Privacy policy

2. What data we collect

We only collect what you give us voluntarily, plus the technical minimum the site needs to run safely:

• What you type into the contact form: name, email address, phone or WhatsApp number (optional), your message, and the package you are interested in.
• The language you browse the site in (Spanish or English), so we can reply in that same language.
• Your IP address and technical browser data at the moment you submit the form, which Cloudflare Turnstile uses to tell people apart from bots.
• Server logs (date, time, path, and response code) generated by our hosting provider to operate and protect the site.

We do not collect sensitive data, we use no advertising or analytics cookies, we neither buy nor sell databases, and we do not profile you or make automated decisions about you.

3. What we use it for

Your data is used only for the following:

• Answering your enquiry and preparing a proposal or quote for you.
• Contacting you by email or WhatsApp about that enquiry and following up on it.
• Protecting the form against spam and automated abuse.
• Meeting legal, accounting, or tax obligations once the relationship becomes a contract.

We do not use your email to send you advertising or newsletters you did not ask for. If we ever do, it will be under a separate consent and with an unsubscribe link in every message.

4. Our legal basis

Law 8968 requires your informed, express, and freely given consent before we process your data. You give that consent when you submit the form, having been able to read this policy, which is linked from the form itself and from the footer of every page.

For visitors in the European Union, processing rests on your consent, on the pre-contractual steps you request by writing to us, and on our legitimate interest in keeping the site secure. You may withdraw your consent at any time; doing so does not affect the lawfulness of processing carried out before the withdrawal.

5. How long we keep it

Form enquiries are kept for 24 months from the date they are sent. Once that period is over, an automated job deletes them from the database every day, without depending on anyone remembering to do it.

If the enquiry turns into a commercial relationship within that period, the data is then kept for as long as the applicable accounting and tax rules require. You can ask us to delete it before any of those periods expire.

6. Who we share it with

We do not sell, rent, or trade your data. We share it only with the providers we need in order to run the site, and each one only accesses what it needs:

• Supabase — the database where enquiries are stored (servers in the United States).
• Resend — delivery of the internal email that alerts us to a new enquiry (United States).
• Cloudflare Turnstile — anti-spam verification of the form (global network).
• Vercel — hosting and delivery of the site (global network).
• Calendly — the call scheduler embedded on the booking and contact pages (United States). It only receives your data if you open the calendar and book a call.

This means your data is transferred internationally, outside Costa Rica. By submitting the form you give us your express consent for that transfer, as Law 8968 requires; our providers also offer the contractual safeguards the GDPR requires for transfers outside the European Economic Area.

7. Your rights and how to exercise them

You have the following rights over your personal data:

• Access: to know what data of yours we hold, where it came from, and what we use it for.
• Rectification: to correct it if it is wrong, out of date, or incomplete.
• Erasure: to ask us to delete it when it is no longer needed or when you withdraw your consent.
• Objection and restriction: to ask us to stop using it for a particular purpose.
• Portability: to receive a copy in a structured, commonly used format (applies under the GDPR).
• Withdrawal of consent at any time, without having to give a reason.

To exercise any of them you have two routes: the data request form, which gives you a ticket number to follow it up, or writing to info@nexosolutionscr.tech from the same address you contacted us with, telling us which right you want to exercise. There is no charge.

We reply within the five business days set by Law 8968 and, in any case, within 30 calendar days at most, which is the GDPR's deadline. Before handing over or deleting data we may ask you to confirm your identity, so that we don't hand it to someone else. We keep the record of each request for 24 months as proof that we handled it.

If you believe we did not handle your request properly, you can file a complaint with Costa Rica's Data Protection Agency (PRODHAB) or with the supervisory authority of your country of residence in the European Union.

8. How we protect it

The database is protected with row-level security: the site's public key can neither read nor write enquiries — only the server can, using a secret key that never reaches your browser. All site traffic is encrypted over HTTPS, and access to enquiries is limited to the Nexo team.

No system is infallible. Should a security breach affect your data, we would notify you by email and report it to the relevant authority without undue delay.

9. Cookies and similar technologies

This site uses no analytics, advertising, or cross-site tracking cookies. Our analytics (Vercel Web Analytics) measures visits in aggregate and without cookies, so it needs no consent from you. Cloudflare Turnstile may store a temporary technical identifier in your browser for the sole purpose of verifying that you are not a bot; without it, the form would be exposed to spam.

The Calendly calendar loads inside a frame on Calendly's own domain and may store its cookies there once you open it. On the contact page it is not loaded until you press the button, and on the booking page you can avoid it by writing to us through the form, by email, or on WhatsApp. If we add other tools in the future, we will update this policy and ask for your prior consent where the law requires it.

10. Minors

This site is aimed at businesses and adults. We do not knowingly collect data from minors. If we find that we have received data from a minor without the authorisation of their legal representative, we delete it.

11. Changes to this policy

When we change this policy we will publish the new version on this same page, with its version number and update date visible at the top. We also store, alongside each enquiry we receive, the version that was in force at that moment, so it is always clear which text you agreed to.

If the change is substantial — a new purpose or a new recipient — we will tell you by email before it takes effect, provided we have a way to reach you.

12. Contact

Any question about this policy or about your personal data: write to us at info@nexosolutionscr.tech. Nexo Solutions CR, San José, Costa Rica.