I. Introduction
II. Definitions
III. Type of Personal Information We Acquire
IV. How Your Data is Acquired
V. How We Use Your data
VI. How We Share Your Data
VII. Cookies and Related Technologies
VIII. Online Behavioral Advertising (OBA)
IX. Transfer of Your Data Among Jurisdictions
X. Data Security and Notification
XI. Notice to Residents of the State of California, U.S.A.
XII. Notice to Residents of the European Economic Area (EEA) and Switzerland
XIII. Contact Us Regarding Our Privacy Policy
I. Introduction
This Privacy Policy governs all websites, applications, and other services that link to, or contain references to, this document and are published, controlled or made available by COSTARICA.COM, its parent, subsidiaries and affiliates ("we", "us" or "our").
This Privacy Policy outlines how we acquire and treat your data when you access, visit and/or use "The Service". It also governs your data that we may acquire offline.
This Privacy Policy can be accessed any time in the footer of "The Service"'s, via the menu link or on "The Service" description screen, or as otherwise indicated depending on "The Service" you are using.
By requesting a quote, buying a Product or a Service, registering for any aspect of "The Service", or otherwise accessing, visiting or using "The Service", you consent to this Privacy Policy. If you do not agree with the terms and conditions of this Privacy Policy, you should not access, visit and/or use "The Service".
We advise that you print or retain a digital copy or a copy of this Privacy Policy for future reference. Please also review our Terms and Conditions and any other terms and conditions that may be posted elsewhere in "The Service" or otherwise communicated to our users, because all such terms and conditions are also part of the Agreement between you and us.
This Privacy Policy may be modified from time to time, so check back often. So that you are aware changes have been made, we will adjust the "Last Revised" date at the beginning of this document. If we make a significant change in the way we use or share your information, we will also post on "The Service" a prominent notice that a change was made. Continued access of "The Service" by you will constitute your acceptance of any changes or revisions to the Privacy Policy.
This Privacy Policy does not cover information collected on sites, applications, destinations, or services linked to from "The Service" that we do not own or control.
II. Definitions
All terms written between quotes in this Privacy Policy that are not otherwise defined have the meaning set forth as follows:
"PII" (Personally Identifiable Information) in this documents refers to information that alone or in combination with other information or in certain contexts can be used to identify, distinguish or trace you or your "Device"(s). Your "data" refers to your "PII", together with other information about you and/or your "Device"(s) that we acquire.
"The Service" in this document refers to each website, application, and/or other service, regardless of how it is distributed, transmitted, published, or broadcasted provided by us that links to this document, including without limitation all social, community and public discussion areas, photo and video galleries, bulletin boards, forums, chats, blogs, personal/job search, and other features and functionality thereof.
"Product" in this document refers to any product, item, merchandise and/or including without limitation packaged tourism products, hotel room, rental car and transportation reservations, medical referral, real estate and business services, "Content", contests and surveys, and other publications that may be featured, mentioned, reviewed, described, auctioned, given away, rented, sold, distributed, or otherwise available on or through "The Service", either by us or third parties.
"Third Party Providers" in this document refers to any third party unaffiliated with us that play a role in providing "The Service" or a "Product" via your "Device" and enabling you to acquire, access, visit and/or use the Service including without limitation equipment, hardware and software manufacturers and providers, telephone, mobile, wireless, cable, and Internet network providers and carriers, sellers or providers of technology as well as vendors, service providers and others we retain to host, run, track, and otherwise administer portions of the Service. It also refers to any third party unaffiliated with us that play a role in providing your or fulfilling a "Product" including without limitation a hotel, airline, car rental and tour operators or any applicable supplier usually we just provide them with your first and last name and arrival/pick up time. It also refers to business partners with whom we may jointly offer a "Product".
