PRIVACY POLICY OF L’ATELIER VIAJES
Last updated: August 2, 2025
Thank you for visiting this page. Your privacy is fundamental to us, and we want you to be fully informed about how L’Atelier Viajes collects, uses, shares, and protects your personal data, in compliance with applicable laws in Mexico, the European Union, and the United States of America.
This section is intended for our users in Mexico and lays the general foundation of our policy.
1. Identity and Address of the Data Controller (Individual)
L’ Atelier Viajes is a service provided by Beatriz Haubi (hereinafter, "the Data Controller" or "L’Atelier Viajes"), with the contact email address bea@atelierviajes.com.
The Data Controller is responsible for collecting and protecting your personal data in accordance with the Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.
2. Information We Collect and Sensitive Data
We collect the following personal information, including data considered sensitive according to the LFPDPPP:
Contact Information: Full name, email address, postal address (for documentation delivery or invoicing purposes, if applicable), and telephone number.
Travel Information: Destination, travel dates, type of accommodation, and transport preferences.
Documentos de viaje y datos sensibles: Passport information (number, issue date, expiration date, nationality), visa information, details of medical expense insurance, and travel insurance. Passport information, visas, and health insurance are considered sensitive information under the LFPDPPP and will be treated with special protection and express consent.
Payment Information: Credit or debit card details (collected and securely processed by third-party payment platforms, from which we only receive transaction confirmation, not your full card details).
Browse Information: IP addresses, browser type, operating system, cookies, and other tracking technologies (see section 7 for more details).
Sources of Data Collection: Your data is collected directly from you when you interact with our Site, complete forms, make reservations, or communicate with us.
3. Purposes of Processing Your Personal Data
Your personal data is processed for the following purposes:
a) Primary Purposes (necessary for the legal relationship):
To process and manage your travel service reservations (confirm your booking, send e-tickets, manage changes or cancellations).
To provide customer service (answer your questions, resolve issues, and offer support).
To carry out the necessary procedures for obtaining visas and insurance, should you request them through our services.
To comply with applicable legal and regulatory obligations.
b) Secondary Purposes (not necessary for the legal relationship):
To personalize your experience on the Site, recommending relevant destinations, offers, and services.
To communicate with you to send newsletters, promotions, and updates about our services.
To improve our Site and services by analyzing Site traffic, identifying trends, and optimizing user experience.
For secondary purposes, we require your express consent, which may be obtained through specific checkboxes on our forms or platforms. You have the right to object to the processing of your data for these purposes at any time.
4. Sharing Your Information and Data Transfer
Your personal data may be shared with third parties, both national and international, for the following purposes:
Travel Service Providers: Hotels, airlines, car rental companies, tour operators, and other service providers directly related to your travel reservation. These transfers are necessary to fulfill the primary purposes, and your consent is deemed granted upon contracting our services. Sensitive data (passport, visa, health insurance) will be transferred to these providers only when essential for the provision of the service you have expressly requested.
Government Authorities: When required by law or to protect the rights, property, or safety of our users or third parties (e.g., immigration, customs, national security).
Business Partners: With your express consent, we may share your information (excluding sensitive data, unless you specifically authorize it for a concrete purpose) with business partners to offer you relevant products and services.
All data transfers will be carried out under the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality, and accountability, always ensuring that data recipients commit to maintaining the confidentiality and security of the data.
5. Your ARCO Rights and Withdrawal of Consent
You have the right to:
Access: Know what personal data we hold about you, what we use it for, and the conditions of use we give it.
Rectification: Request the correction of your personal information if it is outdated, inaccurate, or incomplete.
Cancellation: Request the deletion of your information from our records or databases when you consider that it is not being used in accordance with the principles, duties, and obligations provided for in the LFPDPPP.
Opposition: Object to the use of your personal data for specific purposes.
Likewise, you have the right to withdraw your consent for the processing of your personal data at any time, provided it does not involve primary purposes that are indispensable for the legal relationship between us.
To exercise any of your ARCO rights or withdraw your consent, you can send a written request to the following email address: bea@atelierviajes.com.
Your request must contain, at least: a) Your full name and address or any other means to communicate the response; b) Documents proving your identity or, where applicable, legal representation; c) A clear and precise description of the personal data for which you seek to exercise any of the ARCO rights; d) Any other element or document that facilitates the location of the personal data.
L’Atelier Viajes will respond to your request within a maximum of 20 business days from the date the request was received. If the request is appropriate, it will be made effective within 15 business days following the date on which the response is communicated.
6. Information Security and Retention Periods
We have implemented and maintain administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, in compliance with the LFPDPPP. We are committed to maintaining the confidentiality of your personal data and to applying industry standards in information protection.
Your personal data will be retained only for the time necessary to fulfill the purposes for which it was collected, and to comply with applicable legal obligations. Subsequently, it will be blocked and deleted.
7. Cookies and Tracking Technologies
Our Site uses cookies and other tracking technologies to collect information about your online activity. These technologies allow us to:
Remember your preferences and configure the Site according to your needs.
Analyze Site traffic and user behavior to improve our services (e.g., which pages are most visited).
Currently, L’Atelier Viajes does not use third-party cookies for targeted advertising or affiliate marketing purposes. If we incorporate such technologies in the future, this Privacy Policy will be updated, and your specific consent will be requested for it.
You can configure your browser to notify you when you receive a cookie or to reject them, although this might affect the functionality of some parts of the Site.
8. Links to Other Websites
Our Site may contain links to other third-party websites. It is important for you to know that we are not responsible for the privacy practices of those other websites. We recommend that you read the privacy policies of each site you visit.
9. Changes to this Privacy Policy
L’Atelier Viajes reserves the right to make modifications or updates to this Privacy Policy at any time to address new legislation, internal policies, or new requirements for the provision or offering of our services. Any significant change will be notified through a prominent notice on our website or, if necessary, via email.
If you are a resident of the European Union, the following provisions also apply to the processing of your personal data.
1. Legal Bases for Processing Personal Data
In addition to the purposes mentioned in Section I, L’Atelier Viajes processes your personal data based on the following legal bases according to the GDPR:
Performance of a contract: The processing of your data is necessary for the performance of the travel services contract you enter into with us (e.g., processing reservations, managing payments).
Compliance with a legal obligation: The processing is necessary for compliance with a legal obligation to which we are subject (e.g., tax obligations, authority requirements).
Consent: For sending marketing communications, the use of non-essential cookies, or the processing of sensitive data when not strictly necessary for the performance of the service (e.g., very specific travel preferences that do not affect the main booking), your express consent will be the legal basis. You can withdraw this consent at any time.
Legitimate interests: The processing is necessary for the purposes of the legitimate interests pursued by L’Atelier Viajes or by a third party, provided that such interests are not overridden by your interests or fundamental rights and freedoms (e.g., improving our services, fraud prevention, network security).
2. Data Subject Rights under GDPR
In addition to the ARCO rights (Access, Rectification, Cancellation, Opposition) detailed in Section I, if you are an EU resident, you have the following additional rights:
Right to erasure ("right to be forgotten"): Request the deletion of your personal data without undue delay when, among other things, the data is no longer necessary for the purposes for which it was collected, or when you withdraw your consent and there is no other legal basis for the processing.
Right to restriction of processing: Request that the processing of your personal data be restricted in certain circumstances (e.g., if you contest the accuracy of the data).
Right to data portability: Receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit it to another data controller without hindrance from us.
Right to object to automated individual decision-making, including profiling: Object to the processing of your data being based solely on automated decisions, including profiling, which produce legal effects concerning you or similarly significantly affect you.
Right to lodge a complaint with a supervisory authority: If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
To exercise any of these rights, you can contact us at bea@atelierviajes.com.
3. International Data Transfers
If we transfer your personal data outside the European Economic Area (EEA), we will ensure that the transfer is carried out in accordance with the GDPR, using appropriate safeguards, such as the signing of Standard Contractual Clauses adopted by the European Commission, or relying on an adequacy decision by the European Commission regarding the recipient country.
4. DPO (Data Protection Officer):
Given the current size and nature of our operations, L'Atelier Viajes does not require the mandatory designation of a Data Protection Officer (DPO) according to Article 37 of the GDPR. Nevertheless, we are committed to protecting your data, and you can contact us for any privacy inquiries using the email address mentioned.
If you are a resident of California or other U.S. states with specific privacy laws (such as Virginia, Colorado, Utah, Connecticut), the following provisions may also apply to the processing of your personal data.
1. Categories of Personal Information Collected and Shared (California Consumer Privacy Act – CCPA/CPRA)
In the past 12 months, L’Atelier Viajes has collected the following categories of personal information and shared them with third parties for commercial purposes, as permitted by law:
Identifiers: Name, email address, postal address, telephone number, IP address, passport information, visa information.
Customer Records Information: Bank account numbers, credit/debit card numbers (processed by third parties).
Characteristics of Protected Classifications: Nationality (via passport, for travel purposes).
Commercial Information: Records of products or services purchased or considered.
Internet or Other Electronic Network Activity Information: Browse history, information regarding your interaction with our website.
Sensitive Information (CPRA): Passport information, visa, details of medical expense insurance, and travel insurance.
Sources of Personal Information: We collect personal information directly from you or from travel service providers (e.g., airlines, hotels) at the time of booking or inquiry.
Commercial Purposes for Collecting and Sharing Information: Personal information is collected and shared for the primary and secondary purposes described in Section I, which include: processing transactions, providing customer service, marketing, security, and service improvement.
2. U.S. Consumer Privacy Rights
In addition to the general rights mentioned in Section I, residents of California and other states with similar privacy laws may have the following rights:
Right to Know: The right to request that L’Atelier Viajes disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it is collected, the business or commercial purposes for collecting or sharing it, and the categories of third parties with whom we share it.
Right to Delete: The right to request the deletion of personal information that we have collected from you, subject to certain exceptions.
Right to Correct: The right to request the correction of inaccurate personal information.
Right to Opt-Out of Sale or Sharing of Personal Information: The right to opt-out of the sale or sharing of your personal information for targeted advertising or profiling for advertising purposes. L’Atelier Viajes currently DOES NOT SELL or SHARE your personal information within the meaning of the CCPA/CPRA definitions for cross-context behavioral advertising or profiling for advertising purposes. Should this practice change in the future, this policy would be updated, and a clear link would be provided to exercise this right.
Right to Limit the Use and Disclosure of Sensitive Personal Information: The right to limit the use and disclosure of your sensitive personal information to what is necessary to perform the requested services.
To exercise these rights, you can send a request to bea@atelierviajes.com. To verify your identity, we may ask you for additional information.
3. Non-Discrimination
We will not discriminate against you for exercising any of your privacy rights under U.S. laws. This means we will not deny you goods or services, charge you different prices or rates, provide a different level or quality of goods or services, or suggest that you will receive a different price or rate for exercising your rights.
4. Information Regarding Minor Users
L’Atelier Viajes does not knowingly collect or sell personal information from individuals under the age of 16 without the affirmative consent of the parent or guardian, in compliance with the CCPA/CPRA.
Beatriz Haubi
L' Atelier Viajes
Important Notes for L’Atelier Viajes:
Cookie Consent: Since the website currently does not use third-party cookies for marketing/affiliation, the section is clear on this. If this changes, it will be updated accordingly, to manage cookie consent (CMP) that allows for granular consent according to GDPR and CCPA/CPRA.
Sensitive Information: The mention of "passport information, visas, and health insurance" as sensitive data is critical. Consent must be explicit and, if possible, in writing or with a very clear checkbox that the user must actively tick.
Identity Verification: When a user from the EU or USA requests to exercise a right (especially deletion or access), you must be able to reasonably verify their identity before processing the request.
Legal Advice: While this document is quite comprehensive, privacy laws are constantly evolving, and will be updated accordingly.
