Comprehensive privacy notice

Nau Mai Travel Experiences · Last updated: October 13, 2026 [confirm publication date]

This English version is provided for convenience. In case of any discrepancy, the Spanish version (Aviso de privacidad) prevails.

In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation (Diario Oficial de la Federación) on March 20, 2025 (the "Law"), its Regulations and other applicable provisions, we make this Privacy Notice available to you in order to inform you what personal data we collect, what we use it for, with whom we share it and how you can exercise your rights.

1. Identity and address of the data controller

[LEGAL NAME], with Federal Taxpayer Registry number [RFC], operating under the trade name "Nau Mai Travel Experiences" (hereinafter "Nau Mai" or "we"), is the party responsible for processing your personal data.

2. Personal data we collect

We collect your personal data directly from you when you request information, ask for a quote or book a trip (in person, by phone, WhatsApp, email, social media or website forms), and indirectly when another person provides it to include you as a travel companion in a booking, or when our suppliers confirm information about their services. We process the following categories of data:

a) Identification data

Full name; date of birth; age; sex as shown on your travel document; nationality; signature; image of your official ID or passport (including the photograph it contains).

b) Contact data

Address; landline and/or mobile phone; email; social media or messaging app username when you contact us through those channels; name and phone number of an emergency contact [confirm whether collected].

c) Immigration and travel document data

Passport number, issuing country and expiry date; visa and electronic travel authorisation details (type, number and validity); frequent flyer, hotel loyalty or trusted traveller programme numbers; and, for minors, travel consent documentation when applicable.

d) Data of travel companions, including minors

The identification, immigration, travel preference and, where applicable, sensitive data of the people travelling with you, as well as the data of the mother, father or guardian of travelling minors. See section 6.

e) Financial and asset data

Cardholder name, number, type and expiry date of the bank card used for payment; bank transfer and deposit details (institution, account holder, reference and payment receipts); payment history, balances and statements for your bookings. Nau Mai does not store card security codes (CVV) [confirm practice].

f) Tax data

Name or legal name, Federal Taxpayer Registry number (RFC), tax regime, postal code of the tax address, CFDI use and email address for sending digital tax receipts (CFDI).

g) Travel preferences

Desired destinations, dates and length of stay; budget; reason or occasion for the trip (for example, honeymoon or anniversary); type of accommodation, room and bed; seat, class and airline preferences; interests and activities; and history of trips booked with Nau Mai.

h) SENSITIVE personal data

Sensitive data. Only when necessary for the service you request (purchasing travel insurance, special assistance requests, menus or arrangements with suppliers), we will process the following data that the Law considers sensitive: (i) current health status, medical conditions or pre-existing conditions relevant to insurance or travel assistance; (ii) allergies; (iii) dietary requirements for health reasons; (iv) mobility needs, special assistance or disability; and (v) dietary preferences for religious reasons, which may reveal religious beliefs. This data will be processed only with your express written consent, given by handwritten or electronic signature on the form in Annex A (article 8 of the Law).

i) Browsing data

When you visit naumai.com we automatically obtain certain data through cookies and similar technologies. See section 12.

j) Image, voice and testimonials

Photographs, videos, reviews and testimonials that you voluntarily share with us about your trip; they will only be used for the secondary purposes described in section 3.2 and only if you authorise it.

3. Purposes of processing

3.1 Primary purposes (necessary for our legal relationship with you)

Your personal data will be used for the following purposes, which are necessary for the service you request or book:

1. Respond to your information requests and prepare personalised quotes and travel proposals.

2. Design your itinerary and book, issue, modify and cancel the services purchased: flights, accommodation, tours and activities, transfers, travel insurance and rail passes.

3. Verify that travellers' names and documents meet each supplier's requirements, and inform you of immigration and travel document requirements.

4. Inform suppliers of your special health, dietary or mobility needs, when you have authorised it in accordance with section 4.

5. Purchase insurance and travel assistance policies, and help you manage claims.

6. Process payments, deposits, charges, refunds and penalties, and issue statements.

7. Issue digital tax receipts (CFDI) and comply with Nau Mai's tax, accounting and legal obligations.

8. Prepare and deliver your travel guide, personalised kit, itineraries, vouchers and other travel documents.

9. Assist you before, during and after your trip, including handling changes, cancellations, contingencies and emergencies.

10. Handle clarifications, complaints and claims before suppliers or authorities and, where applicable, establish, exercise or defend Nau Mai's rights.

11. Create and maintain your client file to follow up on the services purchased.

12. Verify your identity and prevent fraud in payment transactions.

13. Respond to requests from competent authorities.

3.2 Secondary purposes (not necessary for the legal relationship)

In addition, we will use your data for the following purposes, which are not necessary for the service requested but allow us to serve you better:

1. Send you newsletters, promotions, offers, event invitations and travel content for marketing, advertising and commercial prospecting purposes, by email, messaging or social media.

2. Invite you to answer satisfaction and service quality surveys.

3. Send you greetings on special dates (for example, birthdays or anniversaries).

4. Produce internal statistics and analyses to improve our services.

5. Publish photographs, videos and testimonials of your trip on Nau Mai's social media, website and promotional material. This purpose will only be carried out if you expressly authorise it by ticking the corresponding box in Annex A; images of minors will never be published without the express authorisation of their mother, father or guardian.

How to opt out of secondary purposes? You may object: (a) by ticking the corresponding boxes in Annex A or on the form through which you provide your data; (b) at any time, by emailing travel@naumai.com [confirm] with the subject "Objection to secondary purposes", stating your name and the purposes you object to; or (c) by using the "unsubscribe" link included in each newsletter or promotional communication. If this Notice was not made known to you directly or in person, you have five business days to object before we process your data for these purposes; even after that period you may revoke your consent or object at any time. Your objection will not be grounds for denying you the services you book with us.

4. Processing of sensitive personal data

• We only collect the sensitive data strictly necessary for the specific service you request (for example, quoting or purchasing travel insurance, requesting a wheelchair or airport assistance, or a special menu).
• We require your express written consent, by handwritten or electronic signature, on the Annex A form (article 8 of the Law). If the sensitive data belongs to an adult companion, they must give their own consent; if it belongs to a minor, it will be given by their mother, father or guardian.
• You may refuse to provide it; in that case we may not be able to purchase certain insurance coverage or request the corresponding special arrangements from suppliers.
• We limit access to this data to staff who need it, share it only with the insurer or supplier who must meet the specific need, and keep it for the minimum period necessary (section 13).

5. Consent

For the primary purposes and most of the data described, you are deemed to give your tacit consent when, this Notice having been made available to you, you do not express otherwise (article 7 of the Law). Financial and asset data are processed to fulfil the obligations arising from our legal relationship with you; however, as good practice we also ask for your express consent in Annex A. Sensitive personal data always requires your express written consent.

6. Data of minors and travel companions

• Minors. Nau Mai does not knowingly collect personal data directly from minors. Data of travelling minors is obtained only through their mother, father or guardian, who gives consent in accordance with the representation rules of the Federal Civil Code (article 89 of the Regulations of the Law). Minors' data is processed only for primary purposes; it is not used for marketing, and their image is not published without the express written authorisation of the person holding parental authority or guardianship. Minors' ARCO rights are exercised through their legal representative.
• Adult companions. If you provide us with data of other people who will travel with you, you declare that you have informed them of this Privacy Notice and have their authorisation to provide it. Each companion may exercise their ARCO rights directly and, in the case of sensitive data, must sign their own consent.

7. Transfers of personal data

To provide the services you book, Nau Mai transfers your personal data to third parties in Mexico and abroad, in the countries included in your itinerary. In doing so, we communicate this Privacy Notice and the purposes to which you subjected the processing, and the recipients assume the same obligations as Nau Mai (article 35 of the Law). Under article 36 of the Law, the following transfers do not require your consent:

Please note that airlines and other suppliers may be required by the laws of destination or transit countries to provide passenger data to their immigration and security authorities. Nau Mai does not sell, rent or assign your personal data to third parties for their own marketing purposes. Should we intend in the future to make a transfer that does require your consent, we will ask for it beforehand.

Although the above transfers do not require consent, as a conservative measure we ask you in Annex A to indicate whether you accept or not the transfer of your sensitive data to insurers and travel suppliers.

8. Processors (Nau Mai's service providers)

Nau Mai relies on providers that process personal data on behalf of and under the instructions of Nau Mai (processors), such as email services, customer relationship management (CRM) systems, cloud storage, business messaging, website hosting, electronic invoicing (authorised certification providers) and accounting services [list main providers, optional]. Some of them may store information on servers located outside Mexico. These communications (remissions) do not require your consent or individual notice (article 53 of the Regulations of the Law); we seek to use cloud computing providers that comply with article 52 of the Regulations and require confidentiality and security measures from them.

9. ARCO rights: access, rectification, cancellation and objection

You, or your legal representative, have the right to access your personal data and know the conditions of its processing; to request its rectification when it is inaccurate, incomplete or out of date; to request its cancellation from our records; and to object to its processing on legitimate grounds or for specific purposes (articles 21 to 26 of the Law).

How to submit your request

• By email to travel@naumai.com [confirm], with the subject "ARCO rights request"; or
• In writing, delivered to our address: Av. Netzahualcóyotl 1597, Office 207, Col. [NEIGHBOURHOOD to be confirmed], Postal Code [Postal code to be confirmed], Zapopan, Jalisco, Mexico, during [HOURS]. We will give you an acknowledgement of receipt showing the date received.

Request requirements (article 28 of the Law)

1. Name of the data subject and address, email or other means of receiving notices.

2. Copy of the data subject's valid official ID (voter ID card or passport) and, where applicable, that of the representative, together with the document proving representation (public instrument or power of attorney signed before two witnesses). For minors, the document proving parental authority or guardianship.

3. A clear and precise description of the personal data in respect of which you wish to exercise any ARCO right (except for the right of access).

4. The right you wish to exercise or what you are requesting.

5. Any other element or document that helps locate your data (for example, booking number or travel dates). For rectification requests, state the changes to be made and attach supporting documentation.

Deadlines and response

• If the information is insufficient or incorrect, we may ask you, once only and within five business days of receipt, to provide the missing elements; you will have ten business days to respond (article 96 of the Regulations).
• We will inform you of our decision within a maximum of 20 business days from receipt of your request and, if it is upheld, we will implement it within 15 business days of the date of the response. These periods may be extended once for an equal period when circumstances justify it (article 31 of the Law).
• The response will be sent by the same means through which you submitted your request. Access will be provided by delivering plain copies or electronic documents, once your identity has been verified.
• Exercising ARCO rights is free of charge; only justified reproduction, copying or shipping costs may be charged (article 34 of the Law).
• Cancellation will give rise to a blocking period, after which the data will be deleted. Cancellation will not proceed when the data is necessary to perform a current contract or must be retained by law, among other cases in article 25 of the Law. Nor will objection proceed when processing is necessary to comply with a legal obligation.

If you disagree with the response or do not receive it in time, you may file a data protection request with the Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) within fifteen days of the date on which the response is communicated to you, or from the expiry of the response period (article 40 of the Law).

10. Revocation of consent

You may revoke the consent you have given us at any time, without retroactive effect (article 7 of the Law), through the same means and with the same requirements set out for ARCO rights, stating "Revocation of consent" in the subject and specifying the purposes or data for which you revoke your consent. We will handle your request within the periods set out in section 9. Please note that we may not always be able to handle your request immediately, as a legal obligation may require us to continue processing your data, and that revoking consent for primary purposes may mean we cannot continue providing the service purchased.

11. Options to limit the use or disclosure of your data

• Nau Mai exclusion list. You may request free registration on our exclusion list to stop receiving promotional communications by emailing travel@naumai.com [confirm] with the subject "Exclusion list". We will send you a registration certificate (article 110 of the Regulations).
• Unsubscribe. Each newsletter or promotional communication includes a link or instruction to stop receiving them.
• Public Registry to Avoid Advertising (REPEP) of the Federal Consumer Protection Agency (PROFECO), where you can register your phone number to avoid advertising calls.

12. Use of cookies and similar technologies

Our website naumai.com uses cookies, web beacons, pixels and similar technologies that allow us to automatically collect browsing data when you interact with the site. We inform you of this through a visible notice when you enter the site.

Some of these technologies may belong to third parties, such as [tools used, e.g. Google Analytics, Meta Pixel, website platform — confirm]. How to disable them: you can accept, reject or configure non-essential cookies from the site's cookie notice or panel [confirm the site has one], and delete or block them from your browser's privacy settings (Chrome, Safari, Firefox, Edge or other). Strictly necessary cookies cannot be disabled without affecting the site's operation. Third-party sites accessed through links (for example, social media or WhatsApp) are governed by their own privacy notices.

