Privacy Policy

1. Who we are

The Site belongs to Místico, a residential and hospitality community in Playa Hermosa, Puntarenas, Costa Rica. It is operated by [LEGAL ENTITY NAME], a company incorporated in Costa Rica with corporate ID (cédula jurídica) [3-XXX-XXXXXX], with offices at [Momentum Lindora, 3rd floor, Santa Ana, San José, Costa Rica] ("Místico", "we", "us" or "our").

We are the party responsible for the database (responsable de la base de datos) that holds the personal data described in this policy, as defined in Costa Rica's Law No. 8968 on the Protection of Persons with regard to the Processing of their Personal Data and its regulations (Executive Decree No. 37554-JP, as amended).

Privacy contact: [privacy@misticocr.com] · [+506 2582-0505] · [postal address above]

2. What this policy covers

This policy explains how we collect, use, share and protect personal data when you:

• browse the Site;
• fill in a form on the Site (for example "Book a visit", "Prices and availability", "Download the brochure" or "Contact sales");
• contact us by WhatsApp, email or phone, including through the contact buttons on the Site;
• respond to our advertising, including lead forms on Meta (Facebook, Instagram) or Google;
• visit our sales office, the community or one of our events; or
• start the process of reserving or buying a property from us.

Other places mentioned on the Site, such as Amarena Canvas Beach Hotel, Madresal Beach Club, the restaurants and the Adventure Center, may be run by other companies and have their own privacy policies. When you book or buy directly from them, their policy applies.

3. What we tell you before collecting your data

Law 8968 (article 5) requires us to tell you the following before you give us your data. Here is where each point is covered:

• That a database with your personal data exists. See this section and section 1.
• Why we collect your data. See section 5.
• Who receives your data and who can see it. See section 8.
• Which answers are required and which are optional. See section 4.
• How your data will be processed. See sections 5, 9, 10, 11 and 12.
• What happens if you do not give us your data. See section 4.
• How to use your rights. See section 13.
• Who is responsible for the database and where to find them. See section 1.

4. The data we collect

4.1 Data you give us

• Enquiry, visit and brochure forms. First and last name, email, phone or WhatsApp number with country code, gender (with a "prefer not to say" option), preferred language, project or neighborhood of interest, preferred visit date, lot size or property type of interest, topic and message, whether you are a real estate agent. Required: Fields marked as required in the form (usually name, email and phone). Everything else is optional.
• Optional "details" step. Budget range, buying timeline, preferred language. Optional.
• "Send me news" checkbox. Your choice to receive marketing communications. Optional, unticked by default.
• WhatsApp, email and phone. Your number or address, profile name and anything you write to us. You choose what to share.
• Visits and events. Name, contact details, visit date, people attending and the properties you are interested in. Needed to arrange the visit.
• Reservation and purchase. Copy of your passport or ID, nationality, marital status, address, tax ID, occupation, proof and source of funds, bank details, details of any company or trust buying the property and its beneficial owners, and the signed agreements. Required by law and to sign the contract (see section 5).
• Real estate agents. Name, agency, contact details, licence or registration where applicable, and the clients you introduce. Needed to register the referral.

If you do not give us the required data, we may not be able to answer your enquiry, arrange a visit, send the brochure or, for purchases, complete the sale. Leaving out optional data has no consequences.

Sensitive data. We do not ask for data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life or sexual orientation. Please do not include such data in your messages.

4.2 Data collected automatically

When you use the Site, we and our providers collect:

• Device and connection data: IP address, browser, operating system, device type, language and approximate location derived from the IP address.
• Usage data: pages visited, links and buttons clicked, forms opened and sent, time on the Site and the page that brought you here.
• Campaign data: the advertising or referral source of your visit (UTM parameters such as utm_source and utm_campaign, and Google's click ID gclid). We store the source of your first and most recent visit in your browser so that, if you later send a form, we know which campaign brought you.
• Preferences: for example, whether you view measurements in metric or imperial units.

See section 10 (Cookies and similar technologies) for details.

4.3 Data we receive from others

• Advertising platforms: if you fill in a lead form on Meta or Google, they send us the data you entered in that form, under their lead ad terms.
• Real estate agents and referrers who introduce you to us, when they tell us they have your permission.
• Public sources, such as the National Registry (Registro Nacional), when we verify property, company or identity details during a purchase.

