Privacy Policy

This Policy explains how Costa Rica Experience collects, uses, retains and protects the personal data of people who visit costa-brava.vip or contact us through its forms and linked channels. It applies only to processing actually carried out by the controller in connection with this website. It is governed by Costa Rica's Law No. 8968, the Law on the Protection of Individuals with regard to the Processing of their Personal Data, and its Regulations, Executive Decree No. 37554-JP, as amended.

We process the following categories of data:

• Data you provide: your name, email address, telephone number, the content of your enquiry and any other data you choose to include in the enquiry form or a message.
• Referral data: if you arrive through a personal referral link, the referral code in that link, so that we know who introduced you to the project.
• Technical usage data: IP address, date and time of access, browser, device, pages viewed and the technical logs needed for the website to work and stay secure.

In the enquiry form, your name, email address, telephone number and message are required, together with your acceptance of this Policy. If a required item is not provided, we will be unable to respond to your enquiry or send you the requested information. We do not request sensitive data through the form.

We will use the data to respond to your enquiry; send you the project information you request, such as the master plan and site documentation; arrange a site visit where you ask for one; maintain security, prevent misuse and resolve technical faults; and comply with applicable legal obligations. We will only send advertising, newsletters or commercial communications if you have given specific consent for that purpose, with a simple way to withdraw it. We will not use the data for purposes incompatible with those stated at the time of collection.

Before personal data is requested, clear information is provided about the existence of the database, its purpose, the possible recipients, whether answers are mandatory, the intended processing, the consequences of not providing the information, your rights, and the identity of the controller. Where Law No. 8968 requires consent, we obtain it expressly and record it by a verifiable electronic means: when you submit the enquiry form, your acceptance of this Policy is recorded together with the date and time of submission. You may revoke your consent by writing to travel@arinnitti.foundation, without retroactive effect. Legal exceptions to consent will apply only in the cases expressly provided for by law.

The website uses only the following cookies and similar technologies:

• Security cookie set by our network provider, Cloudflare, to protect the website against automated abuse. It is essential for the website to work.
• Referral cookie (cb_ref, also kept in your browser's local storage) that stores the referral code of the link you arrived through, for up to 90 days. It is only set if you open a link containing a referral code and is only sent to us together with an enquiry you choose to submit.

The website does not use measurement, personalisation or advertising cookies. The project video is embedded in YouTube's privacy-enhanced mode, which does not store cookies until you play the video. If other cookies are introduced in the future, their purpose and any third parties involved will be explained before they are activated, and an express, recordable choice will be requested. Your browser settings allow you to block or delete cookies, although certain features may stop working.

Only authorised members of our team who need to process the data for the stated purposes will have access to it. Hosting, technology support and email providers are involved, acting under the corresponding instructions and confidentiality and security measures. Data will be disclosed to third parties and, where applicable, transferred to databases located in other countries only with the express and valid authorisation of the data subject where required, and in compliance with Law No. 8968. The providers currently involved are:

• Lovable: website hosting, the enquiry database and notification emails.
• Cloudflare, Inc. (United States): content delivery and website security.
• Google LLC (United States): the website's fonts (Google Fonts), our email system, and the embedded YouTube video; when pages load, your browser sends your IP address to Google.

We may also respond to valid requests from authorities in accordance with the law.

We will keep data for as long as needed for the stated purposes and for the periods required by applicable regulations. Enquiries received through the website are kept for up to three (3) years in our database and email systems, unless the law requires a longer period or you ask for earlier deletion and there is no legal reason to keep them. Once data is no longer needed, we will delete or de-identify it where appropriate. We will strive to keep it current, accurate and appropriate to its purpose, and we will act on requests for correction or deletion.

We apply technical and organisational measures appropriate to the nature of the data and the risks of processing to prevent unauthorised access, loss, alteration or improper disclosure. Staff and providers with access to data are bound by a duty of confidentiality, including after their relationship ends, in accordance with the law.

You may request, free of charge, access to your data, its rectification or updating, and its deletion where applicable; you may also decide on the disclosure of your data to third parties and revoke your consent under the terms of the law. To exercise these rights, write to travel@arinnitti.foundation, stating the right you wish to exercise and how you would like to receive our reply. We may ask for reasonable information to verify your identity or authority to act on someone's behalf, without collecting unnecessary data. The controller will respond within five business days of receiving the request. You may also contact Costa Rica's Agency for the Protection of Inhabitants' Data (PRODHAB) if you believe your rights have been infringed.

The website is not aimed at minors. If a feature required processing their data, information and authorisation mechanisms appropriate to the applicable regulations and the nature of the service would be put in place.

The website may contain links to pages run by third parties. Their privacy practices are governed by their own policies; we recommend reviewing them before providing them with any data.

We may update this Policy to reflect changes to the website, the processing or the regulations. The current version and the date it was last updated will be available at costa-brava.vip/privacy. If a change requires new consent, we will request it before the corresponding processing. For privacy enquiries: travel@arinnitti.foundation.