1. Identity and address of the data controller
Boma Desarrollos S.A. de C.V. (hereinafter, “Boma” or “the data controller”), with address in Mérida, Yucatán, Mexico, is responsible for the processing of the personal data we collect through the yucatancountrylakes.mx site, its associated commercial channels and in-person visits to the Yucatán Country Lakes development, located at km 5.5 of the Ucú-Chuburná highway, municipality of Hunucmá.
2. Personal data we collect
We collect the following categories of personal data:
- Identification data: full name, official ID, and RFC (Federal Taxpayer Registry) where applicable.
- Contact data: email address, landline or mobile phone, WhatsApp, postal or tax address.
- Financial or asset data: solely in the context of formal quotes and purchase-and-sale transactions, we collect information on reference budget, down-payment and term capacity, as well as the tax and banking documentation required by the Banco Invex trust.
- Browsing data: IP address, cookie identifiers, pages visited, traffic source (UTM) and session duration.
We do not collect sensitive data (racial origin, political opinions, religious beliefs, health status, sexual life or genetic information).
3. Purposes of the processing
3.1 Primary purposes — necessary for the commercial relationship
- Attend to and respond to requests for information about the project.
- Generate quotes, budgets and financial simulations.
- Manage guided tours, in-person appointments and virtual meetings.
- Formalize promise-of-sale agreements, reservations and trust transactions.
- Issue invoicing, receipts and digital tax vouchers.
- Comply with applicable contractual and legal obligations.
3.2 Secondary purposes — require express consent
- Sending of marketing communications related to Country Lakes and Boma developments.
- Invitations to private events, launches and private-community openings.
- Internal statistical studies and improvement of the digital experience.
- Operation of the artificial-intelligence conversational assistant when the visitor chooses to interact with it.
If you do not wish your data to be processed for the secondary purposes, you may state so by sending an email to privacidad@yucatancountrylakes.mx. Refusal to process your data for secondary purposes will not be grounds to deny you the services or products requested.
4. Transfers of personal data
Your data may be transferred exclusively to the following third parties:
- Banco Invex S.A., Institución de Banca Múltiple, in its capacity as trustee of the project, for purposes of the trust operation and legal certainty of the purchase-and-sale transaction.
- HubSpot Inc. (United States) as CRM provider, under the applicable Data Processing Addendum.
- Odoo S.A. (Belgium) as ERP provider, under a processing agreement compliant with the GDPR and the LFPDPPP.
- Vercel Inc. (United States) as the site's hosting provider.
- Sanity.io (United States) as the site's editorial content manager.
- Sentry, Cloudflare, Google, Microsoft as providers of observability, CDN, analytics and anti-spam tools, under the privacy policies published by each provider.
- Tax, judicial or administrative authorities where there is a duly founded and reasoned request.
We do not sell, rent or trade your personal data with any third party outside the purposes described herein.
5. ARCO rights and revocation of consent
You have at all times the right of Access, Rectification, Cancellation and Objection (ARCO) to the processing of your personal data, as well as to revoke any consent you have granted.
How to exercise them: send an email to privacidad@yucatancountrylakes.mx with (i) a copy of your official ID, (ii) a clear and precise description of the request, and (iii) any other element that helps locate your data. We will respond within a maximum term of 20 business days in accordance with the LFPDPPP.
If you consider that your rights were not duly addressed, you may file a complaint before the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI): home.inai.org.mx.
6. Cookies and similar technologies
The site uses the following categories of cookies:
- Strictly necessary: they enable basic navigation and language persistence.
- Analytics: Google Analytics 4, Vercel Analytics and Microsoft Clarity, to understand how the site is used and to improve the experience. These can be disabled from your browser settings.
- Performance: Sentry to identify errors affecting your experience.
7. Security measures
Boma adopts reasonable administrative, physical and technical measures to protect your personal data, including encryption in transit (TLS), internal least-privilege access policies, strong passwords, periodic audits and confidentiality agreements with all our personnel and providers.
8. Data retention
We retain your data for the time necessary to fulfill the primary purposes for which it was collected, as well as for the applicable legal limitation period for the contractual relationships you have established with Boma. Once this period has elapsed, the data will be securely deleted or anonymized.
9. Data of minors
The site is not directed at minors. We do not knowingly collect personal data from persons under 18 years of age. If we detect the registration of a minor without their guardian's consent, we will proceed to delete it immediately.
10. Changes to the privacy notice
We reserve the right to update this notice. Any material modification will be announced on this same site at least 30 calendar days in advance and, where applicable, communicated by email to registered data subjects.
11. Data controller contact
For any questions about the processing of your data, write to us at privacidad@yucatancountrylakes.mx or by postal mail to the address indicated in section 1.