13. Security measures and retention

Nau Mai maintains administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorised use, access or processing (article 18 of the Law), and will inform you immediately of any security breach that significantly affects your property or moral rights (article 19 of the Law). We will keep your data for the duration of our relationship with you and, thereafter, for the periods required by tax, commercial and other applicable provisions, and for the limitation period of actions arising from the legal relationship; once those periods have elapsed, the data will be blocked and deleted. Sensitive data will be kept for the minimum period necessary: [PERIOD, e.g. up to 90 days after the trip ends or any insurance claim is closed].

14. Mobile application

If in the future Nau Mai makes a mobile application available to clients, before collecting data through it (for example, location, device identifiers or notifications) we will inform you by updating this Notice or through a specific notice, and will ask for your consent when necessary.

15. Changes to the Privacy Notice

This Notice may be modified or updated due to legal changes, changes in our services or in our privacy practices. Any change will be published at naumai.com/aviso-de-privacidad [URL to be confirmed], indicating the date of the last update; in addition, when the change is significant, we will notify you at the email address you provided. When the change involves a different data controller, new primary purposes or purposes requiring consent, the collection of new sensitive or financial data, or new transfers requiring consent, we will make a new privacy notice available to you and, where applicable, obtain your consent.

16. Competent authority

The authority responsible for overseeing compliance with the Law is the Secretariat of Anti-Corruption and Good Governance (articles 2, section XV, 38 and 39 of the Law), which took over the functions of the former National Institute for Transparency, Access to Information and Personal Data Protection (INAI). If you believe your right to personal data protection has been violated, you may turn to that Secretariat through the channels it provides.

Last updated: October 13, 2026 [confirm publication date]. Version 1.0. Always refer to the current version at naumai.com/aviso-de-privacidad [URL to be confirmed].

ANNEX A

Express consent for sensitive data, financial data, minors, transfers and secondary purposes

I declare that I have read and understand the Comprehensive Privacy Notice of Nau Mai Travel Experiences ([LEGAL NAME]), available at naumai.com/aviso-de-privacidad [URL to be confirmed], and state the following, marking the applicable option with an X:

Full name of data subject: ___________________________________________

Booking / file number: ____________________________________

Email: ____________________________________________________

1. Sensitive personal data (art. 8 of the Law)

☐ I DO consent ☐ I DO NOT consent to Nau Mai processing my sensitive data (health status, allergies, dietary requirements, mobility or special assistance needs and dietary preferences for religious reasons) to purchase travel insurance and request from suppliers the special arrangements needed for my trip.

2. Transfer of my sensitive data

☐ I DO accept ☐ I DO NOT accept that Nau Mai transfer my sensitive data, in Mexico and abroad, solely to the insurer and travel suppliers (airlines, hotels, operators and ground handlers) that must meet the specific need.

3. Financial and asset data

☐ I DO consent ☐ I DO NOT consent to the processing of my financial and asset data to process payments, refunds, statements and invoicing.

4. Secondary purposes (tick only if you DO NOT wish)

☐ I DO NOT wish to receive newsletters, promotions or advertising.

☐ I DO NOT wish to receive satisfaction surveys.

☐ I DO NOT wish to receive greetings on special dates.

☐ I DO NOT wish my data to be used for internal statistics and analyses.

5. Image and testimonials

☐ I DO authorise ☐ I DO NOT authorise Nau Mai to publish the photographs, videos and testimonials I share about my trip on its social media, website and promotional material.

6. Minors (complete only if minors are travelling)

As ☐ mother ☐ father ☐ guardian of: ______________________________________________

☐ I DO consent ☐ I DO NOT consent to the processing of the minor(s)' personal data, including sensitive data, for the primary purposes of the Privacy Notice and its transfer to the suppliers and insurers required for the trip.

☐ I DO authorise ☐ I DO NOT authorise the publication of the minor(s)' image on Nau Mai's social media, website and promotional material.

7. Adult companions

I declare that I have informed my companions of the Privacy Notice and have their authorisation to provide their data. I understand that, if sensitive data is collected from an adult companion, they must sign their own consent.

Place and date: _________________________________________________________

You may revoke this consent at any time by writing to travel@naumai.com [confirm], in accordance with section 10 of the Comprehensive Privacy Notice.