Privacy Policy
This Privacy Policy explains how Mascotas Madagascar collects, uses, and protects your personal information in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP 2025). We are committed to transparency and lawful processing.
1. Data Controller
Madagascar Pet Hotel AGS, located at Teniente Juan de la Barrera 503, Colonia Héroes, Aguascalientes, Mexico, is the Data Controller responsible for processing your personal data in accordance with LFPDPPP.
Madagascar Pet Hotel AGS
Teniente Juan de la Barrera 503, Colonia Héroes, Aguascalientes, Ags., México
Email: team@madagascarhotelags.com
Phone: +52 449 448 5486
2. Legal Basis for Processing
We process your personal data based on your consent (provided when you make a booking), contractual necessity (to deliver the pet care services you request), legitimate interests (for security and fraud prevention), and legal obligations (for tax and regulatory compliance).
3. Data We Collect
We collect the following information when you use our services:
Information You Provide
- Your name and contact details (email, phone, address)
- Pet information including name, species, breed, age, and weight
Information Collected Automatically
- Device and browser information for security and fraud prevention
- Session data and usage patterns to improve our services (only with explicit consent)
- Network and interaction data for diagnostic and security routing purposes
4. How We Use Your Data
We use the personal data you provide for the following purposes:
For Your Booking
- Process and manage your pet's boarding reservation
- Send booking confirmations and care updates
- Process payments and issue invoices
For Security & Operations
- Protect against unauthorized access and fraud
- Maintain secure website sessions
- Improve our services using usage data (with explicit consent)
- Route traffic through managed proxies for performance and security delivery
For Legal Compliance
- Meet tax reporting and regulatory requirements
By submitting your booking and accepting our Terms, you consent to these uses as described in this Privacy Notice.
5. Data Processors & Service Providers
To deliver our services we rely on third-party providers (processors) that handle data on behalf of and under the instructions of Mascotas Madagascar, subject to Data Processing Agreements (DPA), described by functional category:
- Cloud hosting and network infrastructure (processing in the US and at global edge locations)
- Managed, encrypted database service (US)
- Transactional email provider (booking confirmations and notices)
- Business email provider (support and communication)
- Session management and rate-limiting service (anti-abuse)
- Usage analytics and error monitoring (analytics is enabled only with your consent; sensitive data is masked before processing)
- Managed proxy and edge infrastructure for performance and security
Data is primarily processed in the United States, protected by standard contractual clauses and encryption. A current list of the specific categories of providers is available on request through our Privacy Office.
By using this service, you acknowledge and consent that your data may be processed on secure servers located outside of Mexico (primarily in the United States) for the sole purpose of service delivery, protected by standard contractual clauses.
Domestic (Mexico)
- Authorized Facility Staff (Care purposes only)
- Veterinary Partners (Emergency only)
- SAT / Fiscal Authorities (Invoicing)
6. Data Retention
We retain your data only as long as necessary:
- Booking records: target 5 years (Fiscal code / SAT)
- Technical security attempt logs (raw IP/device data): target 90 days (Fraud prevention)
- Consent Receipts: target 3 years (Proof of consent)
- ARCO records: target 3 years (Legal compliance)
These are target retention periods, not automatic technical deadlines. Deletion of data past its target period occurs through a periodic manual review by authorized personnel, in line with our internal data-governance policy — never by an automated, unattended process. This ensures data relevant to an active legal, security, or fraud matter is never lost to a timer.
7. Your Rights (ARCO) & Revocation
Under LFPDPPP, you have rights to Access, Rectify, Cancel, and Oppose processing, plus the Right to Revoke consent at any time.
- Access (Acceso): Request a copy of your personal data.
- Rectification (Rectificación): Correct inaccurate or incomplete data.
- Cancellation (Cancelación): Request deletion (blocked period applies before final erasure).
- Opposition (Oposición): Object to processing for specific purposes (e.g., analytics).
Procedure:
- Submit request via our automated ARCO Portal or email team@madagascarhotelags.com
- For Revocation: Contact team@madagascarhotelags.com; our Privacy Office processes revocation requests manually and confirms once complete.
- We acknowledge within 5 days and resolve within 20 business days.