"Content" in this document refers to all text, articles, photographs, images, graphics, illustrations, creative, copy, artwork, video, audio, music, podcasts, ringtones, games, trademarks, trade names, service marks, and other brand identifiers, designs, plans, software, source and object code, algorithms, data, statistics, analysis, formulas, indexes, registries, repositories, and all other content, information, and materials available on or through "The Service", whether posted, uploaded, transmitted, sent or otherwise made available by us, our licensors, vendors, and/or service providers, or by you, and/or other users or third parties, including any such "Content" uploaded manually or bookmarked by you and/or other users.
"Device" in this document refers to any cellular phone, tablet, laptop, desktop computer, or any other "Device" capable of accessing "The Service".
"We", "Us" and "Our" in this document refers to COSTARICA.COM, its parent, subsidiaries and/or affiliates, and each of their respective officers, directors, members, employees, independent and sub-contractors, agents, representatives, successors and assigns.
"You" or "Your", whether between quotes or not, refers to all those who access, visit and/or use "The Service", whether acting as an individual or on behalf of an entity, including you and all persons, entities, or digital engines of any kind that harvest, crawl, index, scrape, spider, or mine digital "Content" by an automated or manual process or otherwise. "You" and "Your" also includes your administrators, executors, successors and assigns.
III. Type of Personal Information We Acquire
Personally Identifiable Information ("PII"):
We acquire "PII" that may include, in certain contexts, your first and last name, street address, state/province, zip code, country, email address, and telephone number, the arrival and departure information of your trip. We also acquire your IP address, User ID, and/or "Device" ID, which certain jurisdictions consider to be "PII" because it could be used to identify an individual or "Device" if it were combined with other identifying information.
"Sensitive PII":
In certain circumstances, such as when purchasing a Product or Service, you may provide a credit, debit, or payment account number, or other payment information which we recognize as more sensitive than other "PII". We generally do not request on or through "The Service" other data that are often considered "highly sensitive," such as other financial account information (e.g., credit report information, bank account numbers or statements), personal health information (e.g., health record, OPG X-Rays), or government issued identification numbers (e.g., social security number, drivers' license number, or passport number), although we reserve the right to do so when such data are necessary to offer you certain services.
Anonymous Data:
Some of the data that we acquire cannot identify, distinguish or trace you or your "Device", even if combined with other identifying information, and some data that could be considered "PII" when combined with other identifying information is not used in a way that identifies, distinguishes or traces you or your "Device", but is instead used in an anonymous way, often aggregated with other anonymous data about other users.
IV. How Your Data Is Acquired
Data You Provide:
We mostly receive "PII" because you provide it to us. For example, when you enter a contest or sweepstakes, complete a survey, or register and/or set up an account/profile, you may be provided, or required to choose, a password and/or User ID, and you may provide a credit, debit, or payment account number, or other payment information, as well as your first and last name, telephone number(s), email and/or street address. Other data such as your age, gender, an avatar, and preferences may also be requested.
When you purchase a "Product" you may provide your first and last name, telephone numbers, emails and/or street address. Other data such as your room and dietary preferences, your flight arrival and departure information may also be requested. Additionally, with "Product" associated with health services you may be requested to provide your medical records such as your OPG X-Ray or other documents to fulfill your request, and with "Product" associated with real estate or business services, you may be requested to provide your income tax, income sources or additional financial information.
In addition, we may acquire your data when you contact us by telephone, postal mail, social media interaction or messaging (e.g., email, multimedia messaging services (MMS), Short Messaging Services (SMS) or similar technologies). We also may acquire information that you provide about other people, for example, when you use our "refer-a-friend" email feature or purchase one of our Products as a gift.
Data Automatically Collected:
"The Service" may also automatically collect data about you, your online behavior and your "Device". The data collected may include, without limitation, the make, model, settings, specifications (e.g., CPU speed, connection speed, browser type, operating system, "Device" identifier) and geographic location of you and/or your "Device", as well as date/time stamp, IP address, pages visited, time of visits, "Content" viewed, ads viewed, the site(s), application(s), destination(s), and/or service(s) you arrived from, and other clickstream data. "The Service" may collect your data even if "The Service" is not open on your "Device" or you're not logged in.
