Privacy Policy

Who We Are

Baja Below Surface operates dive trips, snorkel days and liveaboard expeditions out of La Paz, Baja California Sur, México, and is the party responsible for the personal data described here. Anything on this page — a question, a correction, a request to delete — reaches a person at dani@bajabelowsurface.com or on WhatsApp at +52 624 210 4724.

What We Collect, and Only When You Give It

Browsing this site collects nothing. There is no analytics, no advertising pixel and no tracker of any kind on these pages — the full account is in our Cookies Policy, linked below. You can read every page, look at every photograph and leave again without us learning that you were here.

Data reaches us at exactly one moment: when you send a booking request or write to us. That form asks for your name, email address and a phone number we can actually reach you on, the trip you are interested in, whether you want it shared or private, your preferred and alternative dates, how many people are coming, and anything you choose to write in the message field. We also record which language you were reading in, so we answer in the same one.

Health, Diet and Other Sensitive Details

Our terms ask you to tell us about medical conditions, allergies and dietary needs before you travel, and some of that is sensitive by any definition. We ask because it changes what we carry, how we plan the day and what is on the boat — not because we are curious. Share it in the message field or by email, and it goes to the people running your trip and nowhere else. If you would rather hand it over in person on the day, that is fine; tell us there is something and we will make the space for it.

Why We Hold It

To answer you, and to organise the trip you asked about — confirming a date, holding a place, telling you where the boat leaves from and when to be there.

To run the day safely, which is where the health and dietary information earns its place.

To keep the ordinary records a business has to keep about the trips it ran and the people who came on them.

That is the whole list. We do not use your details to market at you, we do not add you to a mailing list you did not ask for, and we do not build a profile of you.

Where It Lives

Booking requests are stored in a Postgres database hosted by Supabase; the site itself and the photographs on it are hosted by Vercel. Both are established infrastructure providers acting on our instructions, and both run on servers outside México — principally in the United States. If you are writing to us from the European Union or the United Kingdom, that is an international transfer, and it happens because it is necessary to handle the booking you asked us to handle.

When you reach us on WhatsApp or by email instead of the form, that conversation lives with WhatsApp and with our email provider under their own terms, exactly as any message to any business does.

What the Server Sees

Every website sees the IP address of the computer talking to it; ours is no exception, and there is no way for it to be. We use yours for one thing — noticing when the same connection fires the booking form over and over, which is what a bot does and what a guest never does. It is held in memory for a matter of minutes and is never written into your booking or kept anywhere we could look it up later.

Who Ever Sees It

The people who need to: the small team who reply to bookings, and the captain and guides taking you out that day. Our hosting providers hold the data on our behalf and are not permitted to use it for anything of their own. Beyond that, nobody — unless a Mexican authority requires it of us by law, which has not happened and would be a narrow disclosure if it did. We have never sold personal data and will not.

How Long We Keep It

Booking records stay while your trip is ahead of you and afterwards for as long as we may reasonably need them — an insurance question, a tax record, a guest who comes back the following season and would rather not repeat themselves. Enquiries that never became a trip are of no use to us; ask and they are gone. If you would rather we did not keep your record after your trip, say so and we will delete it.

Your Rights Over It

You can ask us what we hold about you and get a copy of it. You can have it corrected if we have it wrong. You can have it deleted, object to what we are doing with it, or withdraw a consent you gave earlier — under Mexican data protection law these are your ARCO rights, and if you are in the EU or UK the GDPR gives you the same set plus the right to have your data handed over in a portable form.

The way to use any of them is to email us and say so, in whatever words come naturally. We do not need a form. Expect a reply within a few days and the thing itself done within twenty days at the outside. There is no charge. If we ever get it wrong and cannot put it right between us, you can complain to your national data protection authority — in México, the successor body to the INAI.

Children

This site is not aimed at children and we do not knowingly collect their data. Guests under 12 come on a trip with an adult, who books and signs on their behalf; anything we hold about a young guest reaches us through that adult and is treated exactly as their own details are. If you believe a child has sent us something directly, tell us and we will remove it.

Keeping It Safe

Traffic to this site is encrypted in transit. The private portal is protected by a signed, HttpOnly session cookie rather than anything readable, and access to the booking inbox is limited to the people who answer it. None of which is a guarantee: no system carrying data across the internet is perfectly secure, and anyone who tells you otherwise is selling something. What we can promise is that we hold as little as the job requires, and that if a breach ever affected you we would tell you rather than hope you did not notice.

Photos and Video

We shoot on trips, and sometimes those images show guests. How that works — and how to tell us you would rather not appear — is set out under Photos & Video in our Terms & Conditions. A request to be left out is honoured, before the trip or after it.

Cookies

Short version: this site sets no tracking cookies at all, and the only optional thing on it is the Google map on our charter page. The complete list of what is stored in your browser, and the switch that controls it, is in our Cookies Policy.

Changes to This Policy

When this policy changes, the new version goes up here and the date at the top moves with it. A change that would mean using your data for something materially new gets your say first — we would ask, not assume.

Contact Us

Anything at all — dani@bajabelowsurface.com, or WhatsApp +52 624 210 4724. A real person reads both.