This Privacy Policy explains how Finca Guarumo collects, uses, stores, and shares your personal data, including data obtained via Google OAuth and Google APIs. By using our Service, you agree to the practices described in this policy.
1. Data Controller and Contact
Data controller: Katja Hollaar, operator of Finca Guarumo Contact email: info@fincaguarumo.com Physical address (optional): Calle La Balsa, Puerto Jimenez, Puntarenas, Costa Rica
If you have questions about this policy or our data practices, contact us at the email above.
2. Information We Collect
2.1. Information You Provide Directly
We may collect information you provide when you:
Create an account or log in
Fill out forms (e.g., booking inquiries, contact forms)
Communicate with us by email or other channels
This may include:
Name
Email address
Phone number
Booking dates and guest details
Payment information (handled by our payment processor; we do not store full card numbers)
Any other information you choose to provide
2.2. Information Collected Automatically
When you use our website or Service, we and our service providers may automatically collect:
Device information (browser type, operating system)
Log data (IP address, pages visited, timestamps, referring URL)
Usage data (features used, clicks, session duration)
Cookies and similar technologies (see “Cookies” section)
2.3. Google User Data (OAuth and Google APIs)
If you sign in with Google or connect your Google account, we may access and process certain Google user data via Google OAuth and Google APIs. The exact data depends on the scopes you authorize, but may include:
Email address
Basic profile information (e.g., name, profile picture URL)
Google Calendar data (e.g., events, availability)
Other Google API data as explicitly authorized
We only request Google data that is necessary for the features described in Section 3.
3. How We Use Your Data
We use the information we collect to:
Provide, operate, and improve the Service
Create and manage your account and authenticate your identity (including via Google OAuth)
Process bookings, inquiries, and payments
Communicate with you about reservations, updates, support, and policy changes
Personalize your experience (e.g., pre-filling your name/email after Google sign-in)
Analyze usage to improve performance, usability, and security
Comply with legal obligations and enforce our terms
Specific uses of Google user data:
Email address and basic profile: To create/log in to your account, identify you, and communicate about your bookings and the Service.
Calendar: Calendar data is used to (e.g., show your availability, sync booking calendars, avoid double bookings).
We do not use Google user data for purposes unrelated to the features described in this policy, and we do not use it for advertising or profiling beyond what is necessary to provide the Service.
4. How We Share Your Data
We do not sell your personal data. We may share your data in the following situations:
4.1. Service Providers
We share data with trusted third-party providers who help us operate the Service, such as:
Hosting providers
Payment processors
Email and communication tools
Analytics providers
These providers are contractually obligated to protect your data and use it only to perform services on our behalf.
4.2. Google and Google APIs
When you connect your Google account:
Google provides us with the data you authorize (as described in Section 2.3).
We may transmit certain data back to Google APIs to enable features (e.g., creating/updating calendar events, saving files).
We do not share your Google user data with third parties except:
As required to provide the specific feature you requested (e.g., a booking system that writes to your connected calendar)
As required by law or to protect rights and safety
4.3. Legal and Safety
We may disclose data if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Finca Guarumo, our guests, or others.
5. Data Retention
We retain your personal data only as long as necessary to:
Provide the Service and fulfill bookings
Comply with legal obligations (e.g., tax, accounting, tourism regulations)
Resolve disputes and enforce our agreements
Typical retention periods:
Google user data: Retained only while your account is active and connected, or as needed to provide the feature. You can disconnect your Google account at any time (see Section 8).
When data is no longer needed, we delete or anonymize it, unless retention is required by law.
6. Data Security
We implement technical and organizational measures to protect your data, including:
Encryption in transit (HTTPS/TLS)
Access controls and authentication
Regular security updates and monitoring
Secure storage and backup procedures
While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.
7. Cookies and Similar Technologies
We and our service providers use cookies and similar technologies to:
Remember your preferences and login state
Analyze site usage and performance
Support security and fraud prevention
You can control cookies through your browser settings. Disabling some cookies may affect certain features of the Service.
8. Your Rights and Choices
Depending on your location, you may have rights such as:
Accessing the personal data we hold about you
Correcting inaccurate data
Deleting your data (subject to legal retention requirements)
Restricting or objecting to certain processing
Exporting your data in a portable format
Withdrawing consent where processing is based on consent
Revoking access will stop future data collection via Google, but may limit features that depend on Google data.
You can also request deletion of your account and associated data by contacting us at [privacy@fincaguarumo.com].
To exercise your rights, contact us at the email above. We will respond within 30 days and may need to verify your identity.
9. International Data Transfers
Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, such as contractual clauses or reliance on adequacy decisions, in line with applicable data protection laws.
10. Children’s Privacy
Our Service is not directed to children under 12. We do not knowingly collect personal data from children. If we become aware of such data, we will take steps to delete it.
11. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will post the updated policy on this page with a new “Effective date”.
Your continued use of the Service after changes constitutes acceptance of the updated policy.
12. How This Policy Relates to Google OAuth Verification
This privacy policy is intended to meet Google’s OAuth verification requirements by:
Clearly describing what Google user data we access (Section 2.3)
Explaining why we collect it and how we use it (Section 3)
Disclosing how we store, secure, and retain Google user data (Sections 5–6)
Stating with whom we share Google user data and under what conditions (Section 4)
Providing users with controls to review, revoke, and delete their Google-connected data (Section 8)
