Last updated: September 17, 2026
This Privacy Policy explains how Roots & Routes Costa Rica Vacations (“Roots & Routes,” “we,” “us,” “our”) collects, uses, shares, and protects personal data when you use rootsandroutescr.com and our booking services (the “Platform”). We process personal data in accordance with Costa Rica’s Law No. 8968, Protection of Persons Regarding the Processing of Their Personal Data (“Ley de Protección de la Persona frente al tratamiento de sus datos personales”), and with international travelers in mind.
1. Who is responsible for your data
Roots & Routes Costa Rica Vacations, operated by Juan Gabriel Ruiz Calderón, Costa Rican national identification (cédula física) 206500206, doing business as “Roots & Routes Costa Rica Vacations”, with tax domicile in San Ramón, Alajuela, Costa Rica (registered as a virtual/online service activity), is the data controller (“responsable del tratamiento”) for the personal data described in this Policy.
2. What we collect
Information you give us directly:
- Account information: name, email address, password, phone number, and, if you register as an Operator, your business name, service categories, and commercial/tax information.
- Booking information: the service you book, dates, number of guests, and any special requests you share with the Operator.
- Billing details entered at checkout (name, email, billing address) — used to generate your order and receipt.
- Communications: messages you send through the Platform’s internal messaging system, support requests, and review content you submit.
Information collected automatically:
- Usage data: pages viewed, searches performed, listings viewed, device type, browser, and approximate location inferred from your IP address.
- Cookies and similar technologies, used for keeping you signed in, remembering your preferences, and (where you consent) analytics. See Section 8.
Information from third parties:
- Payment data. When you pay online, our payment processor, TiloPay, handles your full card details directly — Roots & Routes never receives or stores your complete card number, expiration date, or security code. We do receive, and store as part of your order, limited payment metadata such as the last four digits of the card used, the payment method (e.g., Visa, Mastercard), the transaction authorization code, and whether the payment succeeded or failed. This is used for receipts, refunds, and fraud/dispute investigation.
- If you sign up or log in using a third-party account (for example, Google), we receive the basic profile information that service shares with us (typically name and email), subject to your settings with that provider.
We do not knowingly collect any special category of personal data (health information, biometric data, religious or political beliefs) except where you voluntarily disclose it to an Operator (for example, a dietary restriction or mobility need relevant to a tour) — that disclosure is between you and the Operator, and we recommend sharing only what is necessary for your safety and the Service.
3. Why we use your data, and our legal basis
| Purpose | Legal basis (Law 8968) |
|---|---|
| Creating and managing your account | Performance of a contract with you |
| Processing a booking and payment, and generating your receipt | Performance of a contract with you |
| Sharing the minimum booking details with the relevant Operator so they can deliver the Service | Performance of a contract with you |
| Customer support and dispute resolution | Performance of a contract with you; our legitimate interest |
| Fraud prevention and account security | Our legitimate interest, and legal obligation |
| Sending you marketing emails about offers or new listings | Your consent (you may withdraw it at any time) |
| Improving the Platform (aggregated usage analysis) | Our legitimate interest, or your consent for non-essential cookies |
| Complying with tax, accounting, and consumer-protection law | Legal obligation |
4. Who we share your data with
- Operators. When you book, we share the booking details the Operator needs to deliver the Service (your name, the dates, number of guests, and any note you added), and, once your booking is confirmed, contact details (phone/WhatsApp/email) so you and the Operator can coordinate directly.
- TiloPay (our payment processor), to process your online payment. TiloPay’s own privacy and security practices apply to the payment details you enter directly with them.
- Service providers who help us run the Platform (hosting, email delivery, security/anti-fraud, customer support tools), under contracts that require them to protect your data and use it only for the service they provide us.
- Legal and safety purposes. We may disclose data if required by Costa Rican law, a court order, or a competent authority, or where necessary to protect the rights, property, or safety of Roots & Routes, our users, or the public.
- Business transfers. If Roots & Routes is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to this Policy (or a successor policy you are notified of).
We do not sell your personal data to third parties.
5. International data transfers
Some of the service providers described in Section 4 (for example, hosting or email infrastructure) may process data outside Costa Rica. Where we transfer personal data internationally, we use providers that offer an adequate level of protection or appropriate contractual safeguards consistent with Law 8968.
6. How long we keep your data
We keep account data for as long as your account is active. We keep booking, payment, and tax-relevant records for the period required by Costa Rican commercial and tax law (generally several years) even after an account is closed, and messaging/review content for as long as reasonably necessary for support, safety, and dispute-resolution purposes. When data is no longer needed for these purposes, we delete or anonymize it.
7. Your rights (derechos ARCO)
Under Law 8968, and consistent with data-protection practices recognized internationally, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Cancel/delete your data, subject to our legal obligation to retain certain records (see Section 6).
- Oppose a specific use of your data, including withdrawing consent to marketing at any time.
- Data portability, where technically feasible, and to lodge a complaint with Costa Rica’s data protection authority, PRODHAB (Agencia de Protección de Datos de los Habitantes), or, if you are located elsewhere, your local data protection authority.
Many of your account and booking details can be updated directly in “My Profile”/”My Account.” For any other request, or to delete your account, email us at privacy@rootsandroutescr.com. We will respond within the timeframe Law 8968 requires.
8. Cookies
We use strictly necessary cookies to keep you signed in, remember items in your cart, and secure the checkout process — these cannot be switched off without breaking core functionality. Where enabled, we may also use analytics cookies to understand how the Platform is used, and you will be asked for your consent to these where required. You can control or delete cookies through your browser settings at any time; blocking necessary cookies may prevent you from booking.
9. Security
We use reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS), access controls limiting who on our team can see sensitive data, and an internal audit trail of administrative actions taken on bookings and accounts. No online service can guarantee absolute security, and you also play a role: use a strong, unique password and do not share your account credentials.
10. Children’s privacy
The Platform is not directed at children, and account holders must be at least 18 years old (Section 2 of our Terms and Conditions). We do not knowingly collect personal data from children. A child may of course appear as a guest on a family booking made by an adult account holder; we do not create a separate account or profile for that child.
11. Third-party links
The Platform may link to Operators’ own websites or social media, or to third-party services like TiloPay’s payment page. This Policy does not cover those third-party sites — please review their own privacy policies.
12. Changes to this Policy
We may update this Policy from time to time. We will post the updated version here with a new “Last updated” date, and where a change is material, we will provide additional notice (such as an email or an in-Platform banner).
13. Contact us
Roots & Routes Costa Rica Vacations
Data controller: Juan Gabriel Ruiz Calderón, Costa Rican national identification (cédula física) 206500206, doing business as “Roots & Routes Costa Rica Vacations”
Domicile: San Ramón, Alajuela, Costa Rica (registered as a virtual/online service activity)
Email: privacy@rootsandroutescr.com