Privacy
Last updated:
Master Privacy Policy — Entre Ceibas Ecosystem: entreceibas.com and app.entreceibas.com. Entre Ceibas, Sociedad Anónima — 31 Av. "C" 7-53, Colonia Centro América, Zona 7, Guatemala City.
1
Introduction and data controller
This Master Privacy Policy (the "Policy") describes how Entre Ceibas, Sociedad Anónima, a Guatemalan company (hereinafter "Entre Ceibas", "we", "us"), collects, uses, stores, shares, and protects the personal data of those who use the website entreceibas.com and the web application app.entreceibas.com (together, the "Ecosystem"), both operated and marketed under the Entre Ceibas brand. Entre Ceibas acts as the data controller for personal data collected directly through the Ecosystem.
Guatemala does not yet have a general personal data protection law in force (only bills currently pending before Congress). Entre Ceibas voluntarily applies in this Policy the principles of minimization, purpose limitation, transparency, and security, and adheres to the provisions currently in force in Guatemala: Title Three ("Personal Data Protection") of the Public Information Access Law (Decreto 57-2008), the constitutional right to informational self-determination (habeas data), the Consumer and User Protection Law (Decreto 6-2003), and the Law on the Recognition of Electronic Communications and Signatures (Decreto 47-2008).
2
Definitions
The terms "End User," "Organizer," "Merchant," "Event," "Curated Partner Catalog," and "Sensitive Data" have the meanings assigned to them in the Ecosystem's General Terms and Conditions of Use, which are incorporated into this Policy by reference.
3
Scope: one notice, two surfaces with different processing
This Policy is a single, unified notice: it governs the processing of data both on entreceibas.com (a static site, with no accounts of its own) and on app.entreceibas.com (with user accounts), as well as in the Ecosystem's technology integrations (Bókun, Recurrente, Supabase, Vercel, Netlify, GitHub, MapTiler, Resend, and Google Analytics). Because both surfaces collect data differently, this Policy describes them separately in Sections 4 and 5.
4
Data we collect on entreceibas.com (static site)
4.1 entreceibas.com is a static site: it has no user accounts or its own booking database. When you book an experience from the Curated Partner Catalog, your name, email, and payment details go directly to Bókun — a service operated by Tripadvisor LLC — our booking system, without being stored in Entre Ceibas's infrastructure. That transaction is governed by Bókun's own Terms of Service and Privacy Policy.
4.2 The site uses a cookie called ec_hint: if you're logged in on app.entreceibas.com, it displays your name as a greeting on entreceibas.com. It contains no access tokens and can be deleted without consequences.
4.3 If you accept analytics cookies, the site uses Google Analytics 4 to measure how it is browsed, in aggregate (Section 14). Until you accept, no analytics cookie is written, and you can change your decision at any time from Cookie preferences in the footer.
4.4 You can request access to, correction of, or deletion of your booking data by writing to soporte@entreceibas.com or via WhatsApp; Entre Ceibas will coordinate the request with Bókun, which holds that data.
5
Data we collect on app.entreceibas.com (user accounts)
| Category | Examples | Source |
|---|---|---|
| Account | Email address, password (hashed) | Registration via Supabase Auth |
| Profile | Display name, bio, photo, language, Instagram/WhatsApp (optional) | Profile settings |
| Identity and verification | Date of birth, national ID (DPI) or passport | Onboarding for Event registration |
| Sensitive Data | Blood type, allergies, medical conditions, emergency contact (name, relationship, phone) | Onboarding / Event registration |
| Location | Approximate or precise location (with device permission) | Interactive maps via MapTiler |
| Payment (once active) | Transaction status; full card data is captured and tokenized by Recurrente, not by Entre Ceibas | Checkout via Recurrente |
| Communications | Transactional emails and, with consent, newsletter | Sent via Resend |
| Minor's participation (no account) | Name, age, and, if the Event requires it, equipment size (bicycle or other gear). No email, password, or identity document | Provided exclusively by the parent or legal guardian when registering the minor for a family Event |
6
Purposes of processing
We use the data to: (a) create and manage your account; (b) verify identity and age for Event participation; (c) manage registrations and attendance; (d) contact you about activities and handle emergencies; (e) show nearby routes and locations; (f) process payments via Recurrente once active; (g) send transactional communications (confirmations, receipts, safety notices); (h) send marketing newsletters, only with separate express consent; (i) prevent fraud and maintain Platform security; (j) comply with legal obligations or requirements from competent authorities; (k) measure use of the Ecosystem in aggregate through analytics tools, only if you have accepted analytics cookies (Section 14); and (l) when a parent or legal guardian registers a minor for a family Event, use strictly the minor's name, age, and, where applicable, equipment size for that Event's capacity, equipment rentals, and raffles, with no direct marketing and no sale to third parties.