Data Acquired Elsewhere:
We may also acquire your "PII" or other data offline or otherwise outside of "The Service". For instance, we may purchase or otherwise acquire such data from third party data suppliers. We reserve the right to merge or co-mingle this other data with your "PII" and data collected on or through "The Service".
Social Network Integration:
If you choose to access, visit and/or use any third party social networking service(s) that may be integrated with "The Service", we may receive your data that has been made available to those services, including information about your contacts on those services. For example, some social networking services allow you to push "Content" from our Service to your contacts or to pull information about your contacts so you can connect with them on or through "The Service". Some social networking services also will facilitate your registration for "The Service" or enhance or personalize your experience on "The Service". Your decision to use a social networking service in connection with "The Service" is voluntary. However, you should make sure you are comfortable with your data the third party social networking services may make available us by visiting those services' privacy policies and/or modifying your privacy settings directly with those services. We reserve the right to use, transfer, assign, sell, share, and provide access to all of your data that we receive through third-party social networking services in the same ways as all of your data we receive through our Service (see how we use your data below).
Publicly Posting "PII"
Please be aware that "Content" and "PII" that you disclose in publicly accessible portions of "The Service" may be available to other users, and may also be made available outside "The Service" by third parties, so you should be mindful of all "PII", especially "Sensitive PII", that you may wish to post.
V. How We Use Your data
Processing Your Requests for "Product"(s):
We use your data to process your request for "Content" and/or other "Product"(s). For instance, if you a request travel "Product", we will use your "PII" to contact you and help you plan, book your travels and process the payment. Likewise, if you request our health "Product"(s) we will use your "PII" to contact you and request "Sensitive PII" such as your health records (OPG X-ray, medical history, or others documents) necessary in order to assess your current health issue and provide you with an estimated cost for treatment. If you request our real estate or business services, we will use your "PII" to contact you to present you with opportunities you are looking for, we may request "Sensitive PII" – if the opportunity requires it - such as bank statements, income tax returns, income sources, or other documentation to pre-qualify you as a buyer or assess mortgage opportunities.
If you subscribe to any of our "Product"(s), we may use your e-mail address to send you a confirmation notice and your mailing address to send you the "Product". Similarly, if you enter a contest, we will use your "PII" to notify you if you are a winner. If you enter a contest or submit "Content" to us (e.g., an online review or comment), we may also publish your first and last name, screen name, home town and other "PII" you have provided to us.
Administering "The Service":
We also use your data for any lawful business purpose in connection with administering "The Service", including without limitation for customer service, to help diagnose problems with servers, to improve Products that we offer by tailoring them to your needs, to gather broad demographic information, to analyze trends, to seek compatible advertisers, sponsors, clients and customers, and to track users' movements around "The Service" and elsewhere on the web or across apps and/ "Device"s. Your geographic location data may specifically be used to show you "Content" (including advertising and sponsored messaging) based on geographic location.
Access by Third Party Providers:
We may also allow access to your data by Third Party Providers that provide us with services, such as technical maintenance, market research, community and forums management, auction services, e-commerce, personal/job search and other advertising functionality, but only for the purpose of and to the extent necessary to provide those services. And if you choose to purchase or subscribe to any Product(s), we may forward your data to Third Party Providers for services such as credit/debit card or other payment processing, order fulfillment, credit pre-authorization, and address verification or such as your first and last name, arrival time and your hotel in order to fulfill the Product you purchased. There are also times when you provide data to us in areas of "The Service" that may be managed or participated in by one or more Third Party Providers. In such cases, the data may be used by us and by such Third Party Provider(s), each pursuant to its own policies. While we may seek to require Third Party Providers to follow appropriate privacy policies and will not authorize them to use your data except for the express purpose for which it is provided, we do not bear any responsibility for any actions or policies of third parties.
Marketing Communications:
We may also use your data to communicate with you about new features, events or "Product"(s) offered by us, Third Party Providers, our advertisers, and other companies and individuals with which we have a relationship.