5. Why we use your data

• Answer your enquiry and send what you asked for (prices, availability, brochure, floor plans, reservation terms). Data used: contact and enquiry data.
• Arrange and confirm visits to the sales office and the community. Data used: contact and visit data.
• Assign you an advisor, follow up on your interest and keep a record of our conversations in our customer relationship management (CRM) system. Data used: contact, enquiry and campaign data.
• Prepare, sign and carry out reservation, purchase and related agreements (deeds, payments, deliveries, warranties, owners' association). Data used: purchase data.
• Meet our legal duties, including identity checks and anti-money-laundering rules under Law No. 7786 and its regulations, tax, accounting and consumer protection laws. Data used: purchase data and contact data.
• Send news, launches, pre-sale offers and event invitations, only if you opted in. Data used: contact data and interests.
• Measure which pages and campaigns work, and improve the Site and our advertising. Data used: usage and campaign data.
• Show you Místico ads on other websites and social networks, only if you accept advertising cookies. Data used: cookie and usage data.
• Keep the Site and our forms secure and prevent spam and fraud. Data used: device and connection data.
• Register commissions and referrals with real estate agents. Data used: agent and referral data.
• Establish, exercise or defend legal claims. Data used: any relevant data.

We do not use your data for automated decisions that have legal or similarly significant effects on you.

6. Your consent and other legal bases

Costa Rica. We process your data with your express consent, which you give in writing (on paper or electronically) when you send a form, write to us or sign a document after being informed under this policy. You can withdraw your consent at any time, in the same way you gave it. Withdrawal does not affect processing that took place before it. Law 8968 allows processing without consent only in limited cases, for example when a law or a court order requires it.

European Economic Area, United Kingdom and Switzerland. If those laws apply to you, our legal bases are:

• Steps before a contract and performance of a contract: answering enquiries, visits, reservations and purchases;
• Legal obligation: identity checks, anti-money-laundering, tax and accounting;
• Consent: marketing emails and messages, analytics and advertising cookies;
• Legitimate interests: security, fraud prevention, basic follow-up of your enquiry and the defence of legal claims, which we balance against your rights.

7. Marketing communications

We send news, launches and offers only if you tick "Send me news about Místico projects" or otherwise agree. Every marketing email has an unsubscribe link. You can also reply "STOP" on WhatsApp, or write to [privacy@misticocr.com]. If you unsubscribe, we will still send messages about an enquiry or contract you have with us.

Promotional messages will be identified as such. Any offer will state its terms and how long it is valid.

8. Who receives your data

We do not sell your personal data. We share it only with:

• Our sales team and the advisor assigned to you. To answer and follow up on your enquiry.
• [Desarrollos 506 and companies of the same group that develop or manage Místico]. To manage sales, deliveries and the community.
• Real estate agents you work with, or who introduced you. To coordinate your purchase and their commission.
• Notaries, lawyers, banks, trustees or escrow agents. To formalise purchases and hold deposits or payments.
• The owners' association or condominium administrator, once you buy. Owners' records, fees and community access.
• Service providers who work for us under contract (see the list below). Hosting, forms, CRM, messaging, analytics and advertising.
• Courts, the Superintendence of Financial Entities (SUGEF), the Costa Rican Drug Institute (ICD), tax authorities and other public bodies. When the law or a court order requires it.
• A buyer, investor or successor. If all or part of the business or the project is sold or reorganised, under confidentiality.

Main service providers

• Webflow, Inc. Website hosting and form submissions. Processed in: United States.
• Cloudflare, Inc. Network, security, bot protection (Turnstile) and the connection between the Site and our CRM. Processed in: Global network, including the United States.
• Quickbase, Inc. CRM where enquiries, contacts and follow-ups are stored. Processed in: United States.
• Meta Platforms (WhatsApp, Facebook, Instagram). Messaging, lead forms and advertising. Processed in: United States, Ireland and other countries.
• Google LLC. Analytics, advertising, Google Fonts and maps links. Processed in: United States and other countries.
• Bunny.net, jsDelivr and similar networks. Delivery of videos, scripts and images. Processed in: Global networks.
• Open-Meteo. Local weather shown on the Site (receives your IP address, not your identity). Processed in: European Union.
• [Email marketing provider]. Marketing emails. Processed in: [country].

