Privacy notice

Effective date (last updated): 2026-11-03

This notice is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, published in the DOF on 2025-03-20, last amended DOF 2025-11-14). It also serves as our privacy policy for visitors from California (CalOPPA). It explains how we process your personal data when you use https://www.enkanto.mx, book a stay or contact us. If this English version and the Spanish aviso de privacidad differ, the Spanish version governs.

1. Who is responsible for your data

Viñedos En’kanto (“Viñedo En’kanto”), with its address at Calle Plata S/N, Villa de Juárez, San Antonio de las Minas, Ensenada, Baja California, C.P. 22766, Mexico, is the data controller (responsable) for your personal data.

Personal data contact (art. 29): Viñedo En’kanto, email enkanto.mx@gmail.com, phone +52 (646) 385 9931.

2. Personal data we collect

• Identity and contact: name, email address and phone number.
• Booking data: arrival and departure dates, number of guests, arrival time, comments and billing postal code.
• Invoicing data, if you ask for an invoice: RFC, legal name, tax regime and CFDI use.
• Browsing data: IP address, browser type and pages visited (see section 8).

Sensitive personal data. We do not collect sensitive personal data through this site. Please do not include it in your messages or in your booking comments. If we collect sensitive data, we process it only with your express written consent, given by handwritten signature, electronic signature or the authentication method we tell you (art. 8).

Financial or patrimonial data. Your card details go directly to the Beds24 booking engine when you book a room, or to Stripe when you pay in the online shop. We do not store them on this site. When we process financial or patrimonial data, we ask for your express consent (art. 7).

3. Why we use your data

Primary purposes. These are necessary for your relationship with us and do not need separate consent:

• answer your messages and requests, including event requests;
• manage your booking and your stay, and charge for it;
• process and deliver your online shop orders, when the shop is open;
• issue your invoices;
• meet legal obligations.

Secondary purposes. These are not necessary for the relationship and require your consent. You can refuse them and the primary purposes are not affected:

• measure use of the site with analytics (Jetpack Stats and WooCommerce Analytics, by Automattic), only if you accept analytics cookies.

If you do not want us to use your data for this secondary purpose, choose “Decline” in the cookie notice or in “Cookie preferences” at the foot of every page, or at any time follow the procedure in section 5.

4. How to limit the use or disclosure of your data

• by writing to enkanto.mx@gmail.com with the subject “Limit use of data”;
• by refusing or withdrawing, at any time, analytics cookies in “Cookie preferences” at the foot of every page;
• by registering your Mexican phone number in PROFECO’s Public Registry to Avoid Advertising (REPEP), https://repep.profeco.gob.mx, to stop marketing calls and messages.

5. Your ARCO rights, and how to review or change your data

You have the right to Access your data, Rectify it, Cancel it (deletion) or Oppose its processing (ARCO rights), and to revoke any consent you gave us (art. 7). This is also how you review and request changes to your personal data.

How. Send your request to enkanto.mx@gmail.com or to our address.

What the request must include (art. 28).

1. Your name and an address or email to receive the answer.
2. Documents that prove your identity (e.g. a copy of an official ID) or, if a representative acts for you, the representative’s authority and identity.
3. A clear description of the data the request covers (not needed for access).
4. The right you exercise or what you ask for.
5. Anything else that helps us find your data.

For rectification, also state the changes and attach the document that supports them (art. 30).

Deadlines (art. 31). We send you our answer within 20 days of receiving your request. If the request is granted, we carry it out within 15 days of the answer. We deliver data for an access request after we verify your identity. We may extend these deadlines once, for an equal period, when the circumstances of the case justify it; if we do, we tell you within the original deadline.

Cost (art. 34). Exercising ARCO rights is free. We may charge only the cost of reproduction, copies or shipping.

Revoking consent. Follow the same procedure with the subject “Revocation”. Revocation is not retroactive, and we may be unable to keep providing a service that needs that data.

Complaints. If you disagree with our answer, or receive none in time, you can start a rights protection procedure before Mexico’s Secretaria Anticorrupcion y Buen Gobierno (Anti-Corruption and Good Governance Ministry) within 15 days of our answer, or once the answer deadline has passed (arts. 40 and 41).

6. Changes to this notice

We may change this notice when the law, our services or our practices change. We publish each version at https://www.enkanto.mx/privacy-notice/ with its effective date.

7. Who we share your data with

Processors. To run the site, these third parties process data on our behalf and only for the purposes in this notice:

• Beds24 (Germany): room booking engine and booking payment.
• Hosting.com (United States): hosting for the site and the domain’s email.
• Google (United States): email (Gmail) we use to receive and answer your messages, the location map (Google Maps) and fonts (Google Fonts).
• Automattic (United States): Jetpack, which delivers the site’s images and files and protects it; Akismet, a spam filter; and, only with your acceptance, the analytics in section 3.
• Stripe (United States): online shop payments.

Transfers. We do not transfer your personal data to third parties, except the transfers the law allows without your consent (art. 36), such as those a competent authority requests. Those transfers do not require your consent (art. 36). We give each recipient this notice and its purposes (art. 35).

8. Cookies, web beacons and similar technologies

• Necessary: language preference, shop cart and the record of your cookie choice (the last one is kept in your browser, not in a cookie). They cannot be turned off on the site.
• Analytics: Jetpack Stats and WooCommerce Analytics, by Automattic, collect your IP address, pages visited, time of visit and device and browser type. We do not use advertising cookies.

We do not turn on analytics cookies before you accept them. You can withdraw your acceptance in “Cookie preferences” at the foot of every page, and you can block or delete cookies in your browser settings.

9. Do Not Track signals and tracking across sites

When your browser sends a Do Not Track (DNT) or Global Privacy Control signal, we treat it as a refusal of analytics and advertising cookies.

Only after your acceptance, Automattic (Jetpack Stats and WooCommerce Analytics) may collect data about your activity on this site. We do not allow other third parties to collect personal data about your online activities over time and across different websites.

10. Security

We apply administrative, technical and physical security measures to protect your data, including encrypted connections (HTTPS) and access limited to those who need it.