Privacy notice

Last updated: 22 September 2026

1. Who is responsible for your data

Mauricio Pérez Valero, trading as Navegabacalar — Escuela de Vela Navegabacalar ("Navegabacalar", "we", "us"), is the controller of the personal data collected through this website.

Address: Av. 1 y Calle 24, Colonia Centro, 77930 Bacalar, Quintana Roo, Mexico.
Email: navegabacalar@gmail.com
**WhatsApp:** +52 55 2215 3849
Website: navegabacalar.mx

This privacy notice is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its implementing rules.

2. What data we process

We only collect what you give us or what your use of the site generates. We do not process sensitive personal data (health, ethnic origin, beliefs, sexual orientation, biometrics), and we make no automated decisions with legal effects on you.

When you contact us

Name, email, phone number and the content of your message, whether you use the contact form, WhatsApp or email.

When you create a campus account

Email address and password. Your password is stored encrypted by our authentication provider — we never see it. You can also sign in through a magic link sent to your inbox. We also record your sign-up date and your user type (student or administrator).

When you buy an online course

Email address, course purchased, amount, currency, payment status and the payment session identifier. Your card details never reach our servers or our database: they are collected and processed directly by Stripe, our payment processor.

While you study

The lessons you mark as complete, your quiz answers and, if you join the virtual regatta, your skipper name, boat type and the manoeuvres you record.

Browsing data

IP address, device and browser type, pages visited, and data derived from cookies as described in section 6. Analytics and advertising collection only starts if you allow it.

3. Why we process it

Necessary purposes

These are essential to provide the service; we cannot serve you if you object to them:

Answer your enquiries and arrange lessons, bookings and group programmes.
Create and manage your campus account and keep you signed in.
Process course payments, grant access to what you bought and issue the receipt.
Save your learning progress so you can pick up where you left off.
Keep the site secure and prevent fraud and abuse.
Comply with tax, accounting and other legal obligations.

Secondary purposes

These are not necessary for the service and require your consent. You may refuse now or later without losing access to your courses:

Measure site usage statistically in order to improve it.
Show you advertising related to your interests, on and off this site.
Send you news about courses, dates and school activities.

To refuse the secondary purposes, simply decline analytics and advertising cookies in the "Manage cookies" panel in the footer, or write to navegabacalar@gmail.com.

4. Who we share data with

We do not sell your personal data. We share it only with the providers needed to run the site, which process it on our behalf and under a duty of confidentiality. Some are based outside Mexico, so your data may be transferred to and stored abroad, mainly in the United States and the European Union:

Provider	Purpose	What it receives
Supabase	Campus accounts, authentication and database	Email, encrypted password, enrolments and progress
Stripe	Payment for online courses	Email, amount and payment details (the card is handled by Stripe, not by us)
Vercel	Website hosting	Technical connection data (IP, browser)
Google (Analytics and Ads)	Statistics and advertising, only with your consent	Cookie identifiers and browsing data
Meta (Facebook Pixel)	Advertising, only with your explicit consent	Cookie identifiers and browsing data
WhatsApp / Meta	Messaging support, if you choose that channel	Your number and the content of the conversation

We may also disclose data where a competent authority or a legal obligation requires it.

5. How long we keep it

Contact messages: up to 2 years after the last contact.
Campus account and progress: for as long as your account exists. Delete the account and your account and progress data are erased.
Purchases and invoicing: for the period required by Mexican tax law (at least 5 years), even if you delete your account.
Cookie preference: stored in your own browser until you change it or clear the site's data.

6. Cookies and similar technologies

The first time you visit, a banner offers four categories. No analytics or advertising cookie is set before you decide: the site starts with consent denied by default (Google Consent Mode v2), and the Meta Pixel only loads if you explicitly accept the advertising category.

Necessary — required for the site to work: navigation, language, security, your campus session and the record of your own cookie choice. They cannot be switched off. They include the nb_consent_v1 preference stored in your browser and the Supabase session cookies (sb-…).
Functional — remember your preferences and allow embedded content such as maps or videos where a page includes them.
Analytics — measure site usage in aggregate so we can improve it (Google Analytics, with IP anonymisation).
Advertising — allow ads related to your interests (Google Ads, Meta Pixel).

You can change or withdraw your choice at any time through the "Manage cookies" link in the footer, and you can also block or delete cookies in your browser settings. Blocking all of them may break the parts of the site that rely on your session, such as the campus.

7. Your rights

You have the right to access your personal data, have it rectified if inaccurate, request its cancellation where you believe it is not needed for the purposes in this notice, and object to specific processing (the ARCO rights under Mexican law). You may also withdraw your consent and ask us to limit the use or disclosure of your data.

To exercise them, write to navegabacalar@gmail.com and include:

Your name and a way to send you our reply.
A copy of official ID proving your identity (or proof of authority if you act for someone else).
A clear description of the data concerned and the right you wish to exercise.

We reply within a maximum of 20 business days, free of charge. If you are not satisfied with our answer, you may turn to the competent personal data protection authority.

8. Security

We apply reasonable technical and organisational measures: encrypted connections (HTTPS), hashed passwords, database access restricted by row-level security rules, and payments handled by a PCI-DSS certified provider. No system is infallible, but we will inform you of any breach that significantly affects your data.

9. Minors

Online campus accounts are intended for people aged 18 and over. Children and teenagers are enrolled in in-person lessons, camps and group activities by a responsible adult, who provides the necessary data and authorises its processing.

10. Changes to this notice

We may update this notice to reflect legal changes or new features of the site. The version in force is always the one published on this page, with the update date shown above. If a change is substantial, we will tell you through the contact details you have given us.