Last updated: September 30, 2026
This is an English translation of the original Spanish version of our Aviso de privacidad, issued in compliance with the Mexican Ley Federal de Protección de Datos Personales en Posesión de los Particulares. In case of any discrepancy, the Spanish version prevails.
This Privacy Policy explains how Lucha Mexico Experience LLC collects, uses, shares and protects personal data when you visit luchamexicoexperience.com (the “Website”), contact us, or book and participate in our experiences (the “Experiences”). Because our Experiences are delivered in Mexico City, this Privacy Policy is also our comprehensive privacy notice (aviso de privacidad integral) issued in accordance with the Mexican Ley Federal de Protección de Datos Personales en Posesión de los Particulares (the “LFPDPPP”) and its applicable regulations. Where you are located in another jurisdiction, we also comply with the data protection laws that apply to you, as described below.
1. Data controller (Responsable)
The party responsible for the processing of your personal data (responsable, under the LFPDPPP) is Lucha Mexico Experience LLC, a limited liability company organized under the laws of the State of Delaware, United States of America, doing business as “Lucha Mexico Experience” (“LME”, “we”, “us” or “our”).
Mailing address: 21 SE 1st Avenue, 3rd Floor, Miami, FL 33131, USA.
Address in Mexico for operations and for all purposes of the LFPDPPP: Donceles 67, Centro Histórico, Alcaldía Cuauhtémoc, CP 06000, Mexico City, Mexico.
Privacy contact: alexis@luchamexicoexperience.com.
2. Personal data we collect
2.1 Data you provide to us. We collect identification and contact data (name, email address, phone or WhatsApp number, country and city of residence); booking data (Experience, date, number and names of participants, ages of minor participants, language preferences and special requests); data included in liability waivers (full name, signature and emergency contact); the content of your communications with us by email, WhatsApp, web forms, social media or booking platforms; and any reviews, photographs or other content you choose to share with us.
2.2 Sensitive personal data. We may ask for information about food allergies, dietary restrictions, relevant medical conditions and mobility or accessibility needs. Under the LFPDPPP, data about your present or future health status is sensitive personal data (datos personales sensibles). We collect it only to protect your safety and to adapt the Experience to your needs, and we process it only with your express consent, which we request at the moment we collect it. Providing it is optional, but if you do not provide it we may be unable to make the necessary adjustments. You may revoke that consent at any time as described in Section 9.
2.3 Payment data. Payments are processed by third party payment processors. We receive only limited information about your payment, such as the cardholder name, the last four digits of the card, the amount and the transaction status. We do not store full card numbers.
2.4 Data collected automatically. When you visit the Website, we and our service providers may collect technical data such as your IP address, browser type, device information, pages visited, referring website, approximate location and interactions with the Website, through cookies, pixels and similar technologies, as described in Section 8.
2.5 Data received from third parties. When you book through platforms such as Airbnb Experiences, the platform shares with us the information necessary to manage your booking, such as your name, contact details or platform messaging channel, number of participants, date and special requests, in accordance with the platform’s own privacy policy.
3. Purposes of processing
3.1 Primary purposes. We use your personal data for the following purposes, which are necessary to provide the Experiences and give rise to the legal relationship between you and LME: (a) to process and confirm your booking and purchase admission tickets; (b) to communicate with you before, during and after the Experience about logistics, the meeting point, schedules and changes; (c) to deliver the Experience, including adjustments for dietary, health or accessibility needs; (d) to process payments, refunds and credits in accordance with our Cancellation Policy; (e) to manage liability waivers, safety, incidents and emergencies; (f) to respond to your inquiries and complaints; (g) to comply with our legal, tax and accounting obligations; and (h) to protect our rights, prevent fraud and maintain the security of the Website.
3.2 Secondary purposes. We may also use your personal data for the following purposes, which are not necessary to provide the Experience but allow us to offer you better service: (a) to send you newsletters, promotions and offers related to LME; (b) to request reviews and invite you to satisfaction surveys; (c) to use photographs or videos of the Experience in which you appear in our promotional materials, as described in our Terms and Conditions; (d) to carry out statistical analysis to improve the Website and the Experiences; and (e) to show you advertising, including personalized advertising on social media and search engines.
