Privacy Policy

Last updated: September 28, 2026

Data Controller

In accordance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP), The Dive Machine is responsible for the collection, use, storage and protection of your personal data.

The Dive Machine is a company legally constituted under Mexican law, located at Calle 6 Norte bis #227, Colonia Centro, Solidaridad, Playa del Carmen, Quintana Roo, C.P. 77710, Mexico.

For any inquiries or requests regarding your personal data, you may contact us at info@thedivemachine.com.

Personal Data We Collect

Identification data

Full name, date of birth, nationality and government-issued identification details when required for diving certifications or legal purposes.

Contact information

Email address, phone numbers, physical address and hotel or accommodation details during your stay in the Riviera Maya.

Health and medical data

Medical conditions, diving fitness declarations and health questionnaires required for safe diving activities, as mandated by international diving standards.

Emergency contacts

Name, relationship, phone number and address of your designated emergency contact for your safety during diving activities.

Certification details

Diving certification level, certifying agency (SSI, PADI or others), certification number and diving experience relevant to the services you request.

Payment information

When applicable, billing details are processed through secure third-party payment platforms. The Dive Machine does not store credit card numbers on its own servers.

Information you send us through our website

When you use our contact form, we receive the information you provide, such as your name, email address, phone number and message, so we can answer your request.

Purposes of Processing

Primary purposes

These are necessary to provide the services you request:

• Service delivery: to provide the diving excursions, courses, certifications and related services you book with us.
• Safety: to verify your fitness to dive, comply with international diving safety standards and ensure your well-being during all activities.
• Booking management: to process reservations, confirmations, schedule changes and cancellations.
• Communication: to contact you about your booking, pre-dive instructions, meeting points and follow-ups.
• Legal obligations: to comply with applicable laws, regulations and diving industry standards.

Secondary purposes

These are not strictly necessary, but help us improve your experience:

• Marketing communications: to send you promotions, special offers and news about our diving services, only with your consent.
• Service improvement: to measure customer satisfaction and improve our services and website.
• Database updates: to keep your information accurate and up to date.

If you do not want your data to be used for secondary purposes, you may opt out at any time by writing to info@thedivemachine.com with the subject line "Opt-Out Secondary Purposes".

Sensitive Data

Due to the nature of diving, we may collect sensitive personal data, including health and medical information. This data is collected exclusively to ensure your safety during diving activities and to comply with the standards of certification agencies such as SSI and PADI.

We will always obtain your express consent before collecting sensitive data. You may revoke this consent at any time, although doing so may limit our ability to provide diving services that require medical clearance.

Your ARCO Rights

Under Mexican law, you have the right to Access, Rectify, Cancel and Oppose the processing of your personal data:

• Access: to know what personal data we hold about you, how we obtained it and why we use it.
• Rectification: to request the correction of inaccurate, incomplete or outdated data.
• Cancellation: to request the deletion of your data when it is no longer necessary for the purposes for which it was collected.
• Opposition: to oppose the processing of your data for specific purposes, such as marketing communications.

Data Security

We apply administrative, technical and physical security measures to protect your personal data against unauthorized access, loss, alteration or misuse, including:

• Encrypted connections: our website uses SSL/TLS encryption (HTTPS).
• Access control: only authorized personnel can access personal data, and only when necessary.
• Secure payments: financial transactions are handled by certified third-party payment processors.
• Periodic reviews of our data protection practices.

No method of transmission over the internet or electronic storage is completely secure, but we continuously work to improve our security practices.

Third-Party Transfers

We may share your personal data with the following third parties when necessary to provide our services:

• Diving certification agencies (SSI, PADI or others) when processing your certifications.
• Insurance providers when diving insurance coverage is required or in the event of an incident.
• Government authorities when required by law or legal proceedings under Mexican jurisdiction.
• Payment processors that handle financial transactions on our behalf.

We require all third parties to respect the security and confidentiality of your data. We do not sell, rent or trade your personal information.

Cookies and Website Tools

Our website uses cookies and similar technologies to work properly and to understand how visitors use it:

• Essential cookies: required for the website to function, including navigation, language selection and security.
• Analytics: Google Analytics and Metricool help us understand, in aggregate, how visitors use our website. They are loaded through Google Tag Manager.
• Advertising: Google Ads helps us measure the effectiveness of our campaigns.
• Third-party services: our contact form is protected by Google reCAPTCHA; the WhatsApp chat button, the Google Maps map and the YouTube videos (shown in privacy-enhanced mode) are provided by their respective companies, which may apply their own privacy policies.

You can manage or delete cookies through your browser settings. Disabling some cookies may affect how the website works.

Data Retention

We keep your personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

• Booking and service records: 5 years after the date of service, as required by Mexican commercial and tax regulations.
• Diving certification records: for as long as required by the certification agencies for diver safety.
• Medical and health data: for the duration of your active relationship with us, then securely deleted within 12 months.
• Marketing preferences: until you withdraw your consent or request deletion.

Once the retention period ends, we securely delete or anonymize your data.

Changes to This Policy

The Dive Machine may update this Privacy Policy to reflect changes in our practices or in legal requirements. We will publish any changes on this page and, when they are significant, we will let you know by email, phone or another appropriate means.

Contact

If you have any questions about this Privacy Policy or wish to exercise your ARCO rights, contact us at info@thedivemachine.com or call +52 998 291 2220.