Privacy notice

Sal y Sol Sportfishing, operating out of Marina La Costa, Rangel y Navarro, La Paz, Baja California Sur, Mexico, is responsible for the personal data described in this notice.

For anything related to your data — including the requests described under «Your rights» below — contact us on WhatsApp at the number shown on this site, or by email at privacidad@salysolsportfishing.com. We aim to respond within 20 business days, as required under Mexican data protection law.

• When you book: your name, phone number and email, plus the date, time and number of guests for your trip.
• When you accept the liability waiver: your name, the date and time of acceptance, and your IP address, as proof of that agreement.
• When you pay: the amount, currency and a transaction reference (see «Payment data» below — we never see your card details).
• Automatically, through cookies: see «Cookies and browser storage» below.

We only collect what's needed to run your trip. We don't ask for sensitive personal data (health, religion, etc.), and if a medical condition ever comes up in a message to us, we only use it to keep you safe on the water — never for any other purpose.

• Confirming your booking, assigning a captain and boat, and reaching you before departure.
• Keeping the liability waiver on record in case it's ever needed.
• Processing payment and keeping the transaction record for accounting and tax purposes.
• Referral tracking, if you booked through someone else's link (see «Cookies» below).

All of the above are necessary to provide the service you're requesting — we don't ask for separate consent for them. We do not use your data for advertising, we don't build marketing profiles, and we won't flood your inbox. If that ever changes, we'll ask for your explicit, separate consent first.

Your card details never pass through our servers and we can't see them. Payments are processed by Stripe, which is PCI DSS compliant. We only store the amount, the currency and a transaction reference.

We only share what each trip requires:

• The assigned captain gets your name, phone and departure details.
• Stripe (based in the United States) processes payments.
• Email and WhatsApp/Meta services (based in the United States) are used to confirm and communicate with you.

These providers only receive what they need to do their job, and are bound by their own data protection obligations. Because some of them are based outside Mexico, this involves an international transfer of your data — solely for the purposes described in this notice. We don't sell your data or hand it over to third parties for any other purpose.

• Bookings and waiver records are kept as long as needed to resolve any dispute about the trip, and as required by applicable statutes of limitation.
• Payment/transaction records are kept for at least 5 years, as required by Mexican tax and accounting regulations.
• Unpaid checkouts are deleted automatically after 30 days.
• After these periods, your data is deleted or anonymized.

Under Mexican law, you can exercise your ARCO rights at any time:

• Access the personal data we hold about you.
• Rectify it if it's incomplete or incorrect.
• Cancel it (request deletion), subject to legal retention obligations described above.
• Oppose a specific use of your data.

You can also revoke any consent you've given us, at any time.

Message us on WhatsApp or email us from the address you booked with, and we'll sort it out — no special form needed. We'll confirm receipt of your request and respond within 20 business days.

We keep access to booking and waiver records limited to the people who need it to run your trip, and we rely on providers (Stripe, our hosting and email/WhatsApp providers) that maintain their own industry-standard security certifications.

Our trips and this site are intended for adults. If a minor participates, the liability waiver must be accepted by a parent or legal guardian, and we treat the minor's data with the same protections described in this notice.

We store in your browser only what the booking needs: your trip details while you fill them in, and the code of the person who referred you, if you arrived through their link. That can't be turned off without breaking the booking.

Everything else — measuring how the site is used so we can improve it — only happens if you accept it in the notice that appears at the bottom when you arrive. If you ignore it or reject it, nothing is activated. You can change your mind at any time by clearing this site's data from your browser.

If we make significant changes to how we handle your data, we'll post an updated notice here with a new «Last updated» date, and let you know via WhatsApp or email if the change affects data we already hold about you.