This Privacy Notice explains how we handle your personal data when you visit this website, book with us or stay at one of our Properties. It is issued under the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and, for guests in the European Union, takes the General Data Protection Regulation (GDPR) into account.
1. Data controller
INPLAYARENTALSMEX, S.A. de C.V. (“InPlaya”), with its address at Av. 15, Mz. 79, Lt. 1, Col. Centro, C.P. 77710, Playa del Carmen, Quintana Roo, México, is the controller of your personal data. Privacy contact: info@inplayarentals.com.
2. Personal data we collect
- Identification and contact data: full name, email, phone number (which we also use for WhatsApp) and preferred language.
- Booking data: Property, dates, number of guests, booking code, messages we exchange with you.
- Official ID data: an image or details of the ID document you send in pre-check-in and, if the verification provider requires it, a picture of you to compare with the document: [IDENTITY VERIFICATION PROVIDER TO BE CONFIRMED].
- Payment data: processed by Stripe; we only receive the payment confirmation, the last digits and brand of the card, the amount and currency. We do not store your full card number.
- Minimal technical data: IP address and server logs for security and for running the site. We do not use third-party advertising or tracking tools.
We do not ask for sensitive personal data. Please do not send it to us in free-text messages.
3. What we use your data for
Necessary purposes (without them we cannot provide the service):
- Create, charge, confirm and manage your booking.
- Validate your identity before handing over the access code and keep the guest register that building security requires.
- Communicate with you before, during and after your stay (confirmation, arrival instructions, support, incident handling).
- Issue invoices and meet tax, accounting and legal obligations.
- Handle claims, damages or disputes, and prevent fraud.
Additional purposes (you can object without affecting your booking): sending satisfaction surveys and, only if you agree, information about promotions. To object, write to info@inplayarentals.com.
4. Who we share your data with
We do not sell your data. We share it only as needed with:
- Stripe, as payment processor.
- Messaging and email providers (for example WhatsApp/Meta and our email provider) to send you messages about your booking.
- Our property management system and web hosting providers that give us infrastructure (for example Hostify and Railway).
- The identity verification provider we use for pre-check-in.
- The building administration and security staff, who receive your name and stay dates for access control.
- Authorities, when a law or a lawful order requires it, and our tax and legal advisors when necessary.
Some of these providers are outside Mexico (for example in the United States). We require them to protect your data with equivalent measures and, where the GDPR applies, with appropriate safeguards such as standard contractual clauses.
5. Your rights (ARCO) and how to use them
You have the right to Access your data, Rectify it, Cancel (erase) it and Object to its processing (ARCO rights), and to withdraw your consent and limit the use or disclosure of your data.
To use them, email info@inplayarentals.com with: your name and a way to reply; a copy of an official ID; a clear description of your request; and, if you want a correction, the correct data with supporting documents. We will reply within 20 business days and, where appropriate, carry out your request within the following 15 business days.
If you believe your data protection rights have been violated, you can go to the competent data protection authority (currently the Secretaría Anticorrupción y Buen Gobierno, or its successor).
6. How long we keep your data
We keep booking data for as long as needed to provide the service and as tax and accounting laws require (up to five years). ID images are deleted no later than [ID DELETION PERIOD TO BE CONFIRMED] after check-out, unless an incident or a legal obligation requires keeping them.
8. Guests in the European Union (GDPR)
If you are in the European Economic Area, the legal bases for processing are: performance of the accommodation contract (booking, payment, communications), compliance with legal obligations (tax and registration), our legitimate interest in the security of the Properties and fraud prevention, and your consent where we ask for it (for example, for promotions).
In addition to ARCO rights, you have the right to data portability, to restriction of processing and to lodge a complaint with the supervisory authority in your country. To use them, write to info@inplayarentals.com.
9. Security
We apply reasonable technical and administrative measures to protect your data (encrypted connection, restricted access, providers with security certifications). No system is infallible; if a breach significantly affects you, we will tell you.
10. Minors
The booking service is for people over 18. Data of minors traveling with you is only handled as needed to register the stay.
11. Changes to this notice
If we change this notice we will publish the new version on this website, with its update date.
12. Contact
INPLAYARENTALSMEX, S.A. de C.V. · Av. 15, Mz. 79, Lt. 1, Col. Centro, C.P. 77710, Playa del Carmen, Quintana Roo, México · info@inplayarentals.com · +52 1 938 980 0460.