Privacy Policy

COMPREHENSIVE PRIVACY NOTICE — AMALA

Last updated: September 2026

Jeaninne Aguilar Pérez, acting in her capacity as an individual and the person responsible for operating AMALA, with an address at Ejército Nacional #1, Barrio El Cerrillo, C.P. 29200, San Cristóbal de Las Casas, Chiapas, México, is responsible for the processing, use, storage, and protection of the personal data provided by guests, clients, and users.

For any matter related to privacy and the protection of personal data, you may contact us at:

hellol@amalahouse.com

1. Personal data we may collect

To manage our accommodation services, reservations, and guest support, we may request:

- Full name.

- Date of birth.

- Nationality and country of residence.

- Phone number and email address.

- Government-issued ID or passport.

- Arrival and departure dates.

- Accommodation type and booking details.

- Emergency contact information.

- Billing information.

- Information related to payments and transactions.

- Communications by email, phone, WhatsApp, or website forms.

- Technical data related to browsing our website, where applicable.

Amala will endeavor to collect only the information necessary to provide its services.

2. Financial and payment information

When a reservation requires payment by bank card, the information needed to process the transaction may be handled through the booking engine, payment platform, or relevant financial institution.

Amala will not store full card numbers or security codes when this information is processed directly by authorized third-party providers.

3. Purposes of Data Processing

The personal data provided may be used to:

- Manage and confirm reservations.

- Process check-ins and check-outs.

- Identify and register guests.

- Process payments.

- Issue invoices or receipts.

- Contact guests before, during, or after their stay when necessary.

- Handle requests, questions, changes, or issues.

- Maintain administrative and security controls.

- Meet tax, administrative, and legal obligations.

- Handle inquiries, lost property, or complaints.

- Improve our services and our guests’ experience.

4. Promotional purposes

With the user's authorization, their contact information may be used to:

- Inform you about promotions.

- Share information about new Amala services or experiences.

- Send updates.

- Conduct customer satisfaction surveys.

Guests may request at any time that their data not be used for these purposes, without affecting their reservation or stay.

5. Wellness Experiences and Sensitive Data

Amala does not require information about a guest’s health to make a standard accommodation reservation.

However, some additional services—such as Ayurvedic experiences, massages, temazcal, or other wellness activities—may require information related to the participant’s health or specific conditions.

In these cases, this information will be requested only when necessary to provide the service, and the appropriate consent will be obtained.

Health-related data will not be included in the guest’s standard reservation record.

6. Third-party platforms and providers

To provide our services, some personal information may be processed by providers such as:

- Amala’s booking engine and PMS.

- Booking.com, Expedia, Despegar, or other booking platforms.

- Banks and payment processors.

- Technology and web hosting providers.

- Service providers directly involved in an activity requested by the guest.

- Competent authorities where legally required.

Only the information necessary to provide the relevant service will be shared.

7. Third-party experiences

Amala may provide information or help book experiences offered by third-party providers, such as cultural, culinary, nature, or wellness activities.

When information needs to be shared to make a reservation—for example, your name, phone number, number of guests, or dates—only the information strictly necessary will be provided.

Once the information has been received, each external provider will be responsible for processing that data in accordance with its own privacy policies.

8. Data Security

Amala will take reasonable administrative, technical, and physical measures to protect personal information against:

- loss;

- misuse;

- unauthorized access;

- alteration;

- disclosure;

- damage or destruction.

Access to guest information will be limited to staff who need it to perform their duties.

9. Data Retention

Personal data will be retained only for as long as necessary to provide the contracted services and meet tax, legal, administrative, or contractual obligations.

Once this period has ended, the information will be deleted or handled in accordance with applicable legal requirements.

10. ARCO Rights

The data subject may request:

Access: find out what personal information Amala holds about you.

Correction: correct inaccurate or outdated information.

Erasure: request the deletion of your data where legally applicable.

Objection: request that your data not be used for certain purposes.

Requests should be sent to:

Email: hello@amalahouse.com

Data Controller: Jeaninne Aguilar Pérez

The request must include the data subject’s name, a method for receiving a response, information needed to verify their identity, and a clear description of the right they wish to exercise.

11. Withdrawal of Consent

Where legally applicable, the data subject may request to withdraw the consent given for the processing of their data by sending a request to:

hello@amalahouse.com

Withdrawal will not have retroactive effect or prevent the retention of information that must be kept to comply with legal obligations.

12. Cookies and Website

Amala’s website may use cookies and similar technologies to:

- enable the booking engine to function;

- make navigation easier;

- remember certain preferences;

- obtain usage statistics;

- improve the guest experience.

Some third-party tools may use their own cookies in accordance with their privacy policies.

13. Minors

Amala is an adults-only accommodation for guests aged 18 and over.

For this reason, we do not intentionally collect personal data from minors.

If Amala discovers that it has received information about a minor without a legitimate reason to retain it, the necessary steps will be taken to delete it where legally appropriate.

14. Changes to the Privacy Notice

This Privacy Notice may be amended as a result of legal or operational changes, or changes related to Amala’s services.

Any updates may be viewed on our website:

[AMALA URL — pending]

15. Contact

AMALA

Data controller: Jeaninne Aguilar Pérez, individual

Address: Ejército Nacional #1, Barrio El Cerrillo, C.P. 29200, San Cristóbal de Las Casas, Chiapas, México