Comprehensive Privacy Notice

Godandi & Sons ("Godandi", "we" or "us"), based in Mexico City, is the data controller responsible for processing your personal data. This Comprehensive Privacy Notice is issued in compliance with Mexico's Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and other applicable law. By providing your personal data through our website or any official channel, you accept the terms described in this document.

Data you provide directly

When you book, create an account, or request an invoice, we collect the data you voluntarily give us:

• Full name
• Corporate email address
• Contact phone
• Pickup and drop-off addresses for the transfer
• Flight data (airline, number, time) when applicable
• Tax data (RFC, legal name, tax regime, CFDI use, tax ZIP code) — only if you request an invoice
• Passenger data, when you book for someone else

Automatically collected data

When you visit our site, we automatically collect:

• IP address and approximate location
• Browser type and version
• Device operating system
• Pages visited and time spent
• Referring website

Godandi does NOT collect, process, or store your payment card data (full card number, CVV security code, expiration date). Card payment processing is performed by PayPal Holdings, Inc. ("PayPal"), an independent payment processor certified under the PCI-DSS Level 1 standard.

Your card data is captured and transmitted directly from your browser to PayPal's servers, without at any point passing through Godandi's infrastructure. When you choose to save a card for future payments, PayPal stores it under its PayPal Vault service and provides us only with a secure identifier (token) associated with your account. That token cannot be used to reconstruct your card number and has no value outside PayPal's ecosystem.

PayPal's processing of your financial data is governed by its own privacy notice, available at: paypal.com/mx/legalhub/privacy-full

We use the information we collect to:

• Confirm, coordinate, and dispatch the transport service
• Process your payment through PayPal
• Issue and deliver digital tax invoices (CFDI 4.0) upon request
• Communicate with you about your reservations (email, WhatsApp, SMS)
• Prevent fraud, disputes, and misuse of the service
• Comply with legal, tax, and contractual obligations
• Send commercial communications, only if you give us your consent

Primary purposes (necessary)

These are indispensable to provide the service and do not require additional consent:

• Quoting, booking, and confirming transfers
• Payment collection and processing
• Operational notifications (driver assignment, changes, cancellations)
• Issuing tax invoices
• Post-sale support and incident resolution
• Accounting records and tax compliance

Secondary purposes (optional)

These require your explicit consent, and you may refuse them without affecting the service:

• Sending commercial communications, promotions, and surveys
• Behavioral analysis on the site to improve the experience
• Building aggregated commercial profiles

To provide the service we need to share some of your data with technology providers acting as data processors. Each one receives only the minimum data necessary for its function. Several are located outside Mexico; this international transfer is made under Article 37 Section V of the LFPDPPP (transfer necessary for the performance of the contract between the data subject and the controller).

What are cookies?

Cookies are small text files stored on your device when you visit our website. They help us keep your session active, provide a better experience, and understand how you use the site.

Types of cookies we use

• Essential cookies — required for the site to function (session, security, language preference). Cannot be disabled.
• Analytics cookies — help us understand how the site is used in aggregate. You can reject them from the banner.
• Marketing cookies — used to deliver relevant communications. Enabled only if you explicitly accept.

We apply reasonable technical, administrative, and physical measures to protect your data: mandatory HTTPS/TLS encrypted connections across the site, session authentication via HMAC-SHA256 signed cookies, payment tokenization via PayPal Vault (avoiding your card ever touching our servers), identity- and role-based access controls, integrity verification of incoming webhooks, and audit logs of sensitive events. No system is infallible; in the event of a security breach we will notify affected data subjects in accordance with the LFPDPPP.

We retain your personal data while your account remains active and it is necessary to provide the service. When you delete your account we remove direct identifiers (name, contact, browsable history) within the following 30 calendar days. Data linked to issued tax invoices is retained for 5 years from issuance, by legal obligation (Mexican Federal Tax Code, Article 30). PayPal Vault identifiers are deleted from our database when you delete your account; the card stored at PayPal must be removed directly from your PayPal account.

In compliance with the LFPDPPP, you have the right at any time to exercise the so-called ARCO rights:

• Access — know the personal data we hold about you and the conditions of its processing.
• Rectification — correct your data when it is inaccurate or incomplete.
• Cancellation — request that we delete it when you consider it is not necessary for the declared purposes.
• Opposition — refuse the use of your data for specific purposes.
• Consent revocation — withdraw the permission you have granted for the processing of your data.
• Limitation of use or disclosure — restrict the distribution of your data.

How to exercise your rights

Send your request to info@godandiandsons.com with the following:

• Full name and email address you registered with
• Right you are exercising (Access / Rectification / Cancellation / Opposition / Revocation / Limitation)
• Clear and precise description of your request
• Legible copy of a current official ID
• Any additional supporting document (optional)

We will respond to your request within a maximum of 20 business days from receipt, with the possibility of a 20-day extension when the complexity of the case justifies it. If approved, we will implement the change within the following 15 business days. Exercising your rights is free of charge; we may only charge justified shipping or reproduction costs.

Our service is intended exclusively for persons over 18 years of age. We do not knowingly collect personal data from minors. If we detect that we have received data from a minor without parental or guardian consent, we will delete it immediately. If you are a parent or guardian and discover that a minor in your care has provided us with data, contact us to have it removed.

We may update this Notice periodically to reflect changes in our practices or legal requirements. The last update date appears at the top of the document. Substantial changes will be notified at least 15 calendar days in advance by email or by a prominent notice on the site.

If you have questions about this Notice, doubts about the processing of your data, or wish to exercise your rights, contact us at: