Last updated: 2026-05-24

Privacy Policy

Maya Ocean Real Estate S.A. de C.V. ("Maya Ocean", "we", "our", or "us") respects your privacy. This Privacy Policy explains what personal information we collect through mayaocean.com (the "Site"), how we use it, with whom we share it, and the rights you have over it.

This Policy is issued in accordance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP"), the EU General Data Protection Regulation ("GDPR") for visitors located in the European Economic Area and the United Kingdom, and the California Consumer Privacy Act, as amended by the CPRA ("CCPA"), for residents of California.

Effective date: 2026-05-24

1. Data controller

The data controller responsible for the processing of your personal data is Maya Ocean Real Estate S.A. de C.V., with its registered office at Calle 3 Sur & 40 Avenida, Playa del Carmen, Quintana Roo 77710, Mexico. You can contact us at info@mayaocean.com or +52-984-242-0075.

2. What personal data we collect

We collect only the information needed to respond to your inquiries and operate the Site:

• Lead form data: full name, email address, and phone number that you voluntarily submit through our contact, callback, or property-request forms.
• Inquiry context: the listing, development, city, or page you were viewing when you submitted a form, plus any free-text message you choose to add.
• Technical and usage data: IP address, approximate location derived from IP, browser type and version, device type, the pages you visit, the referring URL, and timestamps. This data is collected automatically through cookies and similar technologies (see our Cookie Policy).
• Attribution data: the marketing source that brought you to the Site (utm_source, utm_medium, utm_campaign) and broker referral identifiers, stored in first-party cookies.

We do not knowingly collect government identifiers, payment card numbers, bank account numbers, or other sensitive financial data through the Site.

3. How we use your data

We process your personal data for the following purposes:

• To respond to your inquiry, send you information about properties or developments you asked about, and arrange viewings or consultations.
• To send you market updates, new-listing alerts, and editorial content relevant to Riviera Maya real estate, where you have given consent or where this is permitted under applicable law as a soft opt-in for similar services.
• To operate, secure, and improve the Site, including analytics, debugging, fraud prevention, and protection against abuse.
• To comply with our legal and regulatory obligations and to establish, exercise, or defend legal claims.

4. Legal bases for processing (GDPR)

For visitors in the EEA and the UK, we rely on the following legal bases under Article 6 GDPR:

• Consent for marketing communications and for non-essential cookies.
• Performance of a contract or pre-contractual steps when you request information about a property in view of a possible purchase.
• Legitimate interests in operating, securing, and improving the Site, in following up on commercial inquiries, and in preventing fraud. We balance these interests against your rights and freedoms.
• Legal obligation where we must retain or disclose data to comply with applicable law.

5. Who we share your data with

Maya Ocean acts as a broker connecting buyers with verified real-estate developments in Riviera Maya. When you submit a lead form for a specific property or development, you explicitly request that we forward your contact details to the relevant developer or seller so they can follow up. We share your data in the following situations only:

• Developers and property owners for the specific listing or development you have asked about, after you submit a request that makes this purpose clear at the point of collection.
• Service providers that host the Site, run our email and CRM systems, perform analytics, send transactional messages, and provide customer support. These providers act as our processors and are bound by written agreements that restrict them to processing your data only on our instructions.
• Public authorities when disclosure is required by law, court order, or to protect our legal rights.
• Corporate transactions in the event of a merger, acquisition, or sale of all or part of our business, in which case your data may be transferred to the successor entity subject to this Policy.

We do not sell your personal information for money. We do not share your personal information with third parties for their independent cross-context behavioural advertising. Where third-party advertising pixels are loaded on the Site, they are described in our Cookie Policy and can be opted out of through your browser or the third party's own controls.

6. International transfers

Maya Ocean is established in Mexico. Some of our service providers are located outside Mexico, the EEA, or the UK. When we transfer personal data internationally, we rely on adequacy decisions where available, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards permitted under LFPDPPP.

7. Retention

We keep your personal data only for as long as necessary to fulfil the purposes set out above:

• Active lead and inquiry data: up to twenty-four (24) months from your last interaction with us.
• Marketing subscribers: until you withdraw consent or after twenty-four (24) months of inactivity, whichever comes first.
• Closed transactions: for the period required to comply with our commercial, tax, and accounting obligations under Mexican law (generally up to ten (10) years).
• Technical logs and analytics: typically up to fourteen (14) months in identifiable form, then aggregated or deleted.

When the retention period ends we will delete, anonymise, or securely archive your data in accordance with our internal retention schedule.

8. Your rights

Depending on where you live, you have one or more of the following rights:

• Access (ARCO/GDPR/CCPA): obtain confirmation of whether we process your data and receive a copy of it.
• Rectification (ARCO/GDPR): correct inaccurate or incomplete data.
• Cancellation or deletion (ARCO/GDPR/CCPA): request that we delete data we no longer need or for which you withdraw consent, subject to legal retention obligations.
• Opposition (ARCO/GDPR): object to processing based on legitimate interests, including direct marketing.
• Restriction (GDPR): ask us to restrict processing in specific cases.
• Data portability (GDPR/CCPA): receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Opt out of sale or sharing (CCPA): we do not sell or share personal information for cross-context behavioural advertising in the meaning of the CCPA, but you may still submit a request and we will respond.
• Non-discrimination (CCPA): we will not deny you goods or services, charge a different price, or provide a different level of quality because you exercised any of your rights.

9. How to exercise your rights

To exercise any of the rights above, please send a written request to info@mayaocean.com with the subject line "Privacy request". Please tell us which right you wish to exercise and provide enough information for us to verify your identity. We will respond within the deadlines set by applicable law (twenty (20) business days under LFPDPPP, one (1) month under GDPR, and forty-five (45) days under CCPA, each subject to permitted extensions).

In Mexico, you also have the right to file a complaint with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI). In the EEA or the UK, you have the right to file a complaint with your local supervisory authority. In California, you have the right to contact the California Privacy Protection Agency.

10. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. No method of transmission over the internet is fully secure, so we cannot guarantee absolute security.

11. Children

The Site is not directed to children under eighteen (18) and we do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at info@mayaocean.com and we will delete it.

12. Cookies and similar technologies

We use first-party and third-party cookies to operate the Site, measure its performance, and remember your marketing attribution. For details about each cookie we set, its purpose, and how to disable cookies, please read our Cookie Policy.

13. Updates to this Policy

We may update this Policy from time to time. When we make material changes, we will revise the "Last updated" date at the top of the page and, where appropriate, notify you by email or through a notice on the Site. We encourage you to review this Policy periodically.

14. Contact us

Maya Ocean Real Estate S.A. de C.V.
Calle 3 Sur & 40 Avenida, Playa del Carmen, Quintana Roo 77710, Mexico
Phone: +52-984-242-0075
Email: info@mayaocean.com