Our providers may only use the data to provide their service to us and must protect it.

9. International transfers

Several of our providers store data outside Costa Rica, mainly in the United States. By sending us your data after reading this policy, you expressly authorise these transfers for the purposes described here, as required by article 14 of Law 8968. For data protected by EEA or UK law, we rely on the EU–US Data Privacy Framework where the provider is certified, or on standard contractual clauses.

10. Cookies and similar technologies

Cookies are small files that a website stores in your browser. We also use your browser's local storage, which works in a similar way.

• Strictly necessary. Runs the Site, protects forms from spam and remembers your cookie choices. Examples: Webflow, Cloudflare Turnstile, cookie consent. Optional: No, the Site needs them.
• Preferences. Remembers your choices, for example metric or imperial units. Examples: mistico-unit-system (local storage). Optional: Yes, but the Site will forget your choice.
• Attribution. Remembers the campaign or website of your first and most recent visit, so we can tell which campaigns bring enquiries. Examples: mistico_ft, mistico_lt (local storage). Optional: Yes.
• Analytics. Counts visits and measures how the Site is used. Examples: [Google Analytics 4 through Google Tag Manager]. Optional: Yes.
• Advertising. Measures our ads and shows you Místico ads on other sites. Examples: [Meta Pixel, Google Ads]. Optional: Yes.

Your choices. When you first visit, a banner lets you accept or refuse optional cookies. You can change your choice at any time with the "Cookie settings" link in the footer, or by deleting cookies in your browser. [We respect the Global Privacy Control signal sent by your browser as a refusal of advertising cookies.]

Embedded videos and maps may set their own cookies when you play or open them. Social networks set their own cookies when you are signed in to them.

11. How long we keep your data

• Enquiries from people who do not buy. Up to [3] years after our last contact, then deleted or anonymised.
• Marketing preferences. Until you unsubscribe, plus a record of your unsubscribe so we do not contact you again.
• Purchase, identity and anti-money-laundering records. For as long as the contract lasts and afterwards for the periods required by anti-money-laundering, tax, commercial and civil law.
• Analytics and advertising data. According to the provider's settings, at most [14] months.
• Form submissions stored on the website platform. Copied to our CRM and deleted from the platform within [90] days.

12. Security

We protect your data with reasonable technical and organisational measures, including encrypted connections (HTTPS), access only for the people who need it, secured access keys for integrations and confidentiality duties for our staff and providers. No online system is completely secure. If a security incident puts your rights at risk, we will tell you and the authorities as the law requires.

13. Your rights

Under Law 8968 you can, free of charge:

• access your personal data and know how and why we use it;
• correct data that is inaccurate or incomplete;
• delete data that is no longer needed or that we process without a valid basis;
• withdraw your consent, including to marketing, and object to transfers of your data.

If EEA or UK law applies to you, you also have the rights to restrict processing, to data portability and to object to processing based on legitimate interests. Residents of certain US states and of Canada may have similar rights under their local laws, which we will respect where they apply.

How to make a request. Write to [privacy@misticocr.com] with your full name and the email or phone number you used with us. We may ask you to confirm your identity. We answer within five (5) business days, as required by article 7 of Law 8968, or within the period set by the law that applies to you if it is shorter.

Complaints. If you are not satisfied with our answer, you can complain to Costa Rica's Agency for the Protection of Personal Data (PRODHAB, www.prodhab.go.cr) or to the data protection authority where you live.

14. Children

The Site is meant for adults. We do not knowingly collect data from anyone under 18. If you think a minor has sent us their data, write to us and we will delete it.

15. Links to other websites

The Site links to other websites and apps, such as WhatsApp, Google Maps, Waze and the websites of the hotel, restaurants and activity operators. We are not responsible for how they handle your data. Please read their privacy policies.

16. Changes to this policy

We may update this policy when our services or the law change. We will publish the new version on this page with a new "Last updated" date. If a change is significant, we will tell you on the Site or by email, and we will ask for your consent again when the law requires it.

17. Contact

[LEGAL ENTITY NAME]

[Momentum Lindora, 3rd floor, Santa Ana, San José, Costa Rica]

Email: [privacy@misticocr.com]

Phone: [+506 2582-0505]