BlueNavyCabo Platform Privacy Notice

BlueNavyCabo issues this notice in its capacity as Data Controller of the processing of the personal data of its operator-clients and their staff.

A.1 Identity and address of the Data Controller

Santiago Tangassi García, an individual engaged in business activities (under the RESICO tax regime, the Simplified Trust Regime), who operates under the trade name BlueNavyCabo, is the Data Controller responsible for the processing of the personal data described in this notice.

• RFC (Federal Taxpayer Registry number): TAGS0711265B6
• Address (for purposes of this notice): Calle Isla San Marcos, Mz. 5, Lt. 10, Fracc. Cumbres del Tezal, C.P. 23454, Cabo San Lucas, Baja California Sur, México.
• Platform: https://bluenavycabo.com (the former domain, bluenavycabo.cabowebsites.com, redirects to this address).
• Contact email for personal data matters (ARCO rights (Access, Rectification, Cancellation and Opposition) and privacy questions): santiagotangassi@gmail.com

Hereinafter, the contact email indicated above is referred to as the "Privacy Contact".

A.2 Individuals whose data BlueNavyCabo processes under this notice

This notice covers the data of the Operator that contracts for or tries out the Platform and of the staff that the Operator registers as users of the dashboard (account holder, managers, front-desk staff, captains). It does not cover the data of the tourists who make bookings: the Operator processes that data as Data Controller, and BlueNavyCabo only as Data Processor.

It also covers the data of prospects who request a demo from the public website ("Request a demo" form): name, email address and business name. This data is used solely to follow up commercially on that request; if no contract is entered into, it is deleted within twelve (12) months at the latest.

A.3 Personal data we process

To register the Operator, operate the Platform and collect the commission, we process:

1. Identification and contact information of the account holder and the users: name, email address and telephone number.

2. Business data: trade name, corporate or business name, RFC, address, applicable permits and registrations (for example, the Operator's registration in the Registro Nacional de Turismo, the National Tourism Registry) and operational data uploaded by the Operator (vessels, services, schedules, prices).

3. Access credentials: the password is not stored in plain text; it is stored protected by a password-derivation algorithm (hash). Where applicable, the two-step verification (2FA) settings.

4. Payment account data (Stripe Connect): the Operator connects its own Stripe account. Bank details and identity verification data are collected and safeguarded directly by Stripe; BlueNavyCabo sees the status of the account and technical identifiers, not full bank account numbers. If the Operator agrees to a monthly fee, the card used to pay it is also collected and safeguarded by Stripe (Stripe Billing): BlueNavyCabo only sees the status of the subscription and the reference and amount of each invoice — never the card number.

5. Tax data of the Operator, in order to issue the CFDI (digital tax invoice) for the commission and to comply with accounting obligations.

6. Technical data collected by the system and retained as evidence and for security purposes:

• IP address and browser user agent at the time the account holder accepts the Terms of Service of the Platform. They are retained together with the exact version of the accepted text and its fingerprint (SHA-256 hash) as evidence of electronic acceptance (click-wrap), in compliance with the requirements of the Código de Comercio (Commercial Code) for a data message to remain complete and accessible for subsequent consultation (arts. 89 bis, 90 bis and 93 of the Código de Comercio).
• Audit log (records of relevant activity in the dashboard) and these same indicators (IP address, user agent, date and time) for security and fraud-prevention purposes.

We do not request sensitive personal data from the Operator or its staff for the purposes of this notice.

A.4 Purposes of processing

Necessary purposes (they give rise to and support the relationship; they do not require additional consent):

1. Creating and managing the account of the Operator and its users, and controlling access to the dashboard.

2. Operating the booking, payment, ticketing and email notification system on behalf of the Operator.

3. Calculating, retaining and invoicing the Platform's commission.

4. Providing support and responding to inquiries.

5. Recording and retaining evidence of acceptance of the Terms (including IP address and user agent, see A.3.6) and maintaining security logs.

6. Complying with legal, tax, accounting and commercial record-retention obligations (art. 49 of the Código de Comercio: retention for 10 years).

Voluntary purposes (the Operator may refuse them without affecting its service):

1. Informing you of improvements, new features and content of the Platform.

2. Inviting you to try features at an early stage.

To refuse the voluntary purposes, simply write to the Privacy Contact; nothing that has already been contracted will change.

A.5 Data Processors and service providers that process data on our behalf

To operate, we use service providers that process data following our instructions, under contract and without using it for their own purposes (Data Processors/sub-processors):

- Stripe — onboarding and operation of the Operator's payment account, payment processing and, if a monthly fee is agreed, its recurring billing (Stripe Billing). - Resend — sending of transactional emails (confirmations, notices, notifications to the Operator). Postmark may act as a backup provider for the same sending when the primary provider fails. - Infrastructure provider (currently Hostinger) — hosting of the server on which the system runs. - Calendar providers that the Operator itself connects (for example Google Calendar or Teamup) — they receive the data of the departures and bookings that the Operator chooses to reflect in its operational calendar. They only process data if the Operator activates the connection, and they stop receiving it once the connection is disconnected. - Data obtained from Google. When the Operator connects Google Calendar, BlueNavyCabo accesses only the "calendar.events" scope in order to read and write the events of the calendar that the Operator selects. The use and transfer to any other application of information received from Google APIs adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. That information is not sold, is not used for advertising, and is not read by any person, except with the Operator's express consent, for security reasons or to comply with the law.\n Database hosting. The system's database is hosted on a server administered by BlueNavyCabo (a VPS under its control), not on a third-party database service. The infrastructure provider supplies the server; administration of the database and of the application is the responsibility of the Platform.

Processing outside Mexico. Some of these providers (Stripe, Resend, Postmark, Google, Teamup) process data in data centers outside Mexico, mainly in the United States. They remain Data Processors: they process the data only on the instructions of BlueNavyCabo (or of the Operator, when the Operator is the one who connects the service), under their own data processing agreements, and they may not use it for their own purposes.

A.6 Transfers

We do not sell or rent personal data. We only disclose it: (a) to competent authorities when a law or a duly grounded order so requires; and (b) to accounting or legal advisors bound by a duty of confidentiality, to the extent strictly necessary. Outside those cases, any transfer that requires consent will be disclosed beforehand in order to obtain such consent.

A.7 ARCO rights and revocation of consent

The Operator and its users may Access their data, Rectify it, Cancel it and Oppose its processing, and may revoke the consent they have granted. To exercise these rights, send the Privacy Contact a request containing: (i) your name and a means by which we can reply to you; (ii) official identification (or the document evidencing representation); and (iii) a clear description of the data and of the right you wish to exercise.

We will respond within the time periods established by law. Exercising these rights is free of charge; only justified shipping or reproduction costs permitted by law are charged.

Some data must be retained due to legal obligations (tax, accounting, and the evidence of acceptance of the terms for 10 years, art. 49 of the Código de Comercio) or for the defense of claims, even if its cancellation is requested; in that case, such data is blocked from any other use until the applicable period expires.

A.8 Retention and security

We retain data for as long as a relationship with the Operator exists and for the periods required by legal, tax, accounting and claims-defense obligations; thereafter, it is securely deleted or anonymized. When the relationship with the Operator ends, the system carries out that deletion no later than ninety (90) calendar days thereafter (automated process), leaving blocked (solely for their legal retention period) the records that the law requires to be retained. The evidence of acceptance of terms and commercial records are retained for 10 years (art. 49 of the Código de Comercio).

We maintain reasonable administrative, technical and physical security measures to protect the data (among others: encryption in transit, passwords safeguarded by hashing, role-based access control and logs). We do not promise perfect security or absolute inviolability, as no measure can guarantee it: we commit to a reasonable standard consistent with industry practice, and to contractually require equivalent measures from our Data Processors.

A.9 Cookies

The Platform uses only strictly necessary cookies and one theme preference cookie. We do not use analytics, tracking or third-party advertising cookies. Details are provided in Part C — Cookie Policy.

A.10 Authority

If the Operator believes that its right to the protection of personal data has been violated, it may turn to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), the competent authority in this matter (the INAI, National Institute for Transparency, Access to Information and Personal Data Protection, was abolished by the reform published in the DOF, Official Gazette of the Federation, on March 20, 2025).

A.11 Changes to this notice

Any change will be published at the address where this notice is hosted, together with its date and version number. If a change involves new purposes that require consent, such consent will be requested before they are applied.

Cookie Policy

This policy applies to the BlueNavyCabo Platform and describes the cookies that the system installs.

C.1 What a cookie is

A cookie is a small text file that a website stores in your browser to remember information between pages or visits.

C.2 Which cookies we use (and which we do NOT)

The system uses only strictly necessary cookies required for it to function and one preference cookie. We do not use analytics cookies (there is no Google Analytics or similar tool), cross-site tracking cookies, third-party advertising cookies or social media cookies. We do not sell or share browsing information with third parties for advertising purposes.

These are the cookies that the Platform installs, with their technical name, their purpose, whether they are strictly necessary, their HttpOnly and SameSite attributes, and their duration:

• Session — technical name: thr_session. Keeps you signed in to the dashboard (and to the Operator app) after you log in with your username and password. Strictly necessary. HttpOnly: yes. SameSite: Lax. Duration: approximately 12 hours.
• Pre-session (2FA) — technical name: thr_pre_session. It is the intermediate security step between "the password is correct" and "you entered the verification code"; without it, the second factor cannot be completed. Strictly necessary. HttpOnly: yes. SameSite: Lax. Duration: approximately 10 minutes.
• Theme preference — technical name: bnc-tema. Remembers whether you chose light mode, dark mode or the system setting, so that the page does not flicker on load; it literally stores "claro" (light), "oscuro" (dark) or "sistema" (system). It is not a tracking cookie: it is your own preference. HttpOnly: no, deliberately, because the browser must read it to render the theme without flickering. SameSite: Lax. Duration: approximately 1 year.

The thr_session and thr_pre_session cookies are issued with the Secure attribute in production (they are only transmitted over HTTPS). The theme cookie is not sensitive (it neither identifies nor tracks) and is also saved in the browser's local storage as a backup.

C.3 The embedded booking widget

Under the current implementation, the public booking page and the checkout (the widget that the Operator embeds on its website) do not install their own cookies for the tourist: payment is processed by Stripe, which installs its own strictly necessary cookies to process the charge and prevent fraud (for example __stripe_mid and __stripe_sid), governed by its cookie policy: https://stripe.com/legal/cookies-policy. If the Operator embeds the widget within its own website, the cookies of that website are the Operator's responsibility.

C.4 Is a cookie consent banner required?

The cookies we use are strictly necessary to provide the service, plus one preference cookie that you yourself activate when choosing the theme. By their nature, they do not require a prior consent banner, which is why the system does not display one: doing so would be declaring a consent that these cookies do not need. This policy serves to inform you transparently.

C.5 How to control them

You can delete or block cookies in your browser settings. Please note that if you block the strictly necessary cookies (thr_session and thr_pre_session), you will not be able to log in to the dashboard. Blocking the theme cookie will only mean that your light/dark mode preference is not remembered.

C.6 Version and place within the legal package

This policy forms part of the Platform's legal package, together with the Platform Terms and the Privacy Notice. Each version is published with its date and version number, and is retained together with its SHA-256 cryptographic fingerprint; previous versions remain intact and available for consultation, on the same terms as the rest of the Platform's legal documents.