Comprehensive Privacy Notice
English courtesy translation of the Aviso de Privacidad Integral. Last updated: 29/09/2026.
Governing Version Notice
This English version is a courtesy translation provided for information purposes only. The Spanish-language Aviso de Privacidad Integral published by Aldea Tonantzin is the only legally binding version. In the event of any discrepancy, inconsistency or difference in interpretation between the Spanish and English versions, the Spanish text shall prevail for all purposes.
Aldea Tonantzin processes your personal data, including health data, solely to organize your safe participation in the temazcal ceremony, with your consent and in accordance with the law.
This Comprehensive Privacy Notice is issued pursuant to Articles 14, 15 and 16 of the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), published in the Official Gazette of the Federation on March 20, 2025 (the "Law"), and other applicable provisions. It applies to data we collect through our website and booking platform, by messaging, by phone, and in person at our premises.
1. Identity and Address of Data Controller
The data controller responsible for processing your personal data is María Jose Moto, operating under the trade name Aldea Tonantzin("Aldea Tonantzin", "we"), with its address for notices at:
Pursuant to Article 29 of the Law, we have designated María José Moto to handle any request relating to your personal data:
- Email: cochemoto@gmail.com
2. Personal Data We Collect
We collect only the data needed to book, assess your fitness to participate, and look after you safely.
| Category | Data | Sensitive? |
|---|---|---|
| Identification and contact | Full name, date of birth or age, phone number, email address, city and country of residence | No |
| Age or representation verification | Official ID, for in-person verification only; it is not copied or retained | No |
| Emergency contact | Name, relationship and phone number of the person you designate | No |
| Image and voice | Photographs or video, only if you expressly authorize it | No |
| Payment | Amount, date, reference and last four digits of the card, as reported to us by the payment processor | No |
| Financial data for refunds | Account holder name, bank and CLABE, only if you request a refund by bank transfer | No (Express consent required) |
| Browsing | IP address, browser and device type, pages visited and cookies | No |
We do not collect full card numbers; these are processed directly by our payment provider. Nor do we request or record data about your religious or spiritual beliefs, even though the ceremony is of that nature: what you share during the circle is not documented.
Tax data: Only if you request an invoice, we collect your RFC (tax ID), name or corporate name, tax regime, tax postal code and CFDI use.
Minors: If a person under 18 participates, we collect the above data about that person and, in addition, the identification and contact data of their mother, father or guardian, who grants consent on their behalf.
Third-party data: When you provide the data of an emergency contact or book for other people, you represent that you have informed them of this Notice and have their authorization to share their data.
3. Purposes of Processing
Your data are used for the following primary purposes, which are necessary for the relationship you establish with us when booking. Except for sensitive and financial data, which require your express consent, these purposes do not require consent under Article 9, section IV, of the Law.
Primary Purposes
- Managing your booking: confirmation, reminders, changes, cancellations and attendance list.
- Conducting the ceremony and taking individual precautions, such as seating you near the door or allowing additional breaks.
- Responding to an emergency: providing first aid, notifying your emergency contact and providing relevant information to medical or civil protection services.
- Processing payments, issuing tax receipts and, where applicable, processing refunds. (Bank details for refunds require express consent.)
- Documenting informed consent, assumption of risk and any incidents, to comply with legal obligations and, where applicable, defend rights before authorities.
- Handling complaints, clarifications and ARCO rights requests.
Secondary Purposes
With your authorization, we will also use your data to:
- Send you information about upcoming ceremonies, workshops and promotions of Aldea Tonantzin.
- Invite you to respond to satisfaction surveys.
- Publish photographs or video in which you appear on our website, social media or promotional materials.
The secondary purposes are not necessary for your participation. Declining them does not affect your booking or the service. You may indicate this when booking, on the in-person form, or at any time through the channels listed in section 1.
4. Consent and Its Revocation
Your health data are processed only with your express written consent, as required by Article 8 of the Law.
- Online: through a specific checkbox, not pre-ticked, linked to the confirmation we send to your email address. This checkbox is separate from acceptance of the Terms and Conditions.
