Privacy Policy / Aviso de Privacidad

1. Data Controller Identification

Casa Bella ("we," "us," or "our"), operating out of Playa del Carmen, Quintana Roo, Mexico, is the data controller responsible for casabellapdc.com. We process and safeguard personal data in compliance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares - LFPDPPP), the EU General Data Protection Regulation (GDPR), and applicable US/Canadian privacy frameworks (including CCPA/CPRA and PIPEDA).

2. Personal Data We Collect & Processing Purposes

We enforce strict data minimization standards. We only process personal information that you voluntarily provide to us:

• Direct Booking & Inquiries: When you contact us via WhatsApp, email, or direct contact forms, we process your name, telephone number, email address, and requested stay dates. This data is used strictly for primary operational purposes: responding to inquiries, issuing quotes, managing direct reservations, and delivering guest communications.
• No Secondary Commercialization: We do not sell, rent, or lease your personal information to third parties, nor do we run cross-site remarketing campaigns.
• Payment Processing: Credit card details are never collected or stored directly on our servers. Payments processed through external processors (such as Stripe) are governed by the payment provider's PCI-DSS compliant privacy policies.

3. Infrastructure, Server Logs & Cookies

Our website uses a privacy-first technical architecture designed to operate without invasive tracking mechanisms:

• Server & Security Logs: Hosted on Vercel and routed via Cloudflare, our infrastructure automatically records technical parameters (such as truncated IP addresses, browser user-agents, and request timestamps) strictly to maintain network stability, prevent malicious activity, and optimize load performance.
• Cookie-Free Telemetry: We use Vercel Web Analytics to measure aggregated, non-identifiable site metrics. This analytics pipeline uses no persistent cookies, avoids cross-site tracking, and anonymizes session hashes daily.
• Embedded Video Media: Property walkthroughs are served via YouTube's privacy-enhanced domain (youtube-nocookie.com). No tracking cookies or external session data are set on your device unless you press play on the video player.

4. Data Transfers & Third-Party Processors

To provide our web service, data may be processed on servers hosted by Vercel Inc. and Cloudflare Inc. in the United States or other global data centers under standard contractual clauses ensuring adequate data protection standards.

5. Your Legal Rights

Depending on your location, you hold statutory rights regarding your personal information:

• Mexico (ARCO Rights): You have the right to Access (Acceso), Rectify (Rectificación), Cancel (Cancelación), or Oppose (Oposición) the processing of your personal data under the LFPDPPP.
• EU/UK (GDPR): You have the right to request access, correction, erasure, restriction of processing, and data portability.
• US & Canada (CCPA/CPRA/PIPEDA): You have the right to know what personal data is collected, request deletion, and opt out of any potential data sale or sharing (which we do not perform).

Exercising Your Rights: To submit a request regarding your data, contact us directly via our host email or WhatsApp listed on the homepage. We will verify and fulfill valid requests within the statutory timeframes defined by applicable law.

6. Policy Updates

We reserve the right to revise this Privacy Policy to maintain alignment with legal requirements or technical changes. Revisions will be published directly to this URL with an updated effective date.