PRIVACY NOTICE
BAAXAL SMC, S.A. DE C.V., (hereinafter "Drim") with address at Petén 28, Narvarte Oriente, CP. 03023 will be responsible for the processing of your personal data.
If you have any questions regarding the protection of your personal data, you can contact our Data Privacy Office at the following e-mail address contacto@drimmexico.com.
Categories of personal data subject to processing. In order to comply with the purposes of the processing indicated in this privacy notice, it is necessary to collect and process the following personal data: (i) Identification data; (ii) Contact data; (iii) Location data; (iv) Patrimonial and/or financial data; (v) Fiscal data; (vi) Demographic data, including data related to the geographic location of the device you use to use our services, information about your preferences and interests related to the goods, products and services we offer you; (vii) Information related to your consumption preferences of our products and services; (viii) Information that you voluntarily provide to us for the provision of Drim services and the attention of complaints, claims or inquiries.
Third party data. In the event that you provide us with information from third parties, by providing such information, you represent that you have previously obtained the consent of such third parties so that Drim may process the data for the purposes set forth in this Privacy Notice.
Data of children and adolescents. Drim does not collect personal data of children, adolescents and persons in a state of legal interdiction without the prior consent of their parents or legal guardians in accordance with the applicable regulations, so that, prior to providing personal data of these holders you declare that you have read this privacy notice and that you have the legal capacity to grant the consent required in terms of the applicable regulations so that Drim can treat the personal data of children, adolescents and persons in a state of legal interdiction to comply with the purposes reported in this privacy notice.
Processing of sensitive personal data. We inform you that for the purposes of this Privacy Notice we may treat sensitive personal data about your current or future health status for the management of assistance services, insurance coverage or any other service that requires it.
Primary purposes. Drim will process your personal data to perform the following primary purposes: (i) To identify you and register you as a customer; (ii) To create a file about you; (iii) To validate and verify the information provided by you; (iv) To provide you with personal attention through different electronic means of communication such as email, telephone, chat, WhatsApp, among others; (v) To provide you with information and advice on travel services and/or for the processing of your visa, if applicable; (vi) To send you quotes on the travel services requested; (vii) To keep your data to make a historical record of your activities; (viii) Provide you with the travel services and events we market; (ix) Make reservations for travel, airline tickets, means of transportation, hotels and lodging in general, on your behalf and that of third parties you indicate; (x) Carry out visa procedures, permits and authorizations on your behalf, as required; (xi) Manage and follow up on your quotations, reservations and/or purchase of travel and events; (xii) Inform you about changes in our services; (xiii) Contact you in case of Categories of personal data subject to processing. In order to comply with the purposes of the processing indicated in this privacy notice, it is necessary to collect and process the following personal data: (i) identification data; (ii) contact data; (iii) location data; (iv) patrimonial and/or financial data; (v) fiscal data; (vi) demographic data, including data related to the geographic location of the device you use to use our services, information about your preferences and interests related to the goods, products and services we offer you; (vii) information related to your consumption preferences of our products and services; (viii) information that you voluntarily provide to us for the provision of Drim services and the attention of complaints, claims or inquiries. (xiv) Keeping our records up to date; (xv) Issuing travel documents; (xvi) Processing payments and, if applicable, clarifications about them; (xvii) Carrying out billing procedures in terms of the applicable regulations; (xviii) Granting you benefits and discounts; (xix) Identifying vulnerable activities and complying with the obligations set forth in the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin and other applicable regulations, conducting internal investigations and complying with internal policies and processes; (xx) Identifying and preventing possible illicit conducts that could mean a violation of the legal provisions in force; (xxi) Give attention to your requests for information, complaints or claims; (xxii) Attend to complaints, claims and/or requests for information; (xxiii) Comply with the obligations derived from the legal relationship with you; (xxiv) Comply with the requirements of competent authorities in the cases legally foreseen.
Secondary purposes. In addition, if you do not object, Drim may process your personal information for the following purposes that are not necessary for the service you request from us, but that allow and facilitate us to provide you with better service: (i) For possible subsequent contacts about the services we offer; (ii) To conduct satisfaction and service quality surveys; (iii) To carry out mass data analysis techniques treatments to perform profiling activities and better customer knowledge; (iv) To inform you of the launch or changes of new products, goods, services, promotions and/or offers according to your interests, including sending communications through emails, phone calls, short messages and other physical and/or electronic means of communication;
In case you do not want your personal data to be processed for any or all of the additional purposes, you can communicate this to us at the following e-mail address contacto@drimmexico.com.
Basis of legitimacy. Drim processes your personal data in order to comply with the obligations arising from the legal relationship with you in order to provide you with the services you request from us.
