Privacy Policy

The Spot is a family-run vacation property in Playa Cocles, Puerto Viejo de Talamanca, Limón, Costa Rica, operated by [Legal entity name and cédula jurídica] ("The Spot", "we", "us"). We are the data controller for the personal data described in this policy. You can reach us at [contact email] or on WhatsApp at +1 773 330 8976.

When you contact us on WhatsApp, Instagram, TikTok or by email, we receive the details you send us: your name, phone number or handle, the content of your message, and any dates, group size or requests you include. We use them to answer you, prepare a booking or a quote, and organise your stay or event. Those conversations take place on the platform you chose, and that platform's own privacy policy also applies.

When you book through Lodgify, Airbnb, Booking.com or Vrbo, the platform collects your booking and payment details under its own terms and privacy policy and shares with us what we need to host you: name, contact details, party size, dates, and any special requests. We do not receive your full payment card details.

When you visit the site, our servers automatically record technical data: your IP address, browser type, the pages you request, and the time of the request. We keep this in server logs for security, to diagnose problems, and to defend the site against abuse.

We use your IP address once, at the start of your visit, to estimate the country you are connecting from so that we can show the site in Spanish or English by default. The lookup runs on our own server against a local database (GeoLite2 data by MaxMind); your IP address is not sent to a third party for this purpose and the estimated country is not stored. You can change the language at any time with the switch in the header.

If you host an event or retreat with us, we may also collect the details needed to arrange it: guest lists, dietary requirements, transport and activity bookings. We use them only to deliver what you asked for.

This site uses a small number of cookies and none of them are used for advertising or to track you across other sites.

"lang" remembers the language you chose with the header switch, for one year. It is set only when you use the switch.

"spot_admin_auth" is a session cookie used exclusively by our staff to sign in to the site's administration area. It is never set on visitors' browsers.

The direct-booking widgets on the Book page are provided by Lodgify and load from Lodgify's servers. Lodgify may set its own cookies and process the data you enter in the widget under its privacy policy.

You can delete or block cookies in your browser settings. The site will still work; it will simply forget your language choice.

We process personal data in line with Costa Rica's Law No. 8968 on the Protection of Individuals with regard to the Processing of their Personal Data and its regulations. Where the General Data Protection Regulation (EU) 2016/679 applies to you, our legal bases are: performance of a contract or of steps you asked for before a contract (answering enquiries, arranging a stay), our legitimate interest in running and securing this site, and, for the language cookie, your consent when you use the switch.

We share personal data only with the services needed to run the site and host you: the booking platform you used (Lodgify, Airbnb, Booking.com or Vrbo), the messaging platform you contacted us on (WhatsApp by Meta, Instagram, TikTok), our hosting and storage provider (Amazon Web Services, with servers in the United States), and, for events, the local providers you asked us to arrange, such as transport, chefs or activity operators. We never sell personal data and we do not share it for advertising.

Because some of these providers are outside Costa Rica, your data may be transferred internationally. We rely on those providers' contractual safeguards for such transfers.

Enquiry and booking correspondence is kept for as long as needed to host you and to handle any follow-up, and then for up to five years to meet accounting and legal obligations and to resolve disputes. Server logs are kept for up to ninety days. The language cookie expires after one year.

You have the right to access the personal data we hold about you, to have it corrected or completed, to have it deleted where we no longer need it, and to object to or restrict certain processing. Where GDPR applies you also have the right to data portability and to withdraw consent at any time. To exercise any of these rights, write to [contact email] or message us on WhatsApp. We answer within the time limits set by law and may ask you to confirm your identity first.

If you believe we have handled your data unlawfully, you may complain to Costa Rica's data protection authority, the Agencia de Protección de Datos de los Habitantes (PRODHAB), or, where GDPR applies, to the supervisory authority in your country.

The site is served over HTTPS, the administration area is restricted to authenticated staff, and personal data is limited to the people who need it to host you. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take reasonable measures to protect your data.

This site is not directed at children and we do not knowingly collect personal data from anyone under 18. Bookings must be made by an adult. If you believe a child has sent us personal data, contact us and we will delete it.

We may update this policy from time to time. The date at the top shows when it last changed. Continued use of the site after a change means you accept the updated policy.

Questions about this policy or about your data: [contact email], or WhatsApp +1 773 330 8976. Postal address: Playa Cocles, Puerto Viejo de Talamanca, Limón, Costa Rica.