Privacy Policy

Applicable to xploragt.com, bookings, communications, and tourism services

Effective date	July 27, 2026
Last updated	October 7, 2026
Privacy contact	info@xploragt.com · +502 3067-6503

1. Data Controller

The controller of personal data is Keneth Donovan Batres Méndez, operating under the trade name Xplora, Tax ID (NIT) 8259028-1, commercial registration number 415689, with business address at 2da calle 4-42, zona 3, La Esperanza, Quetzaltenango, Guatemala.

For the purposes of this Policy, the controller will be referred to as “Xplora.”

• Website: xploragt.com
• Privacy email: info@xploragt.com
• Phone and WhatsApp: +502 3067-6503
• Location: Quetzaltenango, Guatemala

Xplora determines the purposes and essential means by which personal data is processed within its operations. Certain providers may act as data processors or as independent controllers, depending on the nature of the service they provide.

2. Purpose and Scope

This Policy explains what personal data Xplora collects, where it obtains it, how it uses it, with whom it may share it, how long it keeps it, and how requests related to that data can be made.

This Policy applies to data processed through:

• xploragt.com and its forms;
• bookings made through the website, email, phone, WhatsApp, social media, payment links, or authorized agents;
• national and international tours, expeditions, adventure activities, and related services;
• messaging groups, shared albums, medical forms, consent forms, surveys, and service communications;
• in-person interactions with Xplora staff, guides, and providers.

This Policy does not replace any specific consent that may be required for processing medical information, image authorization, participation of minors, high-risk activities, or other special processing.

3. Definitions

Data Subject: the individual to whom the personal data belongs. This may be the Traveler, the payer, a companion, an emergency contact, a website visitor, or any other person whose data is processed by Xplora.

Traveler: the person who books, pays for, uses, or participates in a service marketed, coordinated, or organized by Xplora.

Personal data: any information that directly or indirectly identifies, or allows the identification of, an individual.

Specially protected data: information that, by its nature, may create greater risks for the person, such as medical data, allergies, medications, functional limitations, identity documents, passport, visa, information about minors, or emergency contacts.

Processing: any operation performed on personal data, including its collection, recording, consultation, organization, disclosure, storage, updating, blocking, or deletion.

Provider: any person or entity that provides technology, financial, tourism, transportation, accommodation, assistance, insurance, communications, or other services related to Xplora’s operations.

Cookies: files or similar technologies stored on or accessed from the visitor’s device to enable site functions, remember preferences, measure usage, or deliver advertising, as applicable.

4. Processing Principles

Xplora adopts the following principles as internal privacy commitments:

• Purpose limitation: using data for specified, explicit, and legitimate purposes.
• Proportionality and minimization: requesting only the information reasonably necessary for each service.
• Transparency: clearly communicating the relevant uses of data.
• Accuracy: keeping information correct and up to date.
• Security and confidentiality: applying reasonable controls according to sensitivity and risk.
• Storage limitation: deleting, anonymizing, or restricting data once it is no longer needed, unless there is a legal obligation or a need for legal defense.
• Accountability: documenting relevant decisions and periodically reviewing processing practices.

5. Sources of Data

Xplora may obtain personal data:

• directly from the Data Subject, when completing forms, making a booking, making a payment, contacting Xplora, or participating in a tour;
• from the person who makes a booking on behalf of a group, family member, or companion;
• from authorized agencies, companies, group organizers, or business partners;
• from providers involved in delivering the service, when necessary to correct, complete, or confirm a booking;
• automatically, through technical logs, cookies, pixels, tags, and website security or analytics tools;
• from social media or messaging platforms, depending on how the Data Subject chooses to interact on those platforms.

Anyone who provides another person’s data must have sufficient authorization to do so, share this Policy with them, and avoid providing unnecessary or false information.

6. Categories of Data Xplora May Collect

6.1 Identification and contact data

• full name;
• email address;
• phone number;
• nationality;
• date of birth or age, when needed to verify participation requirements;
• billing, shipping, or home address, only when necessary.

6.2 Tax and billing data

• Tax ID (NIT), name or company name, and tax address;
• data needed to issue invoices, credit notes, and receipts;
• payment, refund, and balance history.

6.3 Identity and travel documents

• national ID number (CUI/DPI), when strictly necessary;
• number, photo, or copy of national ID, passport, visa, immigration permit, or travel document;
• issue and expiration dates, issuing country, and other data required for the booking, entry, transportation, or immigration requirements.

