Privacy policy

1. Data controller

The controller of the database and of the processing of personal data is idea software lab, domiciled in Curridabat, San José, Costa Rica (hereinafter, “the Controller”). For any matter relating to this Privacy Policy (hereinafter, “the Policy”), the data subject (hereinafter, “the Data Subject”) may write to contacto@ideasoftwarelab.com or call +506 7005-8703.

2. Purpose and legal framework

The Policy governs the processing of the personal data that the Controller collects through its website (hereinafter, “the Site”) and through the contact channels indicated on it, in compliance with Law No. 8968, the Law for the Protection of Individuals with regard to the Processing of their Personal Data (Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales), and its Regulations, Executive Decree No. 37554-JP, as amended.

3. Personal data processed

Without prejudice to section 13, the Controller collects only the personal data that the Data Subject provides voluntarily, depending on the contact channel used:

• The Site’s contact form: name, email address, a description of what the Data Subject wishes to build and the preferred reply channel; and, where the Data Subject provides them, the name of their company or business, the project type and their telephone number.
• Email, WhatsApp or telephone call: the contact details from which the communication is made and the information the Data Subject sends through those channels.
• Appointments booked through Calendly: the details the Data Subject enters when booking, which Calendly transmits to the Controller.

The data so collected is entered into a database of personal data, for exclusively internal use, which is not administered for purposes of distribution, dissemination or commercialization and whose controller is idea software lab.

4. Sensitive data

The Controller does not request sensitive data, such as data revealing racial or ethnic origin, political opinions, religious, spiritual or philosophical beliefs or socioeconomic status, or data concerning health, biomedical or genetic information, sex life or sexual orientation. Under article 9 of Law No. 8968, no person is obliged to provide sensitive data; the Data Subject is therefore asked not to include it in any communication. Should any be received, the Controller shall delete it.

5. Purposes of processing

Personal data shall be processed solely for the following purposes:

• To handle and answer the Data Subject’s inquiries.
• To arrange meetings and follow up on those inquiries.
• To prepare and send service proposals, where the Data Subject so requests.
• To process complaints and requests to exercise rights.

The Controller shall not use personal data to send advertising, newsletters or other commercial communications, unless the Data Subject expressly requests them, nor shall it sell, rent, assign or otherwise commercialize it. Where a contractual relationship is formalized, the processing of the data necessary for its performance shall also be governed by the terms of the relevant contract.

6. Mandatory or optional nature of the data

In the contact form, the name, the email address, the description of what the Data Subject wishes to build and the preferred reply channel are mandatory, as is the telephone number where a reply by WhatsApp or by telephone call is chosen; the consent box must also be ticked. Failure to provide any of them will prevent the message from being received and handled. The name of the company or business, the project type and, where a reply by email is chosen, the telephone number are optional; their omission shall not affect the handling of the inquiry.

7. Informed consent

By ticking the consent box on the contact form, the Data Subject acknowledges having been informed of the matters set out in the Policy and gives express consent to the processing of their personal data on the terms described herein, including its storage by the technology providers listed in section 8, whose servers are located outside the territory of the Republic of Costa Rica.

Where the Data Subject contacts the Controller by email, WhatsApp, telephone call or Calendly, the Controller shall send, in its first written reply, a link to the Policy and ask the Data Subject to give express consent in writing to the processing of their personal data on the terms described herein. Until such consent is given, the data shall not be processed for any purpose other than handling that communication.

The Data Subject may withdraw consent at any time, without stating a reason and free of charge, by written notice sent to the email address contacto@ideasoftwarelab.com. The Controller shall give effect to the withdrawal within five business days of its receipt. Under article 5 of Law No. 8968, withdrawal shall not have retroactive effect.

8. Recipients of the data and technology providers

The Controller does not sell, assign or disclose personal data to third parties for their own purposes. To handle inquiries, it relies on the following technology providers, whose servers are located, in whole or in part, outside the territory of the Republic of Costa Rica:

• Vercel Inc., which hosts the Site and receives, on behalf of the Controller, the information sent through the contact form.
• Plus Five Five, Inc. (Resend), which forwards the information sent through the contact form to the Controller’s email and keeps a copy for thirty days.
• Namecheap, Inc., whose email forwarding service delivers to Gmail the messages addressed to the Controller’s address.
• Google LLC, through the Gmail email service, by which messages are received and answered.

