Privacy policy

This page explains what personal data Hotel Las Tinajas handles, what we use it for, who we share it with and how you can use your rights. It covers this website, the digital room guide, and enquiries and bookings by WhatsApp or phone. It follows Costa Rican Law 8968 on the Protection of Individuals regarding the Processing of their Personal Data, and its Regulations.

Data controller

Hotel Las Tinajas, in downtown Nicoya, Guanacaste, Costa Rica.

What for

Answering your enquiries and bookings, your requests during your stay, and your electronic invoice if you ask for one.

Who with

OnePDA, our technology provider, and the services it uses. We do not sell your data.

Your rights

Access, correction, deletion and withdrawing your authorisation. Message us on WhatsApp al +506 2685 5081. We reply within 5 business days.

1. Who is responsible for your data

• Trade name: Hotel Las Tinajas
• Address: Downtown Nicoya, Guanacaste, Costa Rica (see on Google Maps)
• Phone and WhatsApp: +506 2685 5081

The hotel keeps a database with the personal data from the enquiries, bookings, requests and invoice requests it receives through the channels described below.

2. What data we handle and what for

We handle your data with your authorisation (consent), except for data the law requires us to collect, such as electronic invoice details. We ask for it before collecting any data. When you write to us on WhatsApp, you give us your data voluntarily so that we can reply. On the room guide forms, we ask you to tick an authorisation box before sending, and we keep the date and the version of this policy you accepted. You can withdraw it at any time (section 7).

• Enquiries and bookings by WhatsApp or phoneