Privacy Policy.

Mortenson Ranch ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you visit our website, book an experience, attend an event, or otherwise interact with us.

This policy applies to information we collect online and in person at our property in Santa Fe, New Mexico. By using our website or services, you agree to the practices described here.

This Privacy Policy applies to:

• Visitors to mortensonranch.com and any associated digital properties
• Guests booking horseback rides, ranch tours, and ranch experiences
• Couples, vendors, and guests involved in weddings and private events
• Production companies, crews, and talent filming on the ranch
• Anyone who contacts us via phone, email, social media, or in person

This policy does not apply to third-party websites or services we link to. Those are governed by their own privacy policies, which we encourage you to review.

Information you provide directly:

• Contact details — name, email, phone, mailing address
• Booking details — guest counts, dates, dietary needs, accessibility requirements
• Payment information — processed securely by Shopify Payments and Stripe; we do not store full card details on our systems
• Health & safety information — riding experience, height and weight (for proper horse pairing), relevant medical conditions, emergency contacts, signed waivers
• Wedding & event details — ceremony plans, guest lists, vendor contacts, timelines, and special requests
• Production details — production company info, crew rosters, shoot schedules, location release forms, insurance certificates
• Photos & footage — content you submit, or that is captured during your visit (with consent for marketing use)
• Communication content — emails, texts, voicemails, and inquiry-form submissions

Information collected automatically when you visit our website:

Browser type, operating system, and device information. Pages visited, time on site, and referring URLs. IP address and general location (city or region derived from IP). Cookie identifiers and analytics signals from Google Analytics and similar tools.

Information from third parties:

We receive information from booking and payment platforms, marketing platforms reporting on ad performance, vendors (wedding planners, production coordinators) who provide guest information for events they're managing on your behalf, and public sources such as business directories.

• Process bookings, manage reservations, and communicate about your visit
• Coordinate health and safety, including horse pairing and emergency response
• Host film productions, weddings, and private events on your behalf
• Respond to inquiries and provide guest support
• Send updates about the ranch, seasonal availability, and news (you may opt out at any time)
• Personalize and improve our website and guest experience
• Measure marketing performance and reach new audiences
• Maintain accounting, tax, and insurance records
• Comply with legal obligations and protect the safety of guests, staff, and animals
• Defend against legal claims and resolve disputes

We share your information only in the following circumstances:

• Service providers: Shopify (e-commerce, hosting), Shopify Payments and Stripe (payments), Google Analytics (site analytics), Meta and Google advertising platforms (marketing), our email service provider, and other vendors who help us operate. All are bound by confidentiality and data-handling obligations.
• Wedding & event partners: Caterers, florists, planners, photographers, and other vendors who receive guest information solely to perform their services for your event.
• Production partners: When working with film clients, we coordinate with their production teams. When filming for our own marketing, we coordinate with our creative agency.
• Legal & safety: When required by law, court order, subpoena, or to protect rights, property, or safety — including disclosure to law enforcement, insurers, attorneys, and emergency responders.
• Business transfers: If the ranch is sold, merged, or restructured, your information may transfer as part of that transaction. We will notify you and continue to apply this policy.
• With your consent: For any other purpose we disclose at the time we ask for your information.

We use cookies and similar technologies to operate the site, understand how it's used, and reach the right audiences with our marketing.

• Essential: Required for core functionality (cart, login, security, fraud prevention)
• Analytics: Google Analytics 4 — helps us understand site usage in aggregate
• Marketing: Meta (Facebook/Instagram) Pixel and Google Ads tags — measure campaign performance and serve relevant content
• Embedded content: Cookies set by third-party players, maps, and social embeds — governed by their own policies

You can manage cookies through your browser settings, our cookie banner where displayed, or the opt-out tools provided by individual ad networks (such as Network Advertising Initiative, Digital Advertising Alliance, and Your Ad Choices). Disabling certain cookies may affect site functionality.

Mortenson Ranch is a working film and visual environment. Photography and videography happen regularly — by us for marketing and editorial use, by guests, by hired vendors, and by production crews on rented shoot days.

• We photograph and record general activity at the ranch for our website, social channels, and printed materials
• When we plan to feature an identifiable guest in our marketing, we will ask for your consent
• Wedding photography and videography are arranged by your hired vendors; their handling of footage is governed by your agreements with them
• During film and television productions, the production company controls captured content per its own agreements and releases
• Guests who do not wish to be photographed or recorded for marketing purposes should let staff know on arrival

Many ranch experiences — particularly horseback rides — require us to collect health and safety information for your protection and the safety of our animals and staff.

• Riding experience level, height, and weight (for proper horse pairing)
• Relevant medical conditions, allergies, or medications affecting safety
• Emergency contact name and phone number
• Signed liability waivers and acknowledgments of inherent risks
• Minor consent and release forms when applicable

This information is used solely to operate safe experiences, respond to emergencies, and meet our legal and insurance requirements. It is shared only with staff directly involved in your experience and, when needed, with emergency responders or insurers. We retain it for seven (7) years from the date of your visit, in line with our insurance carrier's and applicable legal retention requirements.

For the safety and security of guests, staff, and animals, we operate security cameras at select locations on the property — primarily entry points, parking areas, equipment storage, and animal enclosures.

• Footage is recorded and retained on a rolling sixty (60) day cycle, unless preserved for an active incident
• We do not actively monitor footage in real time except in response to a security event
• Footage is not used for marketing or analytics
• Footage may be shared with law enforcement upon valid request, or with insurers when required for a claim
• Surveillance is not active inside private accommodations, restrooms, or changing areas

With your consent, or where otherwise permitted by law, we send you updates about the ranch, seasonal experiences, events, and news.

• Email — opt out at any time using the unsubscribe link in any message
• Text messages — sent only with your express consent. Reply STOP to opt out. Message and data rates may apply.
• Postal mail — by request only
• Social media — we do not send unsolicited commercial direct messages

Operational messages — booking confirmations, reminders, and urgent updates about your visit — are sent regardless of marketing preferences because they are necessary to fulfill our service to you.

We retain your information only as long as necessary for the purposes described in this policy, or as required by law:

• Booking and waiver records — seven (7) years, per insurance and legal requirements
• Financial and tax records — seven (7) years, per IRS and state tax requirements
• Marketing contacts — kept until you opt out or request deletion
• Surveillance footage — sixty (60) days on a rolling basis, unless preserved for an incident
• Inquiry-only contacts — twenty-four (24) months if no booking results, then deleted
• Production records — seven (7) years, per the location agreement and applicable legal/insurance requirements

We use reasonable administrative, technical, and physical safeguards to protect your information against unauthorized access, alteration, or destruction:

• Encrypted connections (HTTPS/SSL) across our website
• Secured payment processing through PCI-compliant vendors (Shopify Payments, Stripe)
• Access controls limiting staff access to personal information on a need-to-know basis
• Regular review of security practices and vendor agreements
• Physical security measures at our office and storage areas

Depending on your location, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal data
• Restrict or object to certain processing
• Receive a portable copy of your data in a commonly used format
• Opt out of marketing communications at any time
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact our privacy team using the details at the bottom of this policy. We will verify your identity before fulfilling a request and respond within the timeframes required by your jurisdiction — generally within thirty (30) to forty-five (45) days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to know — what categories and specific pieces of personal information we have collected, used, and shared
• Right to delete — request deletion of personal information, subject to legal exceptions
• Right to correct — request correction of inaccurate personal information
• Right to opt out — of any sale of personal information or sharing for cross-context behavioral advertising
• Right to limit — use and disclosure of sensitive personal information to what is necessary
• Right to non-discrimination — for exercising any of the above rights

We do not sell personal information for monetary value. We do share certain identifiers (such as advertising cookies and device IDs) with advertising partners like Meta and Google for cross-context behavioral advertising, which California treats as a "sale" or "share" under the CCPA/CPRA. To opt out, email us at the address below with the subject line "Do Not Sell or Share My Personal Information," or use the corresponding link in our website footer.

Sensitive personal information. The health and safety information we collect for ride waivers may qualify as sensitive personal information under California law. We use it only for the purposes for which you provided it and do not use or disclose it for any purpose other than what is permitted under the CCPA.

