Privacy Policy

Who is responsible for your data

Controller, address and privacy contact: [TO BE CONFIRMED]. If different entities operate in Mexico and Spain, the controller for each processing activity will be expressly identified. These details must be completed before forms, bookings or communications are activated.

Data involved and current status

The visible forms are designed for name, email, country, enquiry reason and message; Collective registration is designed for email. They currently do not deliver or save these details to a SAOMA service. There is no connected booking or payment process on this website. Avoid entering medical information, identity documents, bank details or sensitive information in text fields.

Browsing involves requests to hosting, image and video distribution, and external font services. They may receive your IP address and technical request data. The language preference is stored locally in the browser. The provider inventory, technical logs and their retention periods must be confirmed before production launch.

Purposes and legal bases

When services are activated, responding to enquiries and preparing proposals will rely, in Spain, on pre-contractual steps you request or the appropriate basis for the enquiry; managing bookings on contract performance; and invoicing and legal duties on legal obligations. Technical security may rely on a properly assessed legitimate interest. A generic acceptance will not be used to justify every use.

In Mexico, the prior notice will distinguish purposes necessary for the requested relationship from secondary purposes, and obtain consent in the form required by law or apply the relevant legal exception. Collective notes will be optional: separate consent where required, an option to decline communications and easy unsubscribe without affecting your experience.

Health, consent and external signature

This website does not request or store health declarations or signatures. When an experience requires them, a secure external platform link will be supplied before attendance. The provider, controller, people with access, purpose, retention and any transfers must be identified in that process. External hosting does not remove SAOMA’s obligations when it acts as controller.

Health data require enhanced safeguards: in the EU an Article 6 GDPR basis and a valid Article 9 exception; in Mexico the legal requirements for sensitive data, including express written consent where applicable. They will not be reused for advertising. Final texts and the provider await validation.

Recipients and international transfers

Hosting, communication, booking, payment or documentation providers may be involved only when appointed and their role disclosed. Processors and independent controllers will be distinguished and appropriate safeguards put in place. Specific providers, countries and transfers: [TO BE CONFIRMED]. We do not claim data remain exclusively in Mexico or Spain.

Transfers outside the European Economic Area must use the mechanism required by GDPR, such as an adequacy decision or standard contractual clauses and necessary supplementary measures. In Mexico, transfers and applicable consent or exceptions will be disclosed under the law. Authorities may receive information where legally required.

Retention and security

Retention periods for enquiries, bookings, tax records, communications and external documents: [TO BE CONFIRMED by purpose and country]. Information will not be kept indefinitely by default. Periods will reflect necessity, legal duties and limitation periods; afterwards data will be deleted or restricted where the law requires. Proportionate access controls and technical and organisational measures will be established, without promising absolute security.

Your rights in Spain and Mexico

In Spain you may request access, rectification, erasure, objection, restriction and portability where applicable, and withdraw consent without affecting the lawfulness of earlier processing. Requests will generally be answered within one month, with the statutory extension of up to two additional months in justified cases. You may complain to the AEPD or another competent supervisory authority.

In Mexico you may exercise access, rectification, cancellation and objection (ARCO), revoke consent and limit use or disclosure under the law. In general, the decision will be communicated within 20 days and, if granted, implemented within the following 15 days, subject to permitted extensions. You may contact the Secretaría Anticorrupción y Buen Gobierno, the competent authority in this area.

Operational rights request channel and proportionate identity verification procedure: [TO BE CONFIRMED]. Requests should identify the right and affected data without requiring excessive information. The current form is not a rights request channel.

Images, minors and changes

Booking does not by itself authorise promotional use of your image. Any identifiable use requires the appropriate authorisation or legal basis, independently of participation. Before admitting minors, suitable age, representation and protection conditions will be defined. Solely automated decisions with legal or similar effects are not envisaged; prior information will be provided if introduced.

Material changes will be dated and communicated where appropriate. Incompatible new uses or uses requiring consent will not be activated merely by changing this page.