Health, Safety, and Legal Requests:
We reserve the right to access, use, and share with others your data for purposes of health, safety and other matters in the public interest. We may also provide access to your data in order to cooperate with official investigations or legal proceedings brought by or otherwise involving governmental and/or law enforcement officials, as well as private parties, including, for example, in response to subpoenas, search warrants, court orders, or other legal process. We may also provide access to protect our rights and property and those of our agents, customers, and others including to enforce our agreements, policies, and terms of use.
Employment Opportunities:
If you provide your "PII" to us for an employment inquiry, without limiting the applicability of the rest of this Privacy Policy, we will use your "PII" to evaluate your job application, and for related recruiting, reporting and recordkeeping purposes. We may keep your "PII" on file, whether we hire you or not, to manage your relationship with us and/or for job applicant related reporting and recordkeeping for as long as required or permitted by law.
Transfer or Sale of Our Business:
As our business changes, we may buy or sell various assets owned by us. In the event all or a portion of the assets are sold, assigned, transferred or acquired by another company due to merger, divestiture, restructuring, reorganization, dissolution, financing, acquisition, bankruptcy or otherwise, your data may be among the transferred assets.
Combining Your Anonymous Data with "PII":
We reserve the right to merge or co-mingle anonymous, non-personally identifiable data about you, your offline and online behavior, and/or your "Device" (including its geographic location), with your "PII" for any lawful business purpose.
VI. How We Share Your Data
Credit/Debit Card and Payment Account data:
We will not sell or rent your credit/debit card number or payment account data. We may transfer such data to Third Party Providers who need access to fulfill a transaction.
Health or Financial Information Data:
We will not sell or rent your health or financial records. We may transfer such data to Third Party Providers who need access to fulfill an assessment or estimate as per your request.
Sharing Your Data to fulfill a Product:
We may share your first and last name, arrival/departure time and hotel where you are staying with Third Party Providers in order to fulfill travel or health related "Product"(s).
Sharing Your Data for Marketing:
Unless otherwise specified on "The Service", we may sell or share your data among our parent, subsidiaries, and affiliates and with other third parties who we think may offer or enable you to become aware of "Product"(s) that may be of interest to you.
How to Opt-Out of Sharing for Marketing:
If you do not wish to have "PII" such as your first and last name, email address, street address or phone number shared with third parties for their marketing purposes, contact us as described at the end of this document. But note that, in order for us to properly administer "The Service", we must continue to share your data with Third Party Providers as described in Section IV(C) above (if you object to such sharing, you should not use "The Service"). Note also that this option to opt-out applies only to "PII", and not Anonymous data.
How to Opt-Out of Marketing Messages from Us:
If you do not wish to receive future marketing or other commercial messages from us, simply follow the unsubscribe instructions contained within the message you receive. But note that you may continue to receive certain communications from us that are necessary for "The Service", such as renewal notifications, invoices, technical notices, updates, security alerts, and support and administrative service bulletins.
How to Update Your "PII":
If you have registered on any part of "The Service", please use the mechanism or contact information on "The Service" that allows you to change or update your member preferences, if available, to keep all such data accurate and up-to-date. If no such mechanism or contact information is available on "The Service", contact us as described below with your changes.
VII. Cookies and Related Technologies
Cookies/Local "Device" Storage:
"The Service" will at times place and/or store code or other types of information and/or software on your "Device" or within your browser, such as cookies (including flash cookies), locally shared objects, and HTML5 (collectively known as, "Local "Device" Storage"). We and Third Party Providers may use Local "Device" Storage in connection with "The Service" for any lawful business purpose, including without limitation to determine whether you have seen a particular advertisement before on the same or different "Device" and to otherwise control the display of ads, to track the movements of individual users through "The Service" and elsewhere on the web or across apps, "Device"s, and geographic locations, to help diagnose problems with servers, to gather broad demographic information, to conduct research, to deliver editorial "Content", to record registration and personalization information, and to otherwise administer "The Service". For example, if you register on any part of "The Service" and are given the option to save your user name and password, we may provide this convenience to you via Local "Device" Storage. Local "Device" Storage may also collect and store your "PII", which may be shared with our parent, subsidiaries, and affiliates and other third parties.
