KŌM Tulum · Privacy & Data Protection
Privacy Policy
Your privacy and discretion are at the very heart of our hospitality. This policy describes, with complete transparency, how KŌM Tulum collects, uses, and safeguards your personal data.
1. Data Collection
We collect only the information strictly necessary to provide an exceptional stay: full name, email address, and phone number, gathered through our inquiry and booking forms.
2. Purpose & Use of Data
Your data allows us to manage your bookings, facilitate personalized communications with our private concierge team, and continuously elevate our bespoke guest experience.
3. Identification Documents (Guest Portal)
During pre-check-in, our guest portal collects a valid government-issued photo ID. This collection is mandated by Mexican authorities for guest registration. Legal basis: compliance with legal obligations and fulfillment of the accommodation contract. Documents are stored in an encrypted private vault, accessible only via time-limited signed URLs (1 hour) restricted to authorized KŌM personnel, retained for the duration of the stay and the statutory tourism retention period, then securely purged.
4. House Rules Acceptance & Signature
When accepting the villa house rules via the guest portal, we record the IP address used at the moment of signing (signing_ip). This record serves as technical proof of contract acceptance, distinct from aggregated traffic analytics. Legal basis: contract execution and legitimate interest in evidentiary dispute resolution. It is kept for the statutory contractual prescription period, then purged.
6. Anonymized Traffic Analytics
KŌM aggregates privacy-preserving visit statistics (pages viewed, referrer, approximate geographic region) to refine site performance. IP addresses are truncated and anonymized before storage, preventing the identification of individual visitors.
7. Data Storage & Security
All guest information is hosted on an enterprise-grade, highly secure cloud infrastructure with end-to-end encryption. Access is strictly compartmentalized to authorized KŌM personnel.
8. Third-Party Service Providers
To deliver our hospitality services, we partner with trusted infrastructure providers who process specific data on behalf of KŌM Tulum:
- Supabase — secure database and asset hosting.
- Stripe — PCI-compliant payment gateway processing.
- Resend — transactional email dispatch.
- Meta / WhatsApp Business — verified guest messaging.
- Google — scheduling services and Gemini AI assistance.
Any international data transfers are governed by appropriate contractual safeguards (including Standard Contractual Clauses).
9. Data Retention
Unconverted inquiry records are retained for 3 years from the last interaction. Confirmed guest records are preserved throughout the contractual relationship, plus mandatory legal, accounting, and tax retention periods.
10. WhatsApp Business Communications
Direct messaging via WhatsApp utilizes the Meta WhatsApp Business API. Messages benefit from transport encryption. Your conversation data remains strictly confidential and is never commercialized.
11. Your Rights
You hold the right to access, rectify, or request the deletion of your personal data at any time. A direct request sent to contact@komtulum.com is all that is required.
12. Contact & Inquiries
For any questions regarding this privacy policy, please contact us at: contact@komtulum.com