Privacy Policy

The data controller for this website is:

We collect personal data only when you actively provide it to us or when it is generated automatically through normal website usage. The categories of data we may collect include:

We do not collect payment card data directly. Any payments are processed through third-party providers who maintain their own security and privacy standards.

We collect and process personal data for the following purposes:

• To respond to enquiries and prepare travel quotations — necessary to fulfil your pre-contractual request.
• To arrange and manage your tour booking — necessary for the performance of a contract between you and Costa Rica Top Tours.
• To communicate about your itinerary — including confirmations, updates, and logistical details.
• To improve our website and services — based on our legitimate interest in understanding how visitors use our site so we can enhance their experience.
• To comply with legal obligations — including tax records, anti-money laundering regulations, or requirements under Costa Rican tourism law.
• To send marketing communications — only where you have given explicit consent; you may withdraw consent at any time.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

Our website uses cookies, small text files stored on your device to help the site function correctly and to understand how visitors use it. We use the following types:

You can manage or disable cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

We do not sell your personal data. We may share it with trusted third parties only where necessary to provide our services or comply with legal requirements:

• Hotels, transport providers, and local suppliers — to arrange accommodation, transfers, and activities included in your tour.
• Technology service providers — including our website hosting provider, email platform, and CRM tools, who process data on our behalf under data processing agreements.
• Analytics platforms — such as Google Analytics, which may receive anonymised usage data.
• Legal and regulatory authorities — where we are required by law to disclose information, such as to the Instituto Costarricense de Turismo (ICT) or tax authorities.
• Travel insurance providers — if you purchase travel insurance through us or request a referral.

All third parties with whom we share data are required to handle it securely and only for the specified purpose.

Costa Rica Top Tours is based in Costa Rica. If you are visiting our website from the European Union, United Kingdom, or another jurisdiction with data protection laws, please be aware that your information will be transferred to and processed in Costa Rica.

Costa Rica's data protection framework is governed by Law No. 8968 — the Protection of the Person against the Processing of their Personal Data. Where we use third-party technology providers based in the EU or US (such as Google Workspace), appropriate safeguards are in place including Standard Contractual Clauses or equivalent mechanisms.

We retain personal data only for as long as necessary for the purpose it was collected:

• Enquiries that do not convert to a booking — up to 12 months from last contact.
• Confirmed bookings — for the duration of the contractual relationship plus 7 years, in accordance with Costa Rican tax and commercial law.
• Marketing opt-in records — for as long as consent remains active, or until you withdraw it.
• Analytics data — retained in aggregated, anonymised form; identifiable data typically expires within 14 months in Google Analytics.

When data is no longer required, we securely delete or anonymise it.

Depending on where you are located, you have some or all of the following rights regarding your personal data:

To exercise any of these rights, please contact us at info@costaricatoptours.com. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These include encrypted data transmission (HTTPS/TLS), restricted staff access on a need-to-know basis, and regular review of our data handling practices.

While we take all reasonable steps to protect your information, no method of internet transmission is 100% secure. If you believe your data has been compromised, please contact us immediately.

Our website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has submitted information to us, please contact us and we will delete it promptly.

If your tour includes minors, we will only collect data about them as strictly necessary to fulfil booking and safety requirements, and with parental or guardian consent.

Our website may contain links to external websites such as hotel partners, national parks, or travel information resources. We are not responsible for the privacy practices of these sites and encourage you to read their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of our website after any changes constitutes your acceptance of the updated policy.