7
Legal basis for processing
We process data based on: (i) performance of the contract formed when you accept the Terms and register for an Event or book an experience; (ii) express consent, required in particular for Sensitive Data, analytics cookies, and marketing communications; (iii) Entre Ceibas's legitimate interest in the security and integrity of the Ecosystem; and (iv) compliance with legal obligations.
8
Processing of identification, health, and emergency data (Sensitive Data)
8.1
Data we collect for this purpose
When completing the verification process (onboarding) to participate in app.entreceibas.com Events, the Platform asks the End User, in addition to their account data, for: (a) date of birth; (b) national ID (DPI) or passport number; (c) a contact phone number; (d) blood type, allergies, and pre-existing medical conditions relevant to the activity, when the End User chooses to provide them; and (e) the name, relationship, and phone number of an emergency contact (together, the "Sensitive Data").
8.2
Special nature of this data
Although Guatemala does not yet have a general personal data protection law in force, Entre Ceibas voluntarily applies to Sensitive Data an enhanced level of protection, inspired by the principles of minimization, purpose limitation, security, and confidentiality set out in Title Three of the Public Information Access Law (Decreto 57-2008) and in the constitutional habeas data right recognized by Guatemala's Constitutional Court.
8.3
Consent
National ID (DPI)/passport, date of birth, and emergency contact are required fields to complete onboarding and to participate in Events that require them; allergies and medical conditions are optional to provide, though recommended for safety reasons. Collecting all of this data requires the End User's prior, express, and specific consent, given through independent consent checkboxes on the relevant screens, in accordance with Entre Ceibas's current consent traceability map.
8.4
Limited purpose
Sensitive Data is collected and used exclusively to: (a) verify identity and eligibility (age, one national ID per account) for Event participation; (b) allow an Event's organizing team, or emergency services, to act with the information needed in the event of an accident or medical emergency; and (c) meet insurance or authority requirements applicable to the Event. Sensitive Data is never used for marketing, advertising, or commercial profiling, and is never sold, licensed, or transferred to third parties other than those listed in this clause.
8.5
Limited disclosure to the specific Event's Organizer
An End User's Sensitive Data linked to registration for an Event is shared, in an automated manner, only with the Organizer of that particular Event (name, contact details, ID, date of birth, and health information of their own registered participants), and only for as long as necessary to organize, run, and handle emergencies for that Event. No Organizer has access to data belonging to participants who are not registered in their own Events. Entre Ceibas staff access to Sensitive Data is restricted through role-based technical access controls — Row Level Security policies in the Supabase database — that prevent an Organizer from viewing data belonging to participants of other Organizers' Events.
8.6
Specific security measures
Entre Ceibas stores Sensitive Data encrypted in transit (HTTPS/TLS) and at rest, on Supabase's database infrastructure, with authentication (Supabase Auth) and Row Level Security as the primary access controls. These controls are reviewed periodically, and retention of this data is limited to the period set out in Clause 8.7.
8.7
Retention period
Sensitive Data linked to a registration is retained for the duration of that registration and up to ninety (90) days after the Event ends, unless: (a) an incident, claim, or legal proceeding related to the Event is pending, in which case it is retained for the statute-of-limitations period applicable under the Guatemalan Civil Code; or (b) insurance or regulatory requirements require a longer period. Profile data (national ID, date of birth, emergency contact) linked to the account is retained while the account remains active, per Section 11.
8.8
End User rights over their Sensitive Data
You can access, correct, or request deletion of your Sensitive Data at any time from your profile on the Platform, or by writing to soporte@entreceibas.com. When it has already been lawfully shared with an Organizer for an ongoing or completed Event, deletion with respect to that Organizer must also be coordinated directly with them.
8.9
Authorization for emergencies
You expressly authorize that, in the event of a medical emergency during an Event, the Organizer and any first-responder personnel, authorities, or medical facilities involved may access your Sensitive Data and contact your emergency contact, without needing additional authorization at that moment, in protection of your own vital interest. It is your responsibility to keep this information current and accurate; Entre Ceibas will not be liable for consequences arising from incomplete, outdated, or false information.