Authorized agents. You may designate an authorized agent to submit requests on your behalf. We will require written, signed permission from you and may verify the identity of both you and your agent before processing the request.

Residents of other U.S. states with comprehensive consumer privacy laws — including but not limited to Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, and others — have rights similar to those described above. These typically include:

• Right to confirm whether we process your personal information and access it
• Right to correct inaccuracies
• Right to delete personal information
• Right to data portability
• Right to opt out of targeted advertising and certain forms of profiling
• Right to opt out of the sale of personal information

Contact us using the details at the bottom of this policy to exercise any of these rights. We do not discriminate against residents who exercise their privacy rights. If we deny your request, you have the right to appeal that decision — the appeal process and contact will be provided in our response within the timeframes required by your state's law.

If you are located in the European Union, United Kingdom, or another region with comparable privacy laws, you have rights under the General Data Protection Regulation (GDPR), the UK GDPR, and equivalent local laws:

• Access, rectification, and erasure of your personal data
• Restriction of processing in certain circumstances
• Data portability
• Objection to processing based on legitimate interests or for direct marketing
• Withdrawal of consent at any time, where processing is based on consent
• The right to lodge a complaint with your local data protection authority

Our legal basis for processing depends on the activity and is one of the following: your consent; performance of a contract (your booking); our legitimate interests in operating the ranch responsibly and securely; or compliance with a legal obligation. We do not engage in automated decision-making that produces legal or similarly significant effects on you.

By using our website or services, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your home jurisdiction. We take steps to ensure appropriate safeguards are in place for any international transfers, including standard contractual clauses where required.

Our website is not directed at children under thirteen (13), and we do not knowingly collect personal information online from children under 13. If you believe a child has provided information through our site, please contact us and we will delete it promptly.

Children regularly visit the ranch with parents or guardians for rides, tours, and events. In those settings, we collect the minimum information necessary (such as name, age, height/weight for safe horse pairing, and emergency contact) directly from the parent or guardian, who must sign all waivers on the minor's behalf. This information is used only for the safe operation of the experience and is never used for marketing purposes.

Some browsers send a "Do Not Track" signal. There is no industry consensus on how to respond to these signals, so we do not currently take action based on them. We do honor the specific opt-out mechanisms described in this policy — cookie controls, "Do Not Sell or Share" requests, and email and SMS unsubscribes — as well as Global Privacy Control (GPC) signals where applicable.

Our website and communications include links to third-party sites and embedded content — including maps, video players, social media feeds, and booking widgets. We do not control how these third parties handle your information. Their practices are governed by their own privacy policies, which we encourage you to review.

Mortenson Ranch is a working film and television location. When a production company contracts to film at the ranch, we collect and process information necessary to host the production:

• Production company name, contacts, and billing details
• Crew rosters, vehicle and equipment lists, location release forms
• Shoot schedules, scout briefs, and call sheets
• Insurance certificates and indemnification documents
• Talent information when relevant to ranch operations or safety

We treat production information as confidential per our location agreement and any associated NDAs. We share it only with staff directly involved in supporting the production, and when required, with insurers, attorneys, or law enforcement. Production records are retained for seven (7) years following the shoot date.

For weddings and private events, we coordinate closely with the couple or event host on logistics. As part of that coordination, we receive personal information about your guests:

• Guest lists, RSVPs, and dietary or accessibility needs
• Vendor contact information (florists, caterers, photographers, planners)
• Special requests, timeline details, and emergency contacts
• Music, photo, or video preferences and releases

We use this information only to host your event safely and successfully. We share it only with staff and vendors directly involved in the event. After the event, we retain a minimum record for legal, insurance, and operational purposes for seven (7) years and dispose of detailed guest lists per our retention schedule.

We update this Privacy Policy from time to time as our practices evolve or as the law requires. The "Last updated" date at the top of the page reflects the most recent revision.

For significant changes, we will provide additional notice — for example, an email if we have your address on file, or a prominent notice on the website. Continued use of our website or services after a change constitutes acceptance of the revised policy.

For privacy questions, requests, or concerns, please reach out using the details below. We respond to verified privacy requests within the timeframe required by your jurisdiction — generally within thirty (30) to forty-five (45) days. For complex requests we may extend that period as permitted by law and will let you know.