6.4 Booking and travel data

• selected tour, dates, departure points, companions, and preferences;
• accommodation, transportation, meals, equipment size, and operational requirements;
• history of purchases, changes, cancellations, refunds, and communications.

6.5 Medical, safety, and emergency data

• allergies, relevant medical conditions, medications, dietary restrictions, and functional limitations;
• medical clearances and details of the treating professional, when required;
• name, relationship, and phone number of the emergency contact;
• reports of incidents, first aid, evacuation, and care received.

6.6 Payment data

• transaction reference, amount, currency, date, status, and payment method;
• proof of bank transfer or limited information provided by the payment gateway;
• data needed to prevent fraud, process chargebacks, or issue refunds.

6.7 Communications and customer service

• content, date, time, and channel of emails, calls, chats, messages, and complaints;
• contact preferences and authorizations;
• surveys, reviews, and feedback.

6.8 Image, voice, and audiovisual content

• photos, videos, audio recordings, and material generated during tours;
• content voluntarily sent to Xplora;
• audiovisual records of incidents or safety situations, when necessary and proportionate.

6.9 Technical and browsing data

• IP address, device identifiers, browser type, operating system, and time zone;
• pages visited, date, time, duration, source of the visit, and actions taken;
• security logs, errors, cookies, and consent preferences.

6.10 Marketing and commercial profile data

• stated interests, destinations viewed, source campaigns, and responses to communications;
• general segments used to send relevant information, without making decisions with legal or similarly significant effects based solely on automated processing.

Xplora will not request full copies of identity documents for standard domestic tours unless there is a duly justified legal, safety, contractual, or provider requirement.

7. Purposes and Legal Grounds for Processing

7.1 Service delivery and booking performance

• quoting, registering, confirming, and managing bookings;
• verifying payments and issuing invoices;
• coordinating transportation, accommodation, guides, permits, entrance fees, insurance, and other components;
• communicating schedules, meeting points, changes, alerts, and requirements;
• managing cancellations, booking transfers, refunds, complaints, and chargebacks.

Legal ground: necessity to handle the Data Subject’s request and to enter into and perform the contract.

7.2 Safety, fitness, and emergency response

• assessing reasonable participation requirements;
• planning safety measures and operational adjustments;
• informing guides only of relevant risks;
• coordinating first aid, evacuation, medical care, insurance, and emergency contacts;
• investigating and documenting incidents.

Legal ground: explicit consent where applicable, protection of life and physical integrity, and necessity to deliver the activity safely.

7.3 Legal compliance and defense

• complying with tax, commercial, immigration, tourism, and consumer protection obligations and requests from authorities;
• preventing fraud, crime, misuse of services, and security risks;
• keeping contractual evidence and exercising or defending legal claims.

Legal ground: compliance with legal obligations and protection of the rights and legitimate interests of Xplora, the Data Subject, and third parties.

7.4 Customer care, quality, and improvement

• responding to inquiries, complaints, and requests;
• measuring satisfaction and service quality;
• analyzing trends in aggregated or anonymized form;
• training staff using anonymized or limited information.

Legal ground: service delivery and a reasonable interest in improving operations, with proportionate safeguards.

7.5 Marketing and commercial communications

• sending information about new tours, promotions, and destinations;
• personalizing communications based on stated interests or general interactions;
• measuring campaign performance.

Legal ground: the Data Subject’s optional consent. Refusing or withdrawing consent will not affect any booking or participation.

7.6 Image and promotion

• publishing photos or videos on social media, the website, ads, or promotional material;
• creating advertising pieces or testimonials.

Legal ground: separate, specific, and optional image authorization. Booking a service will never depend on granting it.

When certain data is essential to book or deliver a service, Xplora will say so. If the Data Subject chooses not to provide it, Xplora may be unable to confirm or deliver the affected component.

8. Payments and Financial Data

Card payments are processed by Recurrente or another payment gateway disclosed at the time of the transaction. Xplora does not store full card numbers, security codes, or banking credentials, unless an authorized platform provides them in a protected manner and there is a legitimate need.

Xplora may receive and keep limited transaction information, such as the payer’s name, amount, currency, reference, masked last digits, payment status, and data necessary for invoicing, fraud prevention, chargebacks, or refunds.

The payment provider may process data as an independent controller or as a processor and will apply its own terms and privacy notices.

9. Medical and Emergency Data

Xplora will request only medical information that is reasonably relevant to the Traveler’s safety, activity planning, or emergency response.

Access will be limited to staff who need to know it. Xplora may share strictly necessary information with guides, medical personnel, rescue services, insurers, transport providers, or other providers involved in providing care.

Medical information will not be used for marketing and will not be posted in groups, on social media, or in open channels.

Whenever possible, consent to process this information will be collected through a separate form. In an emergency, Xplora may process and share information necessary to protect the Traveler’s life or physical integrity, even when immediate authorization cannot be obtained.

10. Bookings Made on Behalf of Others

Anyone booking for a group or for third parties must provide accurate information, be authorized to share it, and give each participant the applicable contractual and privacy documents.

Each Traveler must personally accept the medical, risk, and image consents that apply to them. The person paying may not grant image, health, or marketing authorization on behalf of another adult, unless they hold proven legal representation.

11. Data of Minors

Xplora will not request personal data directly from minors to contract services. When a minor is admitted to an activity, the information must be provided and authorized by their parent, guardian, or legal representative.

Only the data necessary to verify age, representation, authorizations, safety, travel, and emergency care will be collected.

Image authorization for a minor must be recorded in a separate document signed by their legal representative. Xplora may decline to publish images when it considers that their distribution could affect the minor’s dignity, privacy, or safety.

12. Photos, Videos, and Image Authorization

Authorization to use the Traveler’s image or voice for advertising purposes is optional, specific, and separate from acceptance of the Terms and Conditions.

Declining this authorization will not prevent anyone from booking or participating in a tour.

The Traveler may withdraw the authorization for future uses. Xplora will make reasonable efforts to remove the content from channels it directly controls, but cannot guarantee the removal of copies previously made, downloaded, or republished by third parties.

Photos or videos used to document incidents, damage, conduct, safety, or contractual compliance will be processed only for those purposes and for as long as reasonably necessary.

13. WhatsApp, Groups, and Shared Albums

Xplora may use WhatsApp or other platforms for operational communications. These platforms are managed by third parties and apply their own privacy notices.

Before adding someone to a group, Xplora will inform them that other participants may see their phone number, name, profile photo, and messages sent to the group.

Travelers should not post medical information, identity documents, financial data, or other people’s private information in groups. Xplora may delete content or remove users who compromise the group’s privacy or safety.

If a Data Subject does not wish to join a group, Xplora will try to offer a reasonable individual channel for essential communications, whenever operationally possible.

Albums shared via link may be accessible to anyone who has the link. Xplora will limit their duration, permissions, and reach when the platform allows it.

14. Marketing and Preferences

Xplora will send promotional communications only when there is authorization or a prior relationship that allows reasonable contact under applicable law.

Every communication will include a simple way to stop receiving advertising. Data Subjects may also opt out by writing to info@xploragt.com.

Opting out of marketing will not prevent Xplora from sending necessary messages about a booking, safety, changes, payments, complaints, or legal compliance.

Xplora does not sell personal databases, nor does it allow third parties to use the Data Subject’s data for their own advertising purposes without an adequate legal basis and notice.

15. Cookies, Analytics, and Similar Technologies

The website may use the following categories of technologies:

Category	Purpose	Nature	Examples
Essential	Security, session, forms, cart, booking, and privacy preferences.	Required for the site to function.	Session, fraud prevention, consent.
Preferences	Remembering language, region, or selected options.	Optional when not essential.	Language, interface.
Analytics	Measuring visits, performance, and aggregated usage.	Optional.	Meta tools and other analytics tools in use.
Advertising	Measuring campaigns, building audiences, or showing ads.	Optional and subject to consent.	Meta Pixel, TikTok Pixel, Google tags.

Non-essential cookies should remain disabled until the visitor gives consent, where the technical setup allows it. Visitors may change their preferences through the cookie preferences panel or link, or through their browser settings.

Disabling certain technologies may affect site functions. Xplora maintains an up-to-date inventory of cookies, providers, purposes, and retention periods.

16. Recipients and Providers

Xplora may share limited data with:

• authorized staff, guides, and collaborators;
• transport companies, hotels, hostels, communities, operators, local guides, airlines, assistance companies, insurers, and other providers included in the trip;
• payment gateways, banks, and invoicing providers;
• web hosting, email, storage, messaging, CRM, automation, analytics, and security services;
• immigration, tax, tourism, police, judicial, health, or rescue authorities, when there is a legal obligation, a valid request, or an emergency;
• legal, accounting, audit, and insurance advisors, when necessary for compliance or defense;
• buyers, investors, or successors in a business reorganization, subject to confidentiality and prior assessment.

Xplora will share only the information needed for each purpose. It will not hand over full copies of identity documents to a provider that only needs the Traveler’s name.

17. Technology Providers

These providers may act under their own policies and terms:

Service	Provider	Main data	Purpose
Payment gateway	Recurrente	Payment and transaction data	Processing payments, fraud prevention, chargebacks, and refunds.
Web hosting	Hosting.com	Site data, forms, and technical logs	Hosting and protecting xploragt.com.
Domain	GoDaddy	Domain management data	Domain registration and management.
Email and storage	Google / Gmail	Bookings, communications, and documents	Communication and document management.
Messaging	WhatsApp / Meta	Phone number, profile, messages, and metadata	Customer care and tour coordination.
Automation / CRM	ManyChat / n8n	Contact details, tags, conversations, and preferences	Customer care, follow-up, and authorized marketing.
Email marketing	Mailchimp	Email address and preferences	Sending authorized communications.
Analytics	Meta	IP address, device, browsing, and events	Measuring site usage.
Digital advertising	Meta (Facebook, Instagram), TikTok, Google	Identifiers, events, and audiences	Measuring and optimizing authorized campaigns.

18. International Transfers and Services

International trips may require Xplora to share data with airlines, hotels, insurers, authorities, operators, and providers located outside Guatemala.

In addition, some technology providers may store or process information in other countries.

Xplora will disclose relevant processing, limit data to what is necessary, and seek to use providers with reasonable security and confidentiality commitments. The receiving country may apply privacy rules different from those of Guatemala.

When foreign legislation applies to the processing, Xplora will honor the additional rights and obligations that correspond within its scope.

19. Retention and Deletion

Xplora will keep data only for as long as necessary for the purposes described, legal obligations, and the defense of claims.

Category	Retention criteria
Bookings, invoicing, payments, and accounting	For the applicable tax, commercial, contractual, and limitation periods, and while any claim is pending.
Inquiries without a booking	Up to 12 months after the last interaction, unless there is marketing consent or a need for legal defense.
Copies of ID, passport, and visa	Until the trip or procedure is completed and, as an internal rule, up to 90 days afterward; longer only if there is a legal obligation, incident, refund, or claim.
Medical data and emergency contacts	Up to 90 days after the tour if there was no incident. If there was an incident, for as long as necessary for assistance, investigation, insurance, or defense.
Service communications and complaints	Up to 24 months after closure, or for as long as necessary to defend rights.
Marketing	Until consent is withdrawn or after 24 months of inactivity, whichever comes first, unless the authorization is renewed.
Technical and security logs	Normally up to 12 months; longer if there is a documented incident or risk.
Promotional photos and videos	While the authorization remains in effect and the purpose continues. After withdrawal, future uses will stop and reasonable removal from controlled channels will be managed.

Deletion may involve erasure, anonymization, or blocking with restricted access. Backup copies will be purged according to reasonable technical cycles, unless they must be preserved for security, investigation, or compliance.

20. Data Subject Requests

In accordance with applicable law and its privacy commitments, Xplora recognizes and will handle reasonable requests to:

• confirm whether it processes the Data Subject’s personal data;
• access a copy of the available information;
• correct or update inaccurate data;
• withdraw consent for marketing, image, or other optional processing;
• request deletion when the data is no longer needed and there is no obligation to keep it;
• object to certain uses or request that they be restricted;
• receive certain data provided by the Data Subject in a structured format, when technically feasible.

These requests may be limited when information must be kept to comply with a legal obligation, protect safety, respond to an emergency, complete a transaction, exercise rights, defend claims, or protect third parties.

Requests should be sent to info@xploragt.com and include:

• full name;
• preferred way to receive the response;
• relationship with Xplora or booking number;
• the right or action requested;
• a sufficient description of the data involved.

Xplora may request reasonable information to verify the requester’s identity and prevent improper disclosure. It will not request more data than necessary for that verification.

Xplora will aim to respond within fifteen business days. If the request is complex or requires consulting records or providers, the deadline may be reasonably extended, and Xplora will explain the reason and the status of the request.

21. Security and Confidentiality

Xplora applies reasonable administrative, technical, and physical measures, proportionate to the sensitivity, volume, and risk of the data processed, including:

• role-based and need-to-know access;
• strong passwords and additional authentication when available;
• updates, backups, and website security controls;
• protection of company devices and accounts;
• restrictions on downloading, copying, or sending identity and health documents;
• training and confidentiality commitments;
• access reviews and secure deletion when appropriate.