Where the Data Subject chooses to communicate by WhatsApp or to book an appointment through Calendly, their data shall also be processed by WhatsApp LLC (Meta) or by Calendly LLC, as the case may be, under their own terms and privacy policies, by virtue of the relationship the Data Subject maintains directly with those providers.

Only the Controller’s staff handling the inquiry and the providers listed above shall have access to the data, to the extent necessary to provide their services. The Controller shall disclose personal data to a public authority only where required by a constitutional or legal provision, by a reasoned order issued by a competent judicial authority, or by a resolution adopted by a special investigative committee of the Legislative Assembly (Asamblea Legislativa) in the exercise of its duties.

9. Retention period

Personal data shall be kept only for as long as necessary to handle and follow up on the inquiry and, in any event, for no longer than twenty-four months from the last communication, unless a contractual relationship is formalized. It shall be deleted earlier where it is no longer necessary or relevant to the purpose for which it was collected, in accordance with article 6 of Law No. 8968, or where the Data Subject requests its deletion and there is no legal obligation to retain it. Where a contractual relationship is formalized, the related data shall be kept for its duration and, thereafter, for the period required by applicable law or necessary to address any claims, until the corresponding limitation periods have expired.

10. Security measures and duty of confidentiality

In accordance with article 10 of Law No. 8968, the Controller adopts the technical and organizational measures necessary to guarantee the security of personal data and to prevent its alteration, accidental or unlawful destruction, loss, or unauthorized processing or access. Access to the data is limited to the staff handling the inquiry, and the accounts in which it is stored are protected by authentication mechanisms. Under article 11 of the same Law, every person involved in any stage of the processing is bound by professional or functional secrecy, even after their relationship with the database has ended.

11. Rights of the Data Subject

Under articles 5 and 7 of Law No. 8968, the Data Subject is entitled, free of charge:

• To access their personal data and to know the purpose for which it is processed.
• To obtain the rectification of their data, where inaccurate or incomplete, and its updating.
• To obtain the deletion of their data.
• To withdraw the consent given, without retroactive effect.

To exercise these rights, the Data Subject, personally or through a duly accredited representative, shall send a written request to contacto@ideasoftwarelab.com from the email address used in their communications with the Controller or, failing that, accompanied by information allowing their identity to be verified. The Controller shall resolve the request within five business days of its receipt, as provided in article 7 of that Law.

12. Complaints to Prodhab

If the Data Subject considers that the processing of their personal data infringes Law No. 8968, they may file the corresponding complaint with the Agency for the Protection of Inhabitants’ Data (Agencia de Protección de Datos de los Habitantes, Prodhab), a body with maximum deconcentration attached to the Ministry of Justice and Peace (Ministerio de Justicia y Paz), under article 24 of that Law.

13. Technical browsing data and browser storage

The Site does not use cookies or analytics or tracking tools. Notwithstanding the foregoing, the Data Subject is informed of the following:

• The Site uses the Google Fonts service to display its typefaces; consequently, when the Site loads, the browser connects to Google servers, which receive technical connection data such as the IP address.
• Vercel Inc., the Site’s hosting provider, may record technical connection data, such as the IP address and the date and time of access, for security purposes and for the operation of the service.
• Where the Data Subject selects a project type on the Home page, the Site stores that selection in the browser’s session storage while the tab remains open, for the sole purpose of ticking it in the contact form, where it can be unticked. That selection remains on the Data Subject’s device and is not transmitted to the Controller unless the contact form is submitted.
• Where the Data Subject chooses the light or dark mode or the language of the Site, the Site stores that choice in the browser’s session storage while the tab remains open, for the sole purpose of keeping it when moving from one page of the Site to another. That choice remains on the Data Subject’s device and is not transmitted to the Controller.

14. Minors

The Site and the Controller’s services are intended for persons of legal age. Minors shall not provide personal data through the Site without the express consent of their legal representative. If the Controller becomes aware that it has received data from a minor without such consent, it shall delete it.

15. Amendments

The Controller may amend the Policy at any time. The version in force shall be the one published on the Site, stating the date of its last update. Where an amendment involves processing the data for purposes other than those set out herein, the Controller shall first obtain the Data Subject’s consent.

16. Language and related documents

The Policy is drafted in Spanish, which is its official version; any translation is provided for information purposes only and, in the event of any discrepancy, the Spanish version shall prevail. Use of the Site is governed by the Terms and conditions.