PRIVACY AND PERSONAL DATA PROTECTION POLICY

In accordance with the provisions of Law No. 8968 Ley de Protección de la Persona frente al tratamiento de sus datos personales and the Reglamento N° 37554-JP Reglamento a la Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales (Law on the Protection of Individuals with Respect to the Processing of Their Personal Data and Regulation to the Law on the Protection of Individuals with Respect to the Processing of Their Personal Data), this Privacy and Data Protection Policy regulates and establishes the necessary measures and procedures to guarantee the Right to Informational Self-Determination of Users who share their personal data with Golegalcr.com, hereinafter “the Website,” and GoLegal’s social media profiles. 

Informed Consent

The data subject (the User) freely grants his or her informed consent, specific, express, informed, and unequivocal consent to the Data Controller to process the User’s personal data in accordance with the provisions of this privacy policy, confirming such consent, acceptance, and understanding through any messaging platform used to contact GoLegal, or by clicking the acceptance checkbox located on each form on the website. 

The User’s refusal to grant this informed consent to the Data Controller limits the User’s ability to contact GoLegal through the digital communication channels provided on this website or on its social media platforms; therefore, the User must contact GoLegal directly via telephone only, with the exception that during the call, and based on the information shared, the Data Controller may request informed consent.

Accordingly, the User’s acceptance of the informed consent constitutes express authorization for the Data Controller to process personal data in accordance with the following provisions:

1. Data Controller

GoLegal SRL, with legal ID number 3-102-807186, with its registered office in Barrio Escalante, San José, Costa Rica, and email address legal@juanesteband.sg-host.com, is hereinafter the Data Controller and is responsible for collecting, managing, processing, and determining the purpose of the personal data that Users share when interacting with this website.

2. Personal Data Subject to Processing

Personal data is defined as any information relating to an identified or identifiable natural person; consequently, to fulfill the purpose set forth herein, the Data Controller will collect the following personal data through the forms and messaging platforms implemented on this website or on GoLegal’s social media profiles: full name, alias, email address, phone number, IP address, physical address, images, social media profiles, and any other data necessary for the efficient provision and contracting of the legal services offered on this website.
 
This Policy covers all personal data collected and processed by the Data Controller.

3. Purpose of the Processing of Personal Data

When Users who visit and interact with this website are classified as consumers as defined by Law 7472—the Law on the Promotion of Competition and Effective Consumer Protection—and its implementing regulations, the purpose of processing personal data will be for advertising, promotional, commercial, and contractual activities related to the legal services offered by the Data Controller on this website. These purposes include: Web Analytics, analysis of User navigation on the website and the Data Controller’s social media profiles, sending emails, contact via social media, contact via messaging services, phone calls, advertising campaigns on search engines and social media, drafting legal contracts for the provision of services, surveys, market segmentation to improve services and customer service decision-making, and customer acquisition.
 
When Users are not classified as consumers, the personal data collected will be used solely for the purpose of addressing the inquiry or responding to the message that the User sends us through GoLegal’s contact forms, messaging platforms, or social media profiles.

4. Retention Period for Personal Data

Users’ personal data will be retained for a maximum period of 4 years from the date of the User’s last activity with GoLegal. However, it will only be retained for the minimum time necessary for the processing purposes specified in point (3), or until the User requests its deletion, in which case the Data Controller will retain only the data necessary for the exercise or defense of future claims.

5. Recipients and Third Parties with Access to Personal Data

The Data Controller is the final recipient of the User’s personal data. The Data Controller and any staff members designated by the Data Controller for this purpose will have access to this data. However, during the processing and fulfillment of the purpose set forth in point (4), the User grants informed consent for the Data Controller to transfer their personal data to a data processor or third parties that may be located in Costa Rica or outside the country.
 
To fulfill these purposes, the Data Controller uses the following third-party services, which in some cases involve the international transfer of data to third parties:

SiteGround

Description: The hosting service that hosts the GoLegalcr.com website.
 
Company Information: SiteGround Spain S.L. is a company incorporated under Spanish law, duly registered in the Madrid Commercial Registry, in Volume 33,085, Folio 1, Page M-595464, 1st entry, with Tax ID (CIF): B87194171, and with its registered office at: Calle de Prim 19, 28004 Madrid, Spain.
 

 

Google Analytics

Description: A web analytics service embedded in the website’s code via cookies and JavaScript, which analyzes how users use and navigate the GoLegalcr.com website in order to create a profile of user behavior for the purpose of displaying ads on Google LLC’s partner sites.
 
Company Information: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043.
 
 

Facebook

Description: The website includes the Facebook pixel, which is a piece of JavaScript that the Data Controller inserts into the website’s code. The Facebook pixel may collect User data such as: IP address, web browser information, page location, referral source, and the person using the website or the buttons or links the User clicks on. This data is then used by Facebook and the Data Controller to create marketing campaigns or display ads to the User on topics of interest and tailored to the User’s interests.
 
Company information: Facebook, Inc., ATTN: Privacy Operations, 1601 Willow Road, Menlo Park, CA 94025.
 

 

Microsoft Office 365

Description: The Data Controller uses Microsoft Office 365 as an internal management tool; consequently, all emails and messages sent through the forms on this website are processed via this platform, which is owned by Microsoft. Therefore, Users’ personal data processed through this tool will be transferred to Microsoft’s servers for processing in accordance with the purpose set forth in section (5).
 
Company Information:
 
Costa Rica: Oficentro Plaza Roble, El Patio Building, 2nd Floor, Escazú, San José, COSTA RICA
USA: Microsoft Privacy, Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA. Telephone: +1 (425) 882 8080.
Ireland: Microsoft Ireland Operations Limited, Attn: Data Protection Officer, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Telephone: +353 1 706 3117.
 

Mailchimp

Description: Mailchimp is an email marketing and CRM platform that the Data Controller uses to stay in touch with its customers or prospective customers to conduct marketing campaigns, send news and updates, and manage marketing and sales activities with its Users. Mailchimp may have access to Users’ personal data such as: email addresses, name, phone number, country, city, company, IP address, browser settings, and other data necessary to understand the User’s browsing habits within the Data Controller’s digital channels.
 
Company Information: Mailchimp: The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA.
 

QuadLayers

Description: The Data Controller uses the WhatsApp Chat plugin developed by QuadLayers on the website. This application allows Users to contact a GoLegal representative via chat from any page on the website. WhatsApp Chat collects the message sent through its application and sends it to its servers to perform anti-spam analysis.
 
Company Information: https://quadlayers.com/
 

6. Principles Applied to the Processing of Personal Data

In accordance with the provisions of Law 8968—the Law on the Protection of Individuals with Respect to the Processing of Their Personal Data—specifically Article 6, the Data Controller hereby commits, through this Policy, to collect, store, or use personal data for automated or manual processing in accordance with the principles of data currency, truthfulness, accuracy, and suitability for the purpose.

7. User Rights

The User has the following rights regarding the personal data collected and processed by the Data Controller:

7.1.- Access to Information

  • Request confirmation from the Data Controller as to whether or not User data exists in files or databases under the Data Controller’s control.
    Provide information regarding the use being made of the User’s personal data, the purpose of such use, and the technical terms used by the Data Controller to process the data.

7.2.- Right to Rectification

The User has the right to have their personal data rectified, updated, or deleted when such data has been processed in violation of the provisions of Law 8968, particularly due to the data being incomplete or inaccurate, or when it has been collected without the data subject’s authorization.

7.3.- Right to Withdraw Consent

The User may withdraw their informed consent for the processing of their personal data by the Data Controller, in which case the Data Controller will retain only the data necessary for the exercise or defense of future claims.

7.4.- Right to Erasure or Deletion

The User may at any time request that the Data Controller permanently erase or delete, in whole or in part, the data subject’s personal data; in such cases, the Data Controller will retain only the data necessary for the exercise or defense of future claims. Exceptions to the deletion of personal data are those established by law.
 
To exercise any of these rights, the User must send a written request to the email address legal@juanesteband.sg-host.com, including a photocopy of their ID card or passport and all information relevant to their request.
 
If the User considers that the Data Controller’s response is unsatisfactory, that their rights have not been respected, or that the Data Controller’s processing of personal data does not comply with the law, they may contact the data protection authority Prodhab

(http://www.prodhab.go.cr/).

Likewise, Prodhab makes the following forms available to Users to exercise their rights by filing a claim with the Data Controller:

8. Confidentiality and Security of Personal Data

The Data Controller is committed to protecting your personal data and taking all reasonable measures to do so. It also requires that trusted third parties who handle your personal data have  
 
The Data Controller always does everything possible to protect your personal data and, once it has received your personal information, employs strict procedures and security measures to help prevent unauthorized access. Since transmitting information over the Internet is not completely secure, the Data Controller cannot guarantee the security of your data sent through our website. Therefore, any information is sent at your own risk.

Last update: May 4th, 2020