Privacy notice
Last updated: 30 September 2026
Matías Rivero García Rojas, operating under the trade name DIP Expeditions ("DIP", "we"), located at Mantarraya, La Playita, San José del Cabo, C-301, 23403, Baja California Sur, Mexico, is responsible for your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties and related regulations.
Privacy contact: contact@dipexpeditions.com
1. Data we collect
We collect it when you book, write to us (website, email or WhatsApp), sign the participation form or browse our website:
- Identity and contact: name, email, phone/WhatsApp, country of residence and nationality (to apply the resident or international rate), age or date of birth (to check minimum ages) and an emergency contact.
- Booking details: expedition, date, number of guests and preferences.
- Payment data: processed directly by our booking platform and its payment provider. DIP never receives or stores your full card details.
- Health data (sensitive data): medical conditions, pregnancy, allergies or physical limitations relevant to your safety in the water — only with your express consent, given when you sign the participation form.
- Image: photos and videos taken during the expeditions.
- Browsing data: cookies and technical data (see section 6).
2. How we use it
Necessary purposes (we can't provide the service without them):
- Managing your booking, payment, changes, cancellations and refunds.
- Your safety: checking the activity suits you, handling emergencies and contacting your emergency contact.
- Registering you in the passenger insurance for each expedition.
- Contacting you about your expedition (confirmation, times, sea conditions).
- Issuing tax receipts and meeting legal obligations.
Additional purposes (you can opt out without affecting your booking):
- Sending offers, news and the season calendar.
- Asking for a review after your trip.
- Using photos and videos in which you appear on our website, social media and promotional materials.
- Analysing website use to improve it.
To opt out of purposes 6–9, email contact@dipexpeditions.com at any time; for images, please tell us before your expedition.
3. Who we share it with
Only what is necessary, with:
- The insurer of the passenger insurance.
- Authorities, when the law requires it or in an emergency.
- Service providers processing data on our behalf: our booking platform (Bókun) and its payment provider, Cloudflare (bot protection when booking), WhatsApp, email, web hosting, Google (reviews, analytics and advertising) and Meta (advertising). Some are outside Mexico; we require them to protect your data.
We never sell your personal data.
4. Your rights and how to use them
You can access, correct and delete your data, object to its use, withdraw your consent and limit how we use it.
Email contact@dipexpeditions.com with your name, a copy of your ID (or your representative's), the right you want to exercise and the data concerned, and how you'd like our reply. We answer within 20 business days and, if applicable, act on it within the following 15 business days.
5. Retention
We keep your data while we have a relationship with you and for as long as tax and legal obligations require, then delete or anonymise it securely.
6. Cookies
Our website uses cookies to work and remember your language and, only if you accept, to measure visits (Google Analytics) and show relevant ads (Google Ads and Meta). You can accept, reject or change your choice in the cookie banner or your browser settings.
Bot protection: when you book and pay we use Cloudflare Turnstile, which automatically analyses technical signals from your browser (IP address, browser and connection type) to tell people from automated programs and prevent card fraud. These signals don't identify you. Cloudflare processes them on our behalf and, to improve its service, under its Turnstile Privacy Addendum.
7. Minors
We only collect minors' data through their parent or legal guardian, who provides and authorises it when booking.
8. Changes
If we change this notice, we'll publish the new version on this page with its update date.
9. Authority
If you believe your right to personal data protection has been violated, you may contact the competent data-protection authority in Mexico.