PRIVACY NOTICE

How we take care of your data.

At Rutas Better Together (“Rutas”) we value your trust. This notice summarizes what personal data we collect, what we use it for, who we share it with and how you can exercise your rights under the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

Important: this English version is provided for convenience only. The Spanish version is the legally binding text. In case of discrepancy, the Spanish version prevails.

1. Data controller

Rutas Better Together, with address at Av. Michoacán 128, Col. Hipódromo Condesa, Alcaldía Cuauhtémoc, C.P. 06100, Ciudad de México, is the party responsible for the use and protection of your personal data.

• Email: hola@rutascafe.cc
• Phone / WhatsApp: +52 1 55 4269 7900
• Address: Av. Michoacán 128, Col. Hipódromo Condesa, Alcaldía Cuauhtémoc, C.P. 06100, Ciudad de México

2. Personal data we collect

We collect only the information strictly needed for the purposes described below. Data is obtained directly from you when you register in our app, join the community chat, participate in rides or experiences, make purchases or browse the site.

• Identification: full name, date of birth.
• Contact: email, mobile phone, social media handles (e.g. Instagram) provided when joining the community chat.
• Emergency contact: name and phone of the person you designate. By providing this data you confirm you have their authorization to share it with us.
• Cyclist profile: cycling level, preferred modality (road, gravel, MTB), hobby information and experience reported when joining the community chat.
• Transactional: purchase history, reservations, billing data when requested.
• Browsing: IP address, device, cookies and site-usage data.

Credit and debit card details are captured and processed directly by Mercado Pago or Stripe within their PCI-DSS certified environments. Rutas never stores full card data.

We do not collect sensitive personal data (health, ethnic origin, political or religious beliefs, sexual orientation, etc.). If a specific experience requires health information, it will be requested through a separate specific privacy notice with your express consent.

3. Purposes of processing

Primary purposes (required for the relationship)

• Creating and managing your account and cyclist profile.
• Registering you for rides, experiences and community events.
• Attending emergencies during rides and experiences: in case of an incident we will use your data and your emergency contact's data to provide or request assistance, sharing only the information strictly necessary with paramedics, medical services, authorities or your emergency contact.
• Processing orders, payments, billing and delivery.
• Managing your Club Together membership, points and benefits.
• Handling your requests, complaints and exercise of privacy rights.
• Complying with applicable tax, accounting and legal obligations.

Secondary purposes (require your consent)

These are not necessary for the relationship; you may opt out at any time:

• Customer knowledge: usage pattern analysis and basic profiling to improve our products, routes and experiences.
• Marketing and advertising: communications about new rides, experiences, products, events and promotions via email, WhatsApp or social media.
• Personalized content and recommendations.
• Invitations to private community events.
• Satisfaction surveys and internal studies.

To opt out, email hola@rutascafe.cc with the subject “Opt-out secondary purposes”.

4. Data transfers to third parties

We share data with service providers acting as data processors on our behalf. All of them are contractually bound to use the information solely for the purposes we specify and to apply security measures equivalent to ours. The categories of recipients are:

• Cloud infrastructure, hosting and database providers, including authentication, storage and website delivery services.
• PCI-DSS certified payment processors: Mercado Pago and Stripe.
• Transactional and corporate email delivery providers.
• Restaurant point-of-sale system.
• Search, analytics and abuse-prevention tools (rate limiting, bot detection).

Some providers are located outside Mexico (mainly the United States and the European Union). By accepting this notice you acknowledge and consent to the international transfer of your data to these providers under contractual arrangements ensuring a level of protection equivalent to that required by the LFPDPPP. The specific list of providers is available upon written request at hola@rutascafe.cc.

We may additionally transfer your data without your consent in the cases provided by article 37 of the LFPDPPP (legal obligation, competent authorities, judicial order, protection of rights in court proceedings, life-threatening emergencies, etc.).

We do not sell your personal data.

5. Cookies and tracking technologies

We use cookies to keep your session active, remember your cart and preferences, analyze traffic and measure campaign performance. On your first visit we show a banner so you can accept or reject non-essential cookies. Essential cookies (cart, session, security) do not require consent. You can clear cookies from your browser settings at any time.

6. Privacy rights (ARCO)

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Cancel data when you consider it is no longer being used in line with LFPDPPP principles.
• Object to processing for specific purposes.

To exercise these rights, email hola@rutascafe.cc with your full name, registered email, the right you want to exercise and a copy of your official ID. We will respond within 20 business days and, if the request is valid, apply the change within 15 business days.

7. Withdrawal of consent

You may withdraw your consent at any time using the same channel. Withdrawal cannot have retroactive effect. Some processing is required to maintain the relationship and withdrawing it may end the service.

8. Security

We apply reasonable administrative, technical and physical safeguards to protect your data, including TLS encryption in transit, strong authentication, role-based access control, periodic backups and continuous security reviews.

9. Changes to this notice

We may update this notice to reflect legal, service or practice changes. Any update will be published at rutascafe.cc/privacidad with the updated date. Substantial changes will be communicated by email.

10. Competent authority

If you believe your privacy rights have been violated, you may file a complaint with the National Institute of Transparency, Access to Information and Personal Data Protection (INAI): home.inai.org.mx.

11. Acceptance

By registering in our app, joining the community chat, participating in rides or experiences, or using our website, you acknowledge having read and accepted this privacy notice.