Privacy notice

Which personal data we process, why, and how you can exercise your rights.

Data controller

Who processes your data.

Luxury Sustainable Hotels, A.C. (LUSHIA), a non-profit civil association with tax ID LSH220719KH8, based in Playa del Carmen, Quintana Roo, Mexico, is responsible for the personal data you give us through this website, under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties.

For anything about your data, email info@lushia.org. This is a translation; the Spanish version prevails.

Version 1.0 · October 2026

Data we process

Only what you give us when you write.

When you use the collaboration form or the values assessment, we process:

• Identification and contact data: name, email, country and, if you give it, your organization.
• Profile and interests: the kind of person or organization you are and why you are contacting us.
• The answers you write: your message, how far you share our values, your commitments and, for organizations, their practices and whether they have had labour or environmental sanctions.
• The minimal technical data every visit generates (IP address, browser, date and time), which our hosting provider uses to keep the site secure.

We do not ask for sensitive personal data. Please don’t include it in your messages.

Purposes

What we use it for.

We use your data for these purposes, which are needed to handle your request:

• Replying to your message and following up.
• Reviewing your values assessment and deciding whether we can work together.
• Managing your involvement as a member, volunteer, intern, partner or sponsor, if that happens.
• Protecting the site from abuse and meeting legal obligations.

We do not use your data for advertising, we do not sell it and we do not build automated profiles. If we ever want to send you news about our programmes, we will ask for your consent separately first.

Sharing and providers

Who it is shared with.

We do not transfer your data to third parties without your consent, except where the law allows it or a competent authority requires it.

To run the site we rely on providers that process data on our behalf and on our instructions: Cloudflare (hosting and site security) and our email provider (sending and receiving messages). The site loads its fonts from Google Fonts, so your browser shares your IP address with Google when you visit. Some of these providers may process data outside Mexico.

Your rights

Access, rectification, cancellation and objection.

You can access, correct or delete your data, object to its use (ARCO rights), withdraw your consent or limit how we use it. To do so, email info@lushia.org with the subject “ARCO rights” and include:

• Your name and a way to contact you.
• A document proving your identity or, where relevant, your legal representation.
• A clear description of the data and the right you want to exercise.

We will reply within 20 business days and, if your request is upheld, act on it within the following 15 business days. If you think your request has not been handled properly, you can contact the competent data protection authority.

Retention and security

How long we keep it.

We keep your data only as long as the purposes above require and then delete it securely, unless a legal obligation requires us to keep it longer. We apply reasonable administrative, technical and physical safeguards, and only the team members who need your data can access it.

This site does not use advertising or analytics cookies.

Minors and changes

Other points.

If you are under 18, please ask a parent or guardian to contact us on your behalf.

We may update this notice. Any change will be published on this page with its date.

Collaborate

Let's join forces for training in destinations.

See our membership options for individuals and organizations →

Prefer email? Write to us at info@lushia.org · Playa del Carmen, Quintana Roo, Mexico