Privacy notice.

Controller and privacy contact

Address: República de Uruguay 36, Centro Histórico, Centro, Cuauhtémoc, 06000 Mexico City, Mexico. Privacy requests: hola@hesmexico.mx.

Information we may collect

• Name, email address, telephone number and preferred contact channel.
• Arrival and departure dates, guest count, booking preferences and service requests.
• Messages, quotations, payment references and records needed to manage a confirmed stay.
• Identification, billing or other information required by law or reasonably necessary for the requested service.
• Basic technical and browsing data required for website security and operation.
• HES does not intentionally request sensitive personal data through the general website or WhatsApp enquiry. If such data becomes strictly necessary, HES will explain the purpose and obtain the consent required by law.

Primary purposes

• Answer enquiries and verify availability.
• Prepare quotations, confirm bookings, process payments and maintain contractual records.
• Coordinate arrival, departure, guest support, additional services and safety communications.
• Comply with tax, consumer, security and other applicable legal obligations.
• Prevent fraud, protect guests and properties, and operate this website securely.

No secondary marketing purposes

HES does not currently use booking enquiries for advertising, profiling or unrelated marketing. If an optional secondary purpose is introduced, it will be presented separately so the person can accept or refuse it without affecting the requested service.

Sharing and external providers

Data may be processed by payment, hosting, communications, professional-service or booking providers when necessary to deliver the requested service. These providers must process data for the contracted purpose and under applicable confidentiality and security duties. Transfers without consent will occur only when permitted or required by law; otherwise, HES will request the appropriate consent. HES does not sell personal data. Airbnb, Instagram and WhatsApp are governed by their own privacy notices.

Access, correction, cancellation and objection

You may request access to, correction or cancellation of your data, object to its processing, revoke consent where applicable, or limit its use by emailing hola@hesmexico.mx with the subject “Privacy request”. Include your name, a clear description of the request, the right you wish to exercise and a means to receive the response. HES may request reasonable proof of identity. HES will communicate its determination within 20 days of receiving a complete request and, if appropriate, make it effective within the following 15 days; these periods may be extended once when legally justified.

Retention and security

Personal data is retained only as long as reasonably necessary for the purposes described, the contractual relationship and applicable legal retention periods. HES uses proportionate administrative, technical and physical safeguards and confidentiality controls. If a security incident significantly affects a person's rights, HES will notify the affected person as required by law. Do not send passwords, full card details or identity documents through the general form or WhatsApp unless HES has provided a suitable secure channel and explained why they are needed.

Cookies and website operation

The website may use essential technical storage required for language preferences, security and operation. If optional analytics or advertising technologies are introduced, this notice and the corresponding consent controls will be updated before use.

Changes to this notice

Material changes will be published on this page. The date below identifies the current version.