My Local Shuttle — Last updated: October 1, 2026

This Privacy Notice describes what personal data we process, for what purposes, with whom we share it, how long we keep it, and how you can exercise your rights over it.

1. Identity and address of the data controller

Servicios Administrativos Flamingos, S.A. de C.V. (hereinafter, "My Local Shuttle"), with address at Avenida 10, Manzana 35, Lotes 01 y 02, Interior 47, between streets 3 Bis and 5 Bis, C.P. 77710, Playa del Carmen, Municipality of Solidaridad, Quintana Roo, Mexico, and Federal Taxpayer Registry (RFC) SAF1401013B6, is responsible for the processing of your personal data.

For any matter related to this Notice you may write to us at info@mylocalshuttle.com.

2. Who this Notice is for

My Local Shuttle markets and coordinates ground transfers. This Notice explains how we process the personal data of passengers who book a transfer with us, whether directly on mylocalshuttle.com or its app, or through one of the platforms that operate with our network. The actual provision of the transfer corresponds to independent transportation companies, each with its own federal permit.

3. Personal data we process and purposes

The purposes described below are primary: they are necessary to provide the service and to comply with the obligations arising from it. We do not process your data for secondary purposes.

We process your first and last name, email address, phone number, flight number and time where applicable, meeting point, origin and destination of the transfer, number of passengers —including the number of minors, without collecting their name or age—, the comments you record about your trip, and the ratings you submit when it ends.

We use them to provide the transfer you booked, so the assigned driver knows where and when to pick you up, to send you your trip voucher and the invitation to rate the service, so you can track in real time the location of the vehicle picking you up, and to handle any clarification related to your trip.

4. Additional information for passengers

Source of your data and scope of our responsibility. If you booked your trip on another platform or agency, you did not provide your data to us directly nor did we sell you the trip: you provided it to the platform or agency where you booked it, and that party transmits it to us so we can provide the service. We are responsible for the processing we carry out with it, and you may exercise your rights directly before us. The way it was collected and the terms of your booking —changes, cancellations, refunds, and invoicing— are the responsibility of the platform that sold you the trip, in accordance with its own privacy notice. The actual provision of the transfer corresponds to an independent transportation company, with its own federal permit.

If you booked directly with My Local Shuttle. When you book your transfer on mylocalshuttle.com or on the My Local Shuttle app, we collect your data directly and are also the party that sells you the trip. Payment is processed as follows: if you are a Mexican customer, through Clip, and it is charged by Servicios Administrativos Flamingos, S.A. de C.V.; if you are a foreign customer, through PayPal, and it is charged by Garflo Inc., a company incorporated in the state of Texas, United States, with address at 3740 Colony Drive, Suite 244, San Antonio, Texas 78230. You provide your card or account details directly to Clip or PayPal: we neither receive nor keep them.

Information the driver can see. During the provision of the service, the assigned driver has access to your name, your phone number, and the comments you have recorded. They do not have access to your email address. If in the comments you include information about your health —an allergy, a mobility condition— that information will be known to the driver and their company, since it is what allows them to assist you properly.

Service rating. When the transfer ends, the driver may submit a rating and a comment about the service provided. This information is for internal use, is not published, and you may request access to it under the terms of section 8.

Validity of the links you receive. Your trip voucher and your invitation to rate are sent as links that do not require a password. The first expires thirty calendar days after your trip date and the second after ninety. While they remain valid, anyone who has the exact address can view them.

5. Transfers and disclosures of data

Your personal data is disclosed exclusively to the following recipients and for the purposes indicated:

Recipient	Data received	Purpose
Transportation company	Those necessary to provide the transfer	Actual provision of the service
Platform that marketed the trip	Transfer status, driver's name and photograph, vehicle license plate, and its exact location with estimated time of arrival	Inform the passenger during their trip
Amazon Web Services	Hosting of the database and files	Technology infrastructure
The Tour Agency	Recipient's address and message content	Delivery of our email
Mapping services (Google Maps, OpenStreetMap)	Pickup and destination addresses and coordinates. The identity of the person traveling is not disclosed to them	Locate the points on the map and calculate the route
Payment gateways (Clip and PayPal)	Amount, currency, and reference of the transfer. Payment details are provided by the data owner directly to the gateway: we neither receive nor keep them	Collection of My Local Shuttle sales and of payment-link charges: Clip for Mexican customers and PayPal for foreign customers
Garflo Inc. (Texas, United States)	Amount, currency, and reference of bookings paid by foreign customers	Collection, via PayPal, of My Local Shuttle sales to foreign customers. This entails a transfer to the United States

We do not sell personal data nor disclose it to third parties other than those indicated.

6. Retention periods

We keep personal data for the periods indicated, after which it is deleted or blocked through automated processes that run daily:

Data	Retention period
Bookings, including passenger data	10 years
Ratings: the score	Indefinite
Ratings: the written comments	10 years
Log of calls to our programming interface	90 days

The ten-year period responds to tax and reporting obligations, and covers the complete booking —including the information the passenger recorded when booking—, as it constitutes the record of the service booked and of its terms.

7. Processing we do not carry out

For greater clarity, we state that we do not carry out advertising nor use advertising identifiers; we do not measure user behavior through analytics or tracking tools; we do not access the device's contacts, messages, calls, calendar, microphone, or files; we do not process passengers' banking data; and we do not carry out profiling or automated decisions that produce legal effects.

8. Exercise of ARCO rights and revocation of consent

You have the right to know what personal data of yours we process and what we use it for (Access); to request its correction when it is inaccurate or incomplete (Rectification); to ask that we delete it when you consider it is not required for any of the stated purposes (Cancellation); and to object to its use for specific purposes (Objection). You may likewise revoke the consent you have granted us.

To exercise any of these rights, send your request to info@mylocalshuttle.com indicating your full name and the right you wish to exercise. Include with your request a copy of your valid official identification and, if you act through a representative, the document that proves such representation.

We will inform you of the decision adopted within a maximum of twenty business days counted from the day after we receive your request. That period may be extended once, and for up to ten additional business days, when circumstances justify it, notifying you within the original period. If your request is well founded, we will give effect to it within the fifteen business days following the date on which we communicate our response to you.

You may direct your request to us or to the platform where you booked your transfer; in any case we will coordinate the appropriate handling.

If you consider that your request was not handled properly, you may turn to the Secretaría Anticorrupción y Buen Gobierno (Mexico's Secretariat of Anti-Corruption and Good Governance), the competent authority for the protection of personal data held by private parties.

9. Amendments to this Notice

Any amendment to this Privacy Notice will be published at this same web address, updating the date shown in the header.

Check your booking