3.3 How to refuse secondary purposes. If you do not want your personal data to be processed for any of the secondary purposes, you may tell us at any time by writing to alexis@luchamexicoexperience.com with the subject “Secondary purposes”, or by using the unsubscribe link in our emails. Refusing the secondary purposes will not be a reason to deny you the Experiences you book with us.
4. Consent and legal bases for processing
Under the LFPDPPP, by using the Website or providing your personal data after this Privacy Policy has been made available to you, you consent to the processing of your non sensitive personal data for the purposes described above, unless you express your objection. Your sensitive personal data is processed only with your express consent. If you are located in the European Economic Area, the United Kingdom or another jurisdiction that requires a legal basis for processing, we rely on the following: performance of a contract with you (to manage your booking and deliver the Experience); your consent (for sensitive data, marketing communications and non essential cookies); our legitimate interests (to improve our services, secure the Website, prevent fraud and, where permitted, send marketing to existing customers); and compliance with legal obligations (such as tax and accounting requirements).
5. Transfers and sharing of personal data
We do not sell your personal data. We share personal data only as necessary for the purposes described in this Privacy Policy, with the following categories of recipients: (a) booking platforms and reservation software providers, such as FareHarbor and Airbnb Experiences; (b) payment processors; (c) our hosts, guides and independent contractors who deliver the Experience, limited to the information they need; (d) venues, ticketing services, restaurants and transportation providers, when necessary to deliver the Experience, for example participant names for tickets or dietary needs for food stops; (e) providers of email, messaging (including WhatsApp, operated by Meta), website hosting, analytics and advertising services, such as Google and Meta; (f) professional advisors, such as accountants, lawyers and corporate service providers, bound by confidentiality obligations; (g) competent authorities, when required by law, to protect our rights or the safety of any person, or medical and emergency services in case of an emergency; and (h) a successor entity in the event of a merger, acquisition or sale of all or part of our business, which will be bound by this Privacy Policy.
Service providers that process data on our behalf act as processors (encargados, under the LFPDPPP), are required to protect it and may use it only to provide their services to us. The transfers described in this section are necessary to comply with the legal relationship between you and LME, are required by law, or are otherwise permitted without your consent under the LFPDPPP and other applicable laws. If in the future we need to make a transfer that requires your consent, we will request it before making it.
6. International transfers
Lucha Mexico Experience LLC is organized in the United States, our Experiences are delivered in Mexico, and our service providers may be located in the United States, Mexico and other countries. As a result, your personal data may be transferred to and processed in countries whose data protection laws differ from those of your country of residence. We will ensure that recipients are informed of this Privacy Policy and of the purposes to which you have consented. Where required by law, including for data originating in the European Economic Area or the United Kingdom, we rely on appropriate safeguards, such as standard contractual clauses offered by our service providers or other lawful transfer mechanisms.
7. Data retention
We keep personal data only for as long as necessary for the purposes for which it was collected. Booking and transaction records are kept for the period required by tax and accounting laws in the United States and Mexico, generally up to seven years. Liability waivers and incident records are kept for the period during which legal claims may be brought. Marketing data is kept until you unsubscribe or object. Sensitive data related to allergies, health or accessibility is deleted after the Experience, unless it is needed in connection with an incident or a legal obligation. Once the retention period ends, data is blocked and then securely deleted, as provided by the LFPDPPP.
8. Cookies, web beacons and similar technologies
The Website uses cookies, web beacons, pixels and similar technologies. Essential cookies are required for the Website and the booking system to function. Analytics cookies help us understand how visitors use the Website. Marketing cookies and pixels allow us and our advertising partners to measure campaigns and show relevant advertising. Through these technologies we may obtain data such as your IP address, browser type, pages visited, time spent on the Website and referring website. Third parties such as our booking software provider, Google and Meta may place cookies through the Website. You can manage or disable cookies through your browser settings and, where available, through the cookie banner on the Website. Disabling essential cookies may prevent the booking system from working correctly. There is currently no uniform standard for responding to browser “Do Not Track” signals, so the Website does not respond to them.