9
Sharing data with third parties and data processors
9.1 Entre Ceibas shares personal data in the following cases:
- With Bókun (Terms · Privacy): name, email, and payment data for Curated Partner Catalog bookings on
entreceibas.com(Bókun processes the payment directly). - With the specific Event's Organizer: registration data and, where applicable, Sensitive Data, per Section 8. Also the name, age, and, where applicable, equipment size of minors a parent or legal guardian registered for that Event, solely for capacity, equipment rentals, and raffles (Section 15). That data is not sold and is not used for marketing.
- With Recurrente: data necessary to process payments on
app.entreceibas.com, once active. - With Supabase: database hosting and authentication (data processor).
- With Vercel and Netlify: technical hosting of the Platform (data processors).
- With MapTiler: location data necessary to render maps (data processor).
- With Resend: email address for transactional communications and, with separate consent, newsletters (data processor).
- With Google: aggregate usage data for the Ecosystem through Google Analytics 4, and only if you have accepted analytics cookies (data processor; see Section 14).
- With competent authorities: when there is a valid legal request.
9.2 Entre Ceibas requires these providers to meet reasonable confidentiality and security standards, and not to use the data for purposes other than those instructed, except for the independent use that Bókun and Recurrente make under their own privacy policies for processing bookings and payments, respectively. Entre Ceibas does not sell personal data to third parties.
10
International data transfers
The Ecosystem's technology infrastructure (Supabase, Vercel, Netlify, Resend, MapTiler, Bókun, Recurrente, Google) may host data on servers located outside Guatemala; in particular, Bókun is a service operated by Tripadvisor LLC, so Curated Catalog booking data may be processed on Tripadvisor's infrastructure, and analytics data is processed on Google's infrastructure, which operates servers in the United States and the European Union. By using the Ecosystem, you agree that your personal data may be transferred and processed internationally, subject to the security and contractual confidentiality mechanisms described in Section 9.2.
11
Retention period
11.1 Account and profile data is retained while the account remains active and for five (5) years after it is closed, unless a longer legal retention requirement applies (accounting or tax records).
11.2 Sensitive Data is governed by the specific period in Section 8.7.
11.3 Payment transaction data is retained per the periods required by tax regulations and by the respective processors (Bókun, Recurrente).
11.4 Event-level analytics data is retained per the period configured in the Google Analytics 4 property, which does not exceed fourteen (14) months; aggregate reports, which no longer allow you to be identified, may be retained longer. The ec_consent cookie, which records only whether you accepted or declined, expires after 180 days.
12
Information security
Entre Ceibas implements reasonable technical and organizational measures: encryption in transit (HTTPS/TLS), encryption at rest in Supabase, role-based access controls and Row Level Security, secure authentication via Supabase Auth, and periodic access reviews. No system is infallible; in the event of a security incident affecting personal data, Entre Ceibas will notify affected users and the competent authorities as required by applicable regulations, within a reasonable time.
13
Data subject rights (Habeas Data)
Under the constitutional habeas data right and the principles of the Public Information Access Law, you may at any time: (a) access your personal data; (b) correct inaccurate data; (c) request deletion of your data, subject to applicable legal or contractual exceptions; (d) object to processing for marketing purposes; and (e) withdraw your consent at any time, without retroactive effect. Exercise these rights from your profile or by writing to soporte@entreceibas.com. Entre Ceibas will respond within a reasonable time, aiming not to exceed 30 business days.
14
Cookies and tracking technologies
14.1 The Ecosystem uses the following cookies and storage technologies:
| Cookie / technology | Surface | Purpose | Type | Lifetime |
|---|---|---|---|---|
ec_hint | entreceibas.com | Display your name as a greeting if you are logged in on the app (Section 4.2) | Functional / necessary | Set by app.entreceibas.com |
ec_consent | Both | Remember whether you accepted or declined analytics cookies, so you are not asked again | Necessary (consent record) | 180 days |
_ga, _ga_<ID> | Both | Distinguish visitors and sessions for Google Analytics 4 | Analytics — requires your consent | Up to 2 years |
| Session local storage (Supabase Auth) | app.entreceibas.com | Keep you signed in | Necessary | While the session remains active |
14.2 Analytics (Google Analytics 4). Entre Ceibas uses Google Analytics 4, a service provided by Google Ireland Limited and Google LLC, to understand in aggregate how the Ecosystem is used: which pages are viewed, which country or region visitors come from, and which actions are taken (for example, opening an experience page or moving from the site to the app). Both surfaces share a single measurement property, so a journey between entreceibas.com and app.entreceibas.com reads as one visit rather than two unrelated ones.