- In person: through your handwritten signature on the consent form, when the booking or registration takes place at our premises.
- Bank details for refunds: through your express request in writing or by email, pursuant to Article 7 of the Law.
- Other data: tacit consent is deemed given if, once this Notice has been made available to you, you do not object.
Minors: Consent to process the data of a person under 18, including their health data and image, is given in writing by their mother, father or guardian, who signs the form in the presence of our staff.
Revocation: You may revoke your consent at any time, without retroactive effect, by sending an email to cochemotoa@gmail.com with your name, the date of your booking and the consent you are revoking. We will respond within a maximum of 20 business days. If you revoke consent to process your health data before the ceremony, we will be unable to assess your fitness and, for your safety, you will not be able to participate; in that case, the cancellation policy in the Terms and Conditions will apply.
5. Transfers and Processors
We do not sell, rent or assign your data. We disclose them to third parties only in the cases set out in Article 36 of the Law, which do not require your consent.
| Recipient | Purpose | Legal Basis |
|---|---|---|
| Medical services, hospitals and emergency services | Responding to a health emergency during or after the ceremony | Article 36, section II |
| Competent authorities | Complying with a duly grounded request or a legal obligation | Article 36, sections I and V |
Should we intend a different transfer in the future, we will ask for your consent before carrying it out. The receiving third party will assume the same obligations as we do, pursuant to Article 35 of the Law.
Processors: Certain providers process data on our behalf, under our instructions and subject to a contractual duty of confidentiality: the payments processors Stripe and Paypal, the booking and web hosting platform aldea.earth and Airbnb and the email service Gmail and our accounting firm. Some of these providers may store data on servers outside Mexico. These disclosures are not transfers and do not require your consent.
6. Options to Limit Use or Disclosure
You may limit the use of your data at any time, free of charge:
- Promotional communications: through the unsubscribe link included in every email, by replying "BAJA" to our messages, or by writing to cochemotoa@gmail.com. We will add you to our internal exclusion list.
- Photography and video: do not tick the authorization when booking or on the in-person form, or notify the facilitator before the ceremony. If material has already been published, you may request its removal by email; we will remove it from our channels within a maximum of 10 business days.
- Public Registry to Avoid Advertising (REPEP): you may also register with the registry administered by the Federal Consumer Protection Agency (PROFECO).
7. ARCO Rights
You or your legal representative may access, rectify or cancel your data, or object to its processing (ARCO rights), free of charge, by sending a request to cochemotoa@gmail.com or delivering it to our address.
Content of the Request (Article 28 of the Law):
- Your name and an address or email address to receive the response.
- A copy of your official ID or representative IDs and document evidencing representation.
- A clear description of the data and of the right you wish to exercise.
- For rectification, the requested correction and supporting documentation.
- Any other information that helps locate your data, such as the date of your ceremony.
Timeframes: We will notify you of our decision within a maximum of 20 business days of receiving the request. If granted, we will give effect to it within the following 15 business days (Article 31 of the Law).
Form of delivery: We will deliver your data as an electronic file by email, or as a plain copy at our address. We may only charge reproduction or shipping costs (Article 34 of the Law).
If you disagree with our response, you may file a request for protection of rights with the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) within 15 business days (Article 40 of the Law).
8. Retention and Security of Your Data
We retain your health data for the shortest possible time (Article 12 of the Law). When each period expires, data are blocked and then securely deleted.
| Data | Retention Period | Reason |
|---|---|---|
| Signed consent and assumption-of-risk form | 2 years from ceremony | Limitation period for civil liability actions for damages |
| Health incident record | 2 years from incident | Defense of rights and compliance with authority requests |
| Payment and invoicing data | 5 years | Tax obligations (Article 30 Federal Tax Code) |
| Contact details & preferences | Until consent revoked | Secondary purposes |
Security measures: We maintain administrative, technical and physical measures pursuant to Article 18 of the Law. Confidentiality undertakings survive the end of relationship (Article 20).