We maintain an append-only audit ledger of consent events. Revocation requests are logged and processed manually by our Privacy Office upon receipt.
8. Cookies & Telemetry
We apply a privacy-by-default approach:
- Strictly essential: session and security cookies (no consent required).
- Analytics and telemetry: disabled by default. Enabled only after your explicit consent through our banner.
You can withdraw analytics consent at any time by clearing your browser's local site data for this website (this resets your preference and the consent banner will reappear on your next visit), or by contacting team@madagascarhotelags.com to request removal of any associated analytics session data.
9. Security Measures
We apply multiple layers of security, including:
- Encryption: data is encrypted both in transit and at rest.
- Access control: strict record-level access controls and secure credential storage.
- Abuse protection: rate limiting and automated mechanisms to block brute-force attempts.
We use cloud infrastructure from third-party providers whose physical and operational security is managed under recognized compliance certifications (for example, SOC 2).
All staff with data access are bound by confidentiality obligations. Admin panel access is logged and monitored for security purposes.
No system is completely secure. We review and update our security measures periodically.
10. Breach Notification
In compliance with the LFPDPPP, in the event of a confirmed security breach that significantly compromises your personal or financial rights, we will:
- Notify You: Via email within 72 hours of confirmation.
- Report: To the competent Mexican data protection authority if legally required.
- Remediate: Immediately revoke compromised credentials and patch vulnerabilities.
Automated security blocks (e.g., failed login attempts) are considered successful defenses, not breaches, and will not trigger user notifications.
14. Security & Consent Verification
To ensure the integrity of consent and protect against fraud, we collect the following technical data when you interact with our consent mechanisms:
- IP address and network provider (ISP) for geographic and fraud-prevention verification
- Device characteristics (screen resolution, hardware specifications, timezone)
- On certain forms (such as bookings), field-interaction timing signals to help verify human activity
- A local consent preference stored in your browser to remember your choice for future visits
This data is collected for the sole purpose of:
- Verifying the authenticity of your consent declaration
- Defending against fraudulent claims of non-consent
- Maintaining secure audit trails as required by LFPDPPP Art. 7-9
15. Critical Administrative Auditing
To ensure platform integrity and prevent unauthorized access, we employ strict auditing of all critical system interventions:
- Audit Logging: Critical administrative actions are recorded in immutable audit logs for security and traceability purposes.
- Authorized Monitoring: By utilizing administrative accounts, users explicitly consent to this forensic monitoring. This data serves as a definitive legal audit trail to determine accountability in the event of system misuse.
- Access Control: These records are strictly confined to the Audit Logs and are accessible only to the Data Controller for security auditing and forensic reconstruction.
16. Processing on Secure External Infrastructure
For optimal resource management of some operational tasks:
- Background compute: we use secure third-party compute environments to run periodic operational tasks (for example, image optimization and scheduled synchronization).
- Security Guarantee: all data processed in these environments remains encrypted, and no personally identifiable information is exposed or persistently stored via these background tasks.
11. Privacy Office & Contact
Privacy Office:
ARCO Requests (Formal)
team@madagascarhotelags.com
Response: Max 20 days
Urgent Security Issues
Dog Hotel: Teniente Juan de la Barrera 503, Colonia Héroes 20190, Aguascalientes, México Cat Hotel: Aurora Boreal 508, Jardines del Sol 20266, Aguascalientes, México
12. Aguascalientes State Note
This policy applies to private data processing by Mascotas Madagascar under Federal Law (LFPDPPP). While we are located in Aguascalientes, we process data as a private entity. If we ever process data on behalf of public state bodies (e.g., government contracts), specific state transparency rules will be communicated separately.
13. Changes to This Policy
We reserve the right to update this policy. The current version is 3.1 (Effective: May 2026).
- Minor Changes: Will be posted here with a new date.
- Material Changes: Will be notified via email to active users prior to taking effect.
Continued use of the service after an update constitutes acceptance.
Authoritative Copy: A printed copy of this Privacy Notice is available for consultation at both of our facilities. Where the printed copy and this page differ, the version bearing the most recent effective date governs. Every updated version is published on this page, and the version applicable to the processing of your personal data is the one in effect at the time that data was collected.