You May Disable Local "Device" Storage:
If you do not want Local "Device" Storage, your "Device" or browser may include an option that allows you to not accept it. However, if you disable Local "Device" Storage, some portions of "The Service" may not function properly.
Tracking Technologies:
In addition to Local "Device" Storage, we may use web beacons, web bugs, Internet or pixel tags, clear gifs, digital fingerprinting (also known as "Machine Identification") and similar technologies (collectively, together with Local "Device" Storage, the "Tracking Technologies") on "The Service" and in our communications with you, such as within e-mail and text messages and push notifications. We use Tracking Technologies to determine which of our messages have been opened by recipients, and for all or some of the same lawful business purposes we describe above for use of Local "Device" Storage.
Do Not Track (DNT):
Your browser setting may allow you to automatically transmit a "Do Not Track" (DNT) signal to websites and online services that you visit. There is no consensus among industry participants as to what DNT means in this context, and some browsers automatically apply DNT signals by default and therefore do not necessarily reflect our visitors' choice as to whether they wish to receive advertisements tailored to their interests. As a result, like many websites and online services, we do not alter our practices when "The Service" receives a DNT signal from a visitor's browser. As discussed below, you may opt out of the use of your data for online behavioral advertising by third parties at any time. To learn how to set up your browser not to be tracked, please go to http://allaboutdnt.com.
VIII. Online Behavioral Advertising (OBA)
How Online Behavioral Advertising Works (OBA)
We and our Third Party Providers will at times also use Tracking Technologies for purposes of "online behavioral advertising". Online Behavioral Advertising allows the serving of advertisements tailored to interests you have shown by browsing on "The Service" and on other websites, applications, destinations, and services, using the same or a different "Device". To enable Online Behavioral Advertising, we and these Third Party Providers use Tracking Technologies to collect data including for example the make, model, settings, specifications (e.g., CPU speed, connection speed, browser type, operating system, "Device" identifier) and geographic location of your "Device", as well as date/time stamp, IP address, pages visited, time of visits, "Content" viewed, ads viewed, the site(s), application(s), destination(s), and/or service(s) you arrived from, and other clickstream data. The use of Tracking Technologies by Third Party Providers is subject to their own privacy policies, not this Privacy Policy, and we have no responsibility or liability in connection therewith.
Opt-Out of Online Behavioral Advertisng (OBA)
If you do not want to be tracked with Online Behavioral Advertising, you may be able to opt-out of it by visiting http://www.aboutads.info, http://www.networkadvertising.org, http://www.youronlinechoices.com/ and/or by clicking the "Ad Choices" icon that appears in advertising served through OBA. Please note that the option to opt-out applies only to tracking by Third Party Providers across this service and other sites, applications, destinations, and services, and not tracking among pages within "The Service" itself.
IX. Transfer of Your Data Among Jurisdictions
Your data may be processed, transferred to, and maintained on, servers and databases located within the U.S., Canada and elsewhere where the privacy laws may not be as protective as your jurisdiction. We reserve the right to transfer your data to and from any state, province, country or other governmental jurisdiction. Your consent to this Privacy Policy followed by your submission or our collection of such data represents your agreement to any such transfer.
X. Data Security and Notification
Security Measures:
We take commercially reasonable security measures to protect against unauthorized access to, or unauthorized alteration, disclosure or destruction of, "PII" that you share with us.
No Liability for Breach:
Because no data transmission is completely secure, and no system of physical or electronic security is invulnerable, we cannot guarantee the security of the data that you send to us or the security of servers, networks or databases, and by using "The Service" you agree to assume all risk in connection with your data. We are not responsible for any loss or breach of such data or the consequences thereof.
Breach Notification:
In the event that we believe the security of your data in our possession or control may have been compromised, we may seek to notify you. If notification is appropriate, we may notify you by e-mail, push notification, or otherwise.
