year — and are deleted afterwards. Operational conversations on WhatsApp or email are cleared once they are no longer needed for your trip or a follow-up. If you asked for a coupon and did not book, your email and your quote only remain in the message we sent you and in our team’s internal alert, and are cleared once they are no longer needed to follow up on your request.

7.Your ARCO rights

You have the right to access your data, rectify it if it is inaccurate, cancel it when it is no longer needed, and object to a specific use. You may also withdraw your consent at any time.

To exercise them, send your request to hola@alltransfers.mx including: your name and a way to reply to you; a copy of official photo ID; a clear description of the data and the right you want to exercise; and, for a rectification, the correct value and a document supporting it.

We will reply within a maximum of 20 business days and, if your request is granted, act on it within the following 15 business days. The process is free; we could only charge for shipping or document reproduction costs.

If you believe your data protection rights have been infringed, you may approach the competent personal data protection authority in Mexico.

8.Minors

We do not offer the service directly to minors. When children travel, their details — name and age — are given to us by the adult making the booking, and we use them only to fit the correct seat and assign a suitable vehicle.

9.Changes to this notice

Any change to this notice is published on this same page, with the updated date shown above. We recommend checking it before each booking.