Cookie Policy

Last updated: 28 July 2026. Version 1.0.

1. Who is responsible

The data controller (also the «business» under California law and the «organization» under Canadian law) is Zihua Rooms & More, a vacation rental operation in Zihuatanejo, Guerrero, Mexico, running the website zihuarooms.com.

• Email: zihuarooms@gmail.com
• WhatsApp / phone: +52 755 105 7605

This policy explains the use of cookies and equivalent technologies on this website. It applies alongside any privacy notice we give you when you book or contact us.

2. What cookies and similar technologies are

A cookie is a small file a website stores in your browser. It can be used, for example, to recognise that two visits came from the same browser. Other technologies are not cookies but do something comparable by reading or writing information on your device — such as local storage (localStorage). This policy treats both the same way, because European electronic privacy rules and Quebec's Law 25 require it.

3. Exactly which cookies we use

3.1 Strictly necessary (always active)

To remember your cookie decision we use no cookie at all. Your choice is saved in your browser's local storage under the key zr_cookie_consent. That value stays on your device, is never sent to our servers or to third parties, and only records whether you accepted or declined, the date, the language and the notice version.

3.2 Analytics / measurement (optional, off by default)

Only if you accept do we load Google Analytics 4 through the Google tag (gtag.js) served from https://www.googletagmanager.com/. We do not use Google Tag Manager as a tag management system, nor any other third-party tool that sets cookies — that domain is simply where Google hosts the Analytics script.

If you decline, nothing is downloaded from Google. The tag is not loaded in some «anonymous mode»: the script is never requested, no connection to googletagmanager.com or to the Analytics servers is opened, and no _ga cookie is created. If you accepted earlier and later change your mind, we also delete any _ga cookies already in your browser.

3.3 What we do not do

• We use no advertising, remarketing or social network cookies.
• We do not enable Google advertising features or Google Signals: the configuration explicitly sends allow_google_signals: false and allow_ad_personalization_signals: false, and the ad_storage, ad_user_data and ad_personalization consent categories stay denied even when you accept measurement.
• We do not sell your personal information and we do not share it for cross-context behavioural advertising (the California definitions of «sale» and «sharing»).
• We do not build profiles or make automated decisions about you.
• Google Analytics 4 does not log or store your IP address: it uses it transiently to derive an approximate location (country, region, city) and then discards it.

4. What we use the data for

Measurement exists only to help us understand and improve the site. Specifically:

• Knowing how many people visit and which countries and languages they come from, so we can decide what to translate and maintain.
• Seeing which pages and which rentals (Casa Adriana, Casa Luna, Casa Tania) draw the most interest.
• Spotting slow pages, broken links, or steps where people get lost.
• Checking that the site works well on phones, tablets and computers.

If you accept, the categories of information collected are: online identifiers generated by Analytics, site activity data (pages viewed, clicks on contact buttons, gallery and share menu use), technical device and browser data, and approximate location derived from the IP address. We do not ask for or attach your name, email, phone number or payment details to this measurement, and we do not collect sensitive categories of personal information.

5. How we ask for permission and on what basis

We apply the same strict standard to every visitor, wherever they live: nothing runs before your decision, declining takes exactly the same effort as accepting (one click, on a button of the same size and colour), there are no pre-ticked boxes, and you can change your mind at any time.

European Union, European Economic Area, United Kingdom and Switzerland

Storing or reading information on your device requires your prior, freely given, specific, informed and unambiguous consent (Article 5(3) of the ePrivacy Directive 2002/58/EC and Articles 4(11) and 6(1)(a) of the General Data Protection Regulation). Strictly necessary cookies are exempt from that consent. Withdrawing consent is as easy as giving it and does not affect the lawfulness of earlier processing.

United States and California

This section serves as the notice at collection under the California Consumer Privacy Act as amended by the CPRA: section 4 lists the categories of information collected, what they are used for and how long they are kept. We do not sell or share personal information, including that of consumers under 16, and we do not use sensitive personal information to infer characteristics. Even so, we honour automated opt-out signals: if your browser or extension sends Global Privacy Control, we detect it and leave measurement switched off without you having to do anything. The same mechanism covers the opt-out right granted by other state privacy laws (Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with equivalent statutes). We will never treat you worse for exercising your rights.

Canada

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) we seek meaningful consent: we explain in plain language what is collected, what for and who receives it, before anything is switched on. For residents of Quebec, Law 25 additionally requires identification and tracking technology to be deactivated by default and the means of activating it to be disclosed: that is exactly how this site behaves, and the preference panel is that means.

Mexico

Under the Federal Law on Protection of Personal Data Held by Private Parties and its implementing rules, this document, together with the notice shown on arrival, satisfies the duty to disclose the use of remote or local mechanisms that automatically collect data while you browse, and how to disable them. You can disable them with the «Decline» button or from the preference panel, with no effect whatsoever on your use of the site.

6. Where your choice is stored

Your decision is stored in your browser's local storage, under the key zr_cookie_consent, containing: the notice version, whether you accepted measurement, how you did it (banner or panel), the language, and the date and time. That is what stops us asking you again on every visit.

• The decision is kept for 12 months; after that we ask once more.
• It is per browser and per device: on another machine, or in private browsing, you will be asked again.
• If you clear this site's data in your browser, the decision disappears and you will be asked again.
• If your browser blocks local storage everything still works, but the notice will reappear; until you accept, measurement stays off.

7. International transfers

If you accept measurement, the data is processed by Google (Google Ireland Limited for the European Economic Area, Switzerland and the United Kingdom; Google LLC elsewhere) and may be handled on servers outside your country, including in the United States. Google acts as a processor under the Google Ads Data Processing Terms applicable to Analytics, and covers those transfers with the European Commission's Standard Contractual Clauses, the supplementary measures it publishes, and its certification under the EU–US Data Privacy Framework with its UK and Swiss extensions. If you decline there is no transfer of any kind, because no connection to Google is ever made.

8. How long data is kept

• _ga and _ga_31N1YBWE7X cookies: up to 2 years in your browser, unless you delete them earlier or withdraw consent (in which case we delete them for you).
• Your cookie preference: 12 months in your browser's local storage.
• User and event data in Google Analytics: the period configured on our property, which never exceeds the 14 months Google allows. Aggregate reports (visits per page, per country, and so on) cannot identify you and may be kept longer.

9. Your rights, depending on where you live

You can exercise any of these rights by writing to zihuarooms@gmail.com. It is free, we answer within the deadlines set by the applicable law, and we will only ask for the minimum information needed to verify your request. You may act through a representative or authorised agent.

European Union, EEA, United Kingdom and Switzerland

Access, rectification, erasure, restriction of processing, portability and objection, plus the right to withdraw consent at any time. You may also lodge a complaint with the supervisory authority of your country of residence or work (for example the AEPD in Spain, the CNIL in France, the ICO in the United Kingdom or the FDPIC in Switzerland).

California and other US states

The right to know what personal information is collected and who it is shared with, to obtain a copy, to correct it, to request deletion, to opt out of any sale or sharing (although we carry out none), and to limit the use of sensitive personal information (which we do not collect). You will not be discriminated against for exercising them. We honour the Global Privacy Control signal as a valid opt-out mechanism. If a request is denied you may complain to the California Privacy Protection Agency or to the state Attorney General.

Canada

The right to access the personal information we hold about you, to have it corrected, to withdraw consent, and to receive an explanation of our practices. In Quebec, Law 25 adds the right to data portability and to request that dissemination cease or that content be de-indexed in certain cases. Complaints go to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

Mexico

ARCO rights: access, rectification, cancellation and opposition, plus withdrawal of consent and limitation of the use or disclosure of your data. Send your request to the email above, stating your name, a means of replying to you, documents proving your identity or representation, and a clear description of what you are asking for. If you believe your request was not properly handled, you may turn to the competent Mexican data protection authority.

10. How to change, withdraw or block

1. From this site (easiest): open cookie preferences. The change takes effect immediately; turning measurement off deletes any existing _ga cookies.
2. From your browser: Chrome, Firefox, Safari, Edge and Opera all let you view, delete and block cookies and local storage, generally under «Settings → Privacy and security». Clearing this site's data also clears your saved preference.
3. With Google's add-on: the Google Analytics Opt-out Browser Add-on blocks measurement on every site you visit.
4. With an automated signal: if you enable Global Privacy Control in your browser or an extension, we honour it automatically and do not show you the banner.

11. Children

This site is aimed at adults looking for accommodation and is not intended for children. We do not knowingly collect information from anyone under 16, and we do not sell or share the personal information of minors. If you believe a child has given us data, write to us and we will delete it.

12. Changes to this policy

If we change the tools or the purposes, we will update this page and the date above. If the change affects what you agreed to, we will raise the notice version and ask you again before anything new is switched on.

13. Contact

Questions about cookies or privacy? Write to zihuarooms@gmail.com or message us on WhatsApp at +52 755 105 7605. We are in Zihuatanejo, Guerrero, Mexico.