Legal
Privacy notice
This is a reference translation. The original in Spanish is the version that applies.
Version 2026-11b · Last updated: 7 November 2026.
This notice explains what personal data we collect, what we use it for, who we share it with and how you can exercise your rights. It is governed by Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette (DOF) on 20 March 2025 (“the Law”).
1. Who is responsible for your data
Pinacate Tours is the trade name used by two individuals. The party responsible for your data depends on what you book:
| Experience | Responsible party |
|---|---|
| Sonora Salvaje | Manlio Fabio Pacheco Ochoa (National Tourism Registry 3526030687d85) |
| Noche de Estrellas, Dunas con la Luna, day trips, private trips and hotel bookings | Brenda Zulema Morales Soto |
While you are enquiring and before you book, both process your data jointly. They share the address at Camino del Seri 96, Las Praderas, 83288, Hermosillo, Sonora, Mexico, the contact details and this notice.
For any privacy matter: contacto@pinacate.tours or WhatsApp +52 662 464 6648.
2. What data we collect
We only ask for the data we need to sell, organise and run your trip. We get it directly from you (forms, WhatsApp, Instagram, Facebook, email or phone) or automatically when you browse our sites.
| When | What data |
|---|---|
| When you message us | Name, WhatsApp number or Instagram/Facebook username, email and the content of the conversation |
| When you book | Full name, age, departure city, WhatsApp number and email of the person booking; full name and age of each companion; experience, date, number of people and any equipment you rent |
| When you pay | Amount, date, bank, tracking number, name of the payer and the source account shown on the receipt. If you pay by card or at OXXO, the payment is processed by Mercado Pago: we never receive or store your card number |
| If you request an invoice (CFDI) | RFC tax ID, name or company name, tax regime, postcode, CFDI use, email and, if you send it, your tax status certificate |
| To organise the trip | Attendance on departure day and, on Sonora Salvaje, each traveller’s sex to arrange shared rooms and whether anyone in the group needs a special diet |
| If you book a hotel through us | Name of each guest, dates of stay and room type |
| Surveys (optional) | Place of origin, age range, who you travel with, how you heard about us, reason and other trip details; your opinion after the experience |
| When you submit a form | Date and time, IP address, browser, and the text and version of the boxes you ticked, as proof of your consent |
| When browsing | Technical data (browser and device type, pages viewed, where you came from): with cookies, only as you choose in the cookie notice; until you choose, without cookies or identifiers (section 8) |
Sensitive data. If you travel on Sonora Salvaje, the booking form asks whether anyone in your group has a health condition we should know about. We record this information only with your express authorization, use it solely to look after you during the trip, share it only with the team that organizes and guides the departure, and delete it when the trip ends. The same applies if at any other time you choose to tell us about a health condition, allergy or physical limitation. We do not ask for ethnic origin, beliefs or any other sensitive data.
Minors. The name and age of travelling minors are given to us by their mother, father or guardian, or by the adult making the booking with their authorisation. We use them only for the booking, the applicable rate and trip safety.
3. What we use your data for
Necessary purposes to provide the service you book, which do not require your consent under article 9 of the Law:
- Answering your questions and giving quotes, by our team or our automated assistant (section 5).
- Registering your booking, holding your places and confirming it.
- Receiving and verifying your payments, sending receipts and reminding you of the balance.
- Issuing invoices and complying with tax and legal obligations.
- Organising and running the trip: transport, lodging, guides, equipment and meals.
- Sending you trip notices (for example, what to bring and departure time) and giving you access to your portal at mi.pinacate.tours.
- Handling emergencies during the trip.
- Handling cancellations, changes, refunds, complaints and enquiries.
- Protecting our sites against bots and fraud.
Additional purposes, which are not necessary for the service and which you may refuse without affecting your booking:
- Sending you promotions, presales and news of new departures by WhatsApp, email, Instagram or Facebook.
- Showing you ads on Instagram and Facebook about the departures you viewed, if you choose “Accept” in the cookie notice.
- Measuring how the site is used and where visitors come from: with cookies, if you choose “Accept” or “Measurement only” in the cookie notice; until you choose, in aggregate and without cookies (section 8).
- Asking your opinion in quality and market surveys, and compiling statistics.
- Using trip photos and videos in which you appear on our social media and materials (section 10).
4. How to refuse the additional purposes
At any time, before or after booking:
- When booking, leave the “I would like to receive promotions” box unticked. It is optional.
- Write to contacto@pinacate.tours or WhatsApp +52 662 464 6648 saying “I don’t want to receive promotions” or the purpose you want to limit.
- For measurement and ads, choose “Do not measure my visits” in the cookie notice. You can change your choice from “Cookie preferences” at the bottom of every page.
- Surveys are optional: simply don’t answer them.
5. Automated assistant on WhatsApp and Instagram
Many of our replies are written by an artificial intelligence assistant (PinaBot) that uses services from Anthropic and Google. The Pinacate Tours team supervises it. The assistant only informs, quotes and records payments. It does not make decisions that affect you without human involvement. If you would rather talk to someone on the team, ask in the same conversation.
6. Who we share your data with
We do not sell your data or share it with anyone so they can offer you their own products.
Providers that process data on our behalf (processors). They use it only to provide their service to us. Some store information on servers outside Mexico, mainly in the United States.
| Provider | Purpose |
|---|---|
| Cloudflare | Hosting of pinacate.tours, the booking form and the portal, booking database and bot verification (Turnstile) |
| Supabase | Departures and bookings database |
| Hostinger | Automation server and email |
| Email, booking spreadsheets, Google Analytics and the assistant’s Gemini model | |
| Meta (WhatsApp, Instagram, Facebook) | Conversations with you and, if you accept, ads (Meta Pixel) |
| Kommo | Message inbox and customer follow-up |
| Anthropic | The Claude model behind the assistant and PinaBot in the site search |
| Mercado Pago | Card, instalment and OXXO payments |
| Facturama | Electronic invoice stamping |
| Telegram | Internal team alerts about payments and bookings |
| GitHub | Private backup of our databases |
| Typeform | Booking forms we used until September 2026 |
| Guides and field staff | Running your departure (traveller list, check-in and contact on the day) |
Transfers to third parties. Under article 36 of the Law, we share data without requiring your consent only when it is necessary for the service you booked or required by law:
- With the hotel you book through us and with lodging, transport and service providers along the route, only what is essential for your stay and transfer (section IV).
- With medical, rescue or civil protection services in an emergency (section II).
- With the authorities of the El Pinacate and Gran Desierto de Altar Biosphere Reserve when they require it for access (sections I and VII).
- Between the two responsible parties in section 1, what is needed to serve you and run your trip, as they share staff and systems (section VII).
- With the Mexican Tax Administration Service (SAT) and other authorities when a law or order requires it (sections I and V).
7. How long we keep your data
- Bookings, payments and invoices: five years after the trip, the period required by Mexico’s Federal Tax Code for accounting records.
- Conversations and contacts who did not book: up to three years from the last message.
- Record of your consent: the same period as your booking.
- Health and special diet information you share with us: deleted when the trip ends.
- Cookies: each cookie’s period is shown in section 8.
When these periods end, the data is blocked and then deleted, as provided in article 24 of the Law.
8. Cookies and similar technologies
The first time you visit pinacate.tours, the booking form or mi.pinacate.tours, we show you a notice with three options:
- Accept: measurement with Google Analytics and Meta ads about the departures you viewed.
- Measurement only: Google Analytics without ads.
- Do not measure my visits: essential cookies only.
Until you choose, we only use essential cookies. Google Analytics counts the visit without cookies and without any identifier from your browser (Google consent mode): it receives the page, the time and general technical data, and Google estimates the figures in aggregate, not for advertising. Which ad, campaign or site you came from is kept only in that tab, in the browser’s session storage (not a cookie) and without ad identifiers; it is deleted when you close the tab and, if you book during that visit, it is stored with your booking. With “Do not measure my visits” none of this happens. You can change your choice from “Cookie preferences” at the bottom of every page, or delete cookies in your browser.
Our own measurement, without cookies. In addition, the site tells our own system (the Pinacate Tours Panel, hosted on Cloudflare) which pages you view, whether you spend more than a minute on an experience or reach its prices, and whether you tap WhatsApp, the booking form or the reviews, along with which ad, campaign or site you came from and general technical data (device type, browser and country). It uses no cookies, stores nothing in your browser and does not keep your IP address: to avoid counting you twice it uses a fingerprint of your connection and browser that changes every month and cannot identify you. It is used only for aggregate figures, is deleted after 400 days and is not shared with Google, Meta or other third parties. With “Do not measure my visits” it does not happen.
| Cookie | Set by | Purpose | Duration | When |
|---|---|---|---|---|
pt-cookies, pt-cookies-v |
Pinacate Tours | Remember your cookie choice | 6 months in the cookie; in browser storage until you change it or clear the site’s data | Always (essential) |
idioma |
Pinacate Tours | Remember the portal language | 1 year | Always (essential) |
rf_acceso, rf_listo, rf_pago |
Pinacate Tours | Protect your booking link and show its confirmation without leaving keys in the address bar | 10 minutes to 30 days | Always (essential) |
| Portal session | Pinacate Tours | Keep you signed in to mi.pinacate.tours | 30 days | Always (essential) |
| Turnstile | Cloudflare | Tell people from bots when a form is sent | Session | Always (essential) |
pt-origen |
Pinacate Tours | Know which ad, campaign or site you came from; stored with your booking | 90 days | Only with “Accept” or “Measurement only” |
_ga, _ga_* |
Google Analytics | Count visits and measure how the site is used | Up to 2 years | Only with “Accept” or “Measurement only” |
_fbp, _fbc |
Meta | Show you ads for the departures you viewed and measure their results | 90 days | Only with “Accept” |
The booking form also saves a draft of your answers in your browser so you don’t lose them if the page closes. It is deleted when the booking is registered or with “Start again”. If you arrive with a personal link (section 9), its code is kept only in that tab and is not used unless you choose “Accept” or “Measurement only”. Team devices carry a browser flag so their visits are not counted in measurement.
What you type in the site search is sent to Anthropic so PinaBot can answer you, without your name or other details about you, and we do not store it together with data that identifies you. If what you type looks like a phone number or an email address, it is not sent. Please do not type personal or booking details there.
9. Personal information links
When you ask us for information on WhatsApp or Instagram, we may send you a personal link to the page of the experience you are interested in. Only if you choose “Accept” or “Measurement only” in the cookie notice do we record which pages you view with that link, for how long and how far you read, linked to your enquiry, so we can follow up and answer your questions. If you make no choice or choose “Do not measure my visits”, we do not record it. This record is not shared with Google, Meta or other third parties.
10. Photos and videos during the trip
During the experiences we take photos and videos that we may publish on our social media, website and promotional materials, without payment to the people shown. If you don’t want to appear, tell your guide at the start of the trip or write to contacto@pinacate.tours, and we will not publish images in which you can be recognised. We do not publish images in which a child or adolescent can be recognised without the authorisation of their mother, father or guardian.
11. How we protect your data
We apply administrative, technical and physical measures to protect your data against damage, loss, alteration or unauthorised access. These include username, password and second-factor access for the team; role-based permissions; encrypted connections; and private backups. Only staff who need it for their work can see your data.
12. Your rights and how to exercise them
You have the right to access your data, rectify it if inaccurate, cancel it and object to its use (ARCO rights), and to revoke any consent you have given us.
Send your request to contacto@pinacate.tours with:
- Your name and an email or address for our reply.
- A copy of your official ID or, if acting for someone else, the document proving your authority.
- A clear description of the data concerned (not needed for access requests).
- The right you wish to exercise or what you are asking for.
- Any detail that helps us find your information, such as your booking code.
We will reply within 20 business days. If your request is granted, we will carry it out within the following 15 business days. The process is free; we may only charge the cost of copies or shipping.
Please note that if you revoke consent or object to a use that is necessary for the service, we may be unable to complete your booking. Revocation is not retroactive.
If you are not satisfied with our reply, you may start a rights-protection procedure before Mexico’s Secretaría Anticorrupción y Buen Gobierno, the competent authority.
13. If you live in the European Union
If you reside in the European Union or the European Economic Area, in addition to the above:
- Legal bases: we process your data to prepare and perform your trip contract; to comply with legal obligations; with your consent for measurement and advertising cookies and for promotions; and on the basis of legitimate interest to protect our sites against fraud.
- Additional rights: besides the rights above, you may request restriction of processing and portability of your data, and lodge a complaint with the data protection authority of your country.
- International transfers: your data is processed in Mexico and the United States. When you book with us, the transfer is necessary to perform the contract you request. For measurement and advertising it is based on your consent, and with our other providers on the safeguards they offer for these transfers, such as the European Commission’s standard contractual clauses. You can ask us about these safeguards at contacto@pinacate.tours.
14. Changes to this notice
We will publish any change at pinacate.tours/avisop with its date and version number. If a change affects the purposes or the third parties we share your data with, we will also notify you by email or WhatsApp if you have an active booking.
15. Applicable law and courts
This notice is governed by the Law and other applicable Mexican rules. For any dispute, the parties submit to the competent courts of Hermosillo, Sonora, without prejudice to your rights before the Secretaría Anticorrupción y Buen Gobierno or, if you live in the European Union, before the authority of your country.