Last updated: [PENDING: fecha de publicacion]
1. Who is responsible for your data
Two companies are involved in operating this website and the tour you book through it:
- Tours Bahia Ballena S.A. (“TBB”), cedula juridica [PENDING], is the data controller for the personal data needed to provide and deliver your tour (your reservation, contact information, and communication about your booking).
- [PENDING: legal name of the Marketing Provider], which operates this website, acts as data processor on TBB’s behalf for the data collected through the booking form and checkout, and does not use your data for purposes beyond operating this website and passing your reservation to TBB.
2. What we collect
- Identification and contact data: name, email address, phone number/WhatsApp.
- Reservation data: tour date, number of adults/children, special requests (e.g., accessibility needs).
- Payment data: processed directly by our payment provider, Tilopay, under TBB’s merchant account. We do not store your full card number on this website — Tilopay handles this under its own PCI-DSS compliant systems.
- Technical data: standard website analytics (pages visited, general location by IP, device type) if analytics/advertising tools are active (see Section 6).
3. Why we collect it
- To process and confirm your reservation.
- To communicate with you about your booking (confirmation, changes, cancellation, day-of-tour logistics).
- To comply with legal/accounting obligations (invoicing, tax records).
- With your separate consent, to send you marketing communications (e.g., a review request after your tour, seasonal offers). You can opt out of this at any time.
4. Legal basis
We process your data based on: (a) the necessity to perform the contract when you book a tour, (b) compliance with Costa Rican legal/tax obligations, and (c) your consent for any optional marketing communication.
5. Who we share it with
- TBB (Tours Bahia Ballena S.A.), to deliver the tour you booked.
- Tilopay, to process your payment securely.
- We do not sell your personal data to third parties, and we do not share it with anyone beyond what is necessary to deliver your tour and process your payment.
6. Cookies and tracking
[PENDING: confirm which tracking tools are actually active before publishing]. If active, this site may use cookies and similar technologies for:
- Essential website/checkout functionality.
- Analytics (understanding how visitors use the site).
- Advertising (measuring the effectiveness of our marketing campaigns).
You can control cookies through your browser settings.
7. How long we keep your data
We retain reservation and contact data for as long as necessary to provide the service and comply with Costa Rican tax/accounting retention requirements (typically several years for invoicing records), after which it is deleted or anonymized, except where a longer retention period is legally required.
8. Your rights
Under Costa Rican law (Ley 8968), you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Cancel/delete your data when it is no longer necessary for the purposes described here.
- Object to certain uses of your data (e.g., marketing communications).
To exercise these rights, contact us at [PENDING: privacy contact email]. You may also file a complaint with Costa Rica’s data protection authority, PRODHAB (Agencia de Proteccion de Datos de los Habitantes), if you believe your rights have not been respected.
9. Data of minors
Tour reservations, including for children, are made by an adult guardian. We do not knowingly collect personal data directly from minors; any information about a child traveling with you is provided by the adult making the booking, under their responsibility.
10. Security
We take reasonable technical and organizational measures to protect your personal data. Payment information is never handled directly by this website — it is processed by Tilopay under its own security standards.
11. Changes to this policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date.
12. Contact
For any question about this policy or your personal data: [PENDING: contact email/WhatsApp/phone].