Transfers. Drim may transfer your personal data to the following domestic and foreign entities, without requiring your consent: (i) Third party service providers and business partners with whom we have entered into commercial agreements in order for them to provide you with certain services, as well as to comply with the obligations arising from the legal relationship with you; (ii) To insurers or companies with whom we have entered into agreements in order for them to provide you with health care services, support or assistance in case you so require; (iii) Affiliated companies, subsidiaries and/or controlling entities, national or foreign, that operate under the same internal policies regarding personal data protection in order to comply with the purposes informed in this privacy notice; (iv) Competent authorities in the cases provided by the applicable regulations.
Means to exercise ARCO Rights. You or your legal representative may exercise any of the rights of access, rectification, cancellation or opposition (hereinafter "ARCO Rights"), as well as revoke your consent for the processing of your personal data by sending an email to our Data Privacy Office at the address contacto@drimmexico.com, going directly to the Customer Service area in any of our branches; or requesting it in writing, to the address located at Peten 28, Narvarte Oriente CP. 03023 where you will be attended in a timely manner. You will be provided with a Request for Exercise of ARCO Rights ("Request") so that you may exercise your right.
In order for our Data Privacy Office to be able to follow up on your request, you or your legal representative must correctly prove your identity, for which it is necessary that you complete all the fields indicated in the Form and accompany it with a copy of one of the valid official identifications indicated therein.
In the event that the information provided is erroneous or insufficient, or if the corresponding supporting documents are not provided, our Data Privacy Office, within five (5) business days following receipt of the request, may require you to provide the elements or documents necessary to process the request. You will have ten (10) business days to respond to the request, counted from the day after you have received it. If you do not respond within this period, the corresponding request will be deemed not to have been filed.
Our Data Privacy Office will inform you of the decision taken, within a maximum period of twenty (20) business days from the date on which the request was received, so that, if it is appropriate, you can make the same effective within fifteen (15) business days after the response is communicated.
Options and means to limit the use or disclosure of your personal data. You may limit the use or disclosure of your personal data by sending your request to our Data Privacy Office at Peten 28, Narvarte Oriente CP. 03023. The requirements to prove your identity, as well as the procedure to attend your request will be governed by the same criteria indicated in the previous section. In case your request is successful, our Data Privacy Office will register you in Drim's own exclusion list.
Use of cookies, web beacons and similar technologies. Drim uses various technologies to improve the efficiency of our websites and technology tools, including your experience when you browse those sites or use our network. These technologies include the use of cookies, which are small amounts of information that are stored in the browser used by each user so that the server remembers certain information that it can later use. This information allows us to identify you and save your personal preferences to provide you with a better browsing experience.
On our websites and applications we may use cookies, web beacons and other tracking technologies, both proprietary and third party, to enable us to fulfill the purposes stated in this Privacy Notice.
The different types of cookies we use to obtain identifying data and data related to your purchasing behavior and use of internet services are:
- Essential Cookies: We use these technologies to allow you to make proper use of our websites, so they cannot be disabled as they are necessary to allow you to use the functionalities of our websites and technological tools.
- Cookies to remember your preferences and experience: through these technologies we obtain browsing hours, browsing time on our website, sections consulted, and Internet pages accessed prior to ours, these cookies allow us to remember your preferences, browsing options and personalized functions.
- Cookies for performance and analysis purposes: We may use our own and third-party cookies to obtain technical and statistical data that allow us to identify how you use our services in order to improve their performance and future developments.
- First-party and third-party advertising cookies: We may place first-party and third-party advertising cookies (such as business partners and Group Companies) to obtain information regarding your shopping, consumption and website viewing preferences in order to show you advertising that we deem relevant to you.
- Other information: Similarly, as part of our processes to improve our products and services, in certain cases we may collect anonymous responses to surveys and requests related to the use of our products and services. In certain cases and when necessary, we may apply data anonymization techniques in order to perform certain predictive and statistical studies based on the information generated from the use of our Services.
We remind you that you can disable or adjust the use of cookies by following the procedures of the Internet browser you use to access our websites.
Protection of your financial information. For payment processing we use the Stripe, Inc. platform, which meets the highest security standards in the industry. Stripe is certified as a PCI DSS Level 1 Service Provider, uses TLS and AES-256 encryption for data transmission and backup, and maintains international security certifications such as ISO/IEC 27001, as well as SOC 1 and SOC 2 audits. These protocols and measures guarantee the protection of our users' financial and personal information. For more information about Stripe's security, please visit the following official link: https://stripe.com/docs/security.
Authority for the protection of personal data. In case you consider it necessary, we inform you that you have the right to go to the Data Protection Unit of the Anticorruption and Good Governance Secretariat to assert any disagreement related to your right to the protection of personal data. Changes to the Privacy Notice. Drim reserves the right, at its sole discretion, to change, modify, add or remove portions of this Privacy Notice at any time. In such event, Drim will inform you of the changes by the same means that it has made this Privacy Notice available to you.