XI. Notice to Residents of the State of California, U.S.A.
California's "Shine the Light" Law:
California's "Shine the Light" law, Civil Code Section 1798.83 (visit this link for the complete section https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.83.&lawCode=CIV) , gives California clients the right to prevent our disclosure of their personal information to third parties for those third parties' direct marketing purposes, and requires certain businesses to respond to requests from California clients asking about the business' practices associated with disclosing personal information to third parties for the third parties' direct marketing purposes. Alternately, such businesses may have in place a policy not to disclose personal information of clients to third parties for the third parties' direct marketing purposes if the client has exercised an option to opt-out of such information-sharing. We have such a policy in place. If you wish to opt-out of our sharing of your data with third parties for the third parties' direct marketing purposes or to find out more about your opt-out rights, please contact us as described below.
California's Online Erasure:
California's "Online Erasure" law, Business and Professions Code Sections 22580-22582 (visit this link for the complete section http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&division=8.&chapter=22.1.), requires operators of certain websites and online services to allow registered users who are under the age of 18 and residents of California to request removal of "Content" they post. If you fit that description and posted "Content" on a section of "The Service" that is directed to minors, you may request removal of the "Content" by contacting us as described below. In response to your request, we may elect to make the "Content" invisible to other users and the public (rather than deleting it entirely), in which case the "Content" may remain on servers we control and/or may be publicly available elsewhere if a third party copied and reposted the "Content".
XII. Notice to Residents of the European Economic Area (EEA) and Switzerland
Purposes of Processing:
We process your data to process your requests for "Product"(s), administer "The Service", facilitate access by Third Party Providers, make marketing communications, facilitate health, safety and legal requests, respond to your requests in connection with employment opportunities, transfer or sell our business, and to combine data sets. We may also use, transfer and otherwise process data acquired from you directly or by use of Tracking Technologies, for marketing purposes, including to serve you with Online Behavioral Advertising (OBA).
Legal Basis for Processing:
We serve you with OBA with your consent, and you have the right to withdraw consent at any time as explained above, or by contacting us described below. We rely on the legitimate interest basis of processing for the other activities as described above because processing data is necessary to provide you with our "Product"(s) and to respond to your requests, our activities are reasonably expected by our visitors, and those activities do not unduly and negatively affect the privacy rights of our visitors. When you purchase a "Product", enter a sweepstakes, or engage in another type of transaction with us, we may process your data to fulfill that agreement.
Transfers:
Your data may be processed in or transferred to the U.S., Canada or elsewhere in the world. We will ensure that transfers of personal data to a third country or an international organization are subject to appropriate safeguards.
Individual Rights:
If you are a resident of the EEA or Switzerland, you are entitled to the following rights. Contact us as described below to exercise these rights. Please note: In order to verify your identity, we may require you to provide us with personal information prior to accessing any records containing data.
Right to access and rectify your data:
You have the right to obtain information about our processing of data and a copy of your data that we store. You have the right to request that we update your data if it is inaccurate or incomplete.
Right to request erasure of your data:
You have the right to have your data erased from our systems if the data are no longer necessary for the purpose for which it was collected or you withdraw consent and no other legal basis for processing exists.
Right to restrict our processing of your data:
You have the right to restrict our processing if you contest the accuracy of the data we store about you, our processing is deemed unlawful and you oppose erasure of your data, or we no longer need the data for the purposes for which we collected it but we must store it to comply with our legal obligations.
Right to portability of your data:
You have the right to receive your data and to transmit it to another controller where our processing is based on consent you gave us and was carried out by automated means.
Right to object to our processing of your data:
You have the right to object to our processing where we process data based on legitimate interest.
Right to file a complaint:
You have the right to file a complaint about our data collection and processing actions to your data protection authority. You can contact the data protection authorities at http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/
XIII. Contact Us Regarding Our Privacy Policy
If you have any concerns or questions about any aspect of this policy, please feel free to contact by filling out our contact us form at https://www.costarica.com/corporate/contact-us.html. Or, you can write to privacy-policy@costarica.com.