No system is completely secure. Data Subjects should also protect their passwords, devices, and documents, and report any unauthorized use they detect immediately.

22. Security Incidents

When Xplora becomes aware of unauthorized access, loss, alteration, disclosure, or use of personal data, it will assess the scope, contain the incident, document the actions taken, and adopt reasonable corrective measures.

Xplora will notify the Data Subject and the competent authorities when required by law or when the incident may create a material risk to their rights, safety, identity, health, or assets.

Notifications will include, whenever possible, the nature of the incident, the data potentially affected, the measures taken, and recommendations to reduce risks.

23. Automation and Commercial Profiling

Xplora may use automation tools to organize inquiries, send reminders, tag interests, answer frequently asked questions, and manage authorized campaigns.

Xplora will not make decisions that produce legal or similarly significant effects on the Traveler based solely on automated processing, without reasonable human review.

Data Subjects may request human assistance if they believe an automated response did not adequately resolve their situation.

24. Third-Party Sites, Social Media, and Services

The website and Xplora’s communications may contain links to pages, maps, social networks, payment gateways, insurers, airlines, or other third-party services.

Xplora does not control the independent practices of those third parties. Before providing information directly to another platform, Data Subjects should review its privacy notices and terms.

25. Legal Framework

This Policy is interpreted in accordance with the Political Constitution of the Republic of Guatemala, the Consumer and User Protection Law, the Law for the Recognition of Electronic Communications and Signatures (Decree 47-2008), applicable tax, commercial, immigration, and tourism regulations, and any other provisions in force that apply to each type of processing.

Where applicable law grants rights greater than those set out in this Policy, the mandatory legal provisions will prevail.

26. Changes to This Policy

Xplora may update this Policy to reflect legal, technological, operational, or provider changes.

The updated version will state its effective date. Material changes will be communicated through a reasonable channel before taking effect when they significantly affect the Data Subject’s expectations or rights.

An update will not retroactively authorize uses of data that require specific consent. When an optional purpose changes substantially, Xplora will request new authorization where appropriate.

27. Questions, Requests, and Complaints

Data Subjects may contact Xplora through:

Privacy email	info@xploragt.com
Phone and WhatsApp	+502 3067-6503
Location	Quetzaltenango, Guatemala
Office hours	Tuesday to Friday, 8:00 a.m. to 5:00 p.m. (Guatemala time)

Data Subjects should clearly describe their request and provide enough information to locate the booking or relevant data.

This does not limit the right to file a complaint with the competent authorities. When the dispute relates to the provision of services or consumer rights, the Traveler may use the Complaints Book or contact Guatemala’s consumer protection agency, the Dirección de Atención y Asistencia al Consumidor (DIACO).

28. Relationship with Other Documents

This Policy is part of Xplora’s contractual framework and should be read together with:

• the Terms and Conditions;
• the Cancellation, Changes, Booking Transfer, and Refund Policy;
• the specific conditions of each tour;
• the Health and Physical Fitness Declaration;
• the Informed Consent and Assumption of Risk form;
• the Image Authorization, when the Data Subject chooses to grant it;
• the cookie policy or panel, where applicable.

In case of conflict, the specific provision offering greater clarity and protection will apply, without limiting non-waivable rights or authorizing processing incompatible with this Policy.

29. Acknowledgment

By providing data to Xplora, the Data Subject acknowledges having had access to this Policy. This acknowledgment does not make mandatory any processing that requires separate authorization.

Consents for marketing, image use, and medical data will be presented separately, clearly, and in a revocable manner, where applicable.

30. Additional Information for Visitors from the European Union / EEA

If you are located in the European Union or the European Economic Area, the following information also applies to you.

Legal bases. We process your personal data on the grounds described in Section 7: to perform the contract you request (your booking), to comply with legal obligations, for our legitimate interests (such as fraud prevention and service improvement), and with your consent (such as marketing and image use). Health data is processed only with your explicit consent or, in an emergency, to protect your vital interests.

International transfers. Xplora is based in Guatemala, so your data will be processed there in order to provide the services you book with us. Some of our providers may also process data in other countries. Where available, we rely on the safeguards those providers offer, such as standard contractual clauses.

Your rights. You have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. To exercise these rights, write to info@xploragt.com. We will respond within one month at the latest.

Right to lodge a complaint. You also have the right to file a complaint with the data protection authority of your country of residence, such as the Spanish Data Protection Agency (AEPD) in Spain or the competent data protection authority in Germany.