14.3 What this analytics does not do. Entre Ceibas does not send Google your name, your email, your national ID (DPI) or passport, or any Sensitive Data. Google Analytics 4 does not store your IP address: it uses it to derive an approximate location and then discards it. Advertising signals (ad_storage, ad_user_data, ad_personalization) are permanently disabled: Entre Ceibas uses no advertising cookies, does no remarketing, and does not share this data for advertising purposes.
14.4 Consent. Analytics cookies are off by default. On your first visit you will see a notice that lets you accept or decline them; until you accept, Google Analytics writes no cookies or identifiers on your device (Google may receive a cookieless technical signal that cannot recognize you across visits). Your choice is stored in the ec_consent cookie and applies to both surfaces of the Ecosystem, so you are only asked once.
14.5 How to change your mind. You can give or withdraw your consent at any time from the Cookie preferences link in the footer, on both entreceibas.com and app.entreceibas.com. You can also delete or block cookies from your browser settings, or install the Google Analytics opt-out browser add-on. Declining analytics cookies does not limit any feature of the Ecosystem.
14.6 Cookies strictly necessary for the Platform to function do not require additional consent. For any other non-essential cookie or tool adopted in the future, Entre Ceibas will update this section and display a notice allowing you to accept, decline, or configure it.
15
Minors
15.1 You must be at least 13 years old to create an account on app.entreceibas.com. Persons aged 13 to 17 may only use the Platform with the knowledge and supervision of a parent or legal guardian, who must be involved in registration and in accepting this Policy, and who will be responsible for the accuracy of the data provided, including the minor's Sensitive Data. Contracting, booking, or paying requires being of legal age. Entre Ceibas does not allow a minor to create an account in order to take part in a family Event, and does not intentionally collect personal data directly from the minor; that participation is governed by Clauses 15.2 through 15.4.
15.2 Source of the data. Any information about a minor taking part in a family Event is provided exclusively by the minor's parent or legal guardian, when registering the minor for the Event or on site, while that adult is present. On-site listing does not proceed if that adult is not there. The minor does not complete the form, does not accept this Policy on their own, and receives no credentials. That data does not create an account or a user. It is limited to name, age, and, when the Event requires an equipment rental, the corresponding size or measurement (for example, a bicycle or gear). We do not ask for the minor's email, password, or identity document.
15.3 Limited purpose. That data is used strictly for that Event's logistics (setting capacity and headcount), for equipment rentals, and for the minor's participation in that Event's raffles, when there are any. It may be shared with that Event's Organizer solely for those purposes. It is not used to build a profile of the minor. The adult who provided it can correct or delete it from their registration, or write to soporte@entreceibas.com.
15.4 No marketing and no sale. Minors' data is not used for direct marketing, advertising, or newsletters, and Entre Ceibas does not sell, license, or transfer it to third parties for commercial purposes. Other than the account for persons aged 13 to 17 in Clause 15.1 and the family-Event data in Clauses 15.2 and 15.3, Entre Ceibas does not knowingly create accounts for children under 13 and does not collect a minor's data without the involvement of a parent or legal guardian. If we detect data or an account obtained without that involvement, we will delete it as soon as we become aware of it.
16
Marketing communications and newsletters
16.1 Entre Ceibas sends newsletters or promotions by email (via Resend) only to those who have given separate, express consent through the corresponding checkbox.
16.2 Every marketing email includes a clear, free mechanism to unsubscribe. Unsubscribing from the newsletter does not affect transactional communications necessary to perform the contract.
16.3 Minors are excluded. Minors' data described in Section 15 is excluded from all direct marketing communications, even if the adult account holder has accepted the newsletter.
17
Changes to this policy
Entre Ceibas may update this Policy at any time. Material changes — in particular, those affecting the processing of Sensitive Data or marketing purposes — will be notified through a prominent notice on the Platform or by email, and may require renewed express acceptance.
18
Contact and oversight authority
- Entre Ceibas, Sociedad Anónima
- Address: 31 Av. "C" 7-53, Colonia Centro América, Zona 7, Guatemala City, Guatemala.
- Support / privacy email: soporte@entreceibas.com
In the absence of a specialized personal data protection authority in Guatemala, you may turn to the Human Rights Ombudsman's Office (Procuraduría de los Derechos Humanos, PDH) on habeas data matters, or to the competent courts, without prejudice to contacting Entre Ceibas first to resolve any concern directly.
Provider documents referenced in this Policy:
- Bókun / Tripadvisor LLC (booking and payment processing for the Curated Catalog, Sections 4 and 9): Terms of Service · Privacy Policy