9. Your rights
9.1 ARCO rights under Mexican law. In accordance with the LFPDPPP, you have the right to know what personal data we hold about you and how we use it (Access); to request the correction of your data if it is outdated, inaccurate or incomplete (Rectification); to request that we delete your data from our records when you consider that it is not being used properly (Cancellation); and to object to the use of your data for specific purposes (Opposition). These are known as ARCO rights (derechos ARCO).
9.2 Revocation of consent. You may revoke the consent you have given us for the processing of your personal data at any time. Please note that in some cases we may not be able to process your request immediately, for example when we must continue processing your data to comply with a legal obligation, and that revoking your consent for primary purposes may prevent us from continuing to provide the Experience.
9.3 Limitation of use or disclosure. You may ask us to limit the use or disclosure of your personal data, in particular for the secondary purposes described in Section 3.2. If your request is granted, we will register you in our internal exclusion list so that your data is no longer used for those purposes.
9.4 Additional rights in the European Economic Area and the United Kingdom. If you are located in these jurisdictions, you also have the right to request the restriction of processing, to receive your data in a portable format, not to be subject to decisions based solely on automated processing, and to lodge a complaint with your local data protection supervisory authority.
9.5 Residents of the United States. Depending on your state of residence, you may have similar rights under applicable state law. We will honor such requests as required by law.
9.6 How to exercise your rights. To exercise your ARCO rights, revoke your consent, limit the use or disclosure of your data or exercise any other right described in this section, send an email to alexis@luchamexicoexperience.com with the subject “Privacy request” or “Solicitud ARCO”, including: (a) your full name and the email address or other means by which you wish to receive our response; (b) a copy of a government issued identification document or passport and, if you act through a representative, the documents proving the representation; (c) a clear and precise description of the personal data concerned and the right you wish to exercise; (d) in the case of rectification, the corrections requested and supporting documentation; and (e) any information that helps us locate your data, such as your booking reference.
9.7 Response times. If your request is incomplete or inaccurate, we may ask you for additional information within 5 business days of receiving it, and you will have 10 business days to provide it; otherwise, the request will be considered not submitted. We will inform you of our decision within 20 business days of receiving a complete request, or within any shorter period required by the law applicable to you, and if the request is granted, it will be made effective within 15 business days after our response. These periods may be extended once for an equal period when justified by the circumstances, as permitted by the LFPDPPP. Exercising your rights is free of charge, except for reasonable reproduction or shipping costs where permitted by law.
9.8 Complaints before the authority. If you consider that your right to the protection of personal data has been violated, you may file a complaint with the Mexican authority competent in matters of personal data protection, in addition to any authority competent in your country of residence.
10. Security
We implement administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction, and unauthorized use, access or processing, and we limit access to the people and service providers who need it. However, no method of transmission or storage is completely secure. If a security breach significantly affects your property or moral rights, we will notify you as required by the LFPDPPP and other applicable laws, so that you can take the necessary measures to protect your rights.
11. Minors
The Website is not directed to children, and we do not knowingly collect personal data directly from children under 13 years of age, or under 16 years of age in the European Economic Area. Personal data of minor participants is provided by their parent or legal guardian, who consents to its processing on their behalf. If you believe we have collected data from a child without proper consent, please contact us so that we can delete it.
12. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in the law, in our services, in our business model or in our privacy practices. The updated version will be published on this page with a new “Last updated” date. When changes are material, we will also notify you by email or through a notice on the Website, where appropriate.
13. Contact
For any question about this Privacy Policy, the processing of your personal data or the exercise of your ARCO rights, please contact:
Lucha Mexico Experience LLC
Email: alexis@luchamexicoexperience.com
Mailing address: 21 SE 1st Avenue, 3rd Floor, Miami, FL 33131, USA
Address in Mexico: Donceles 67, Centro Histórico, Alcaldía Cuauhtémoc, CP 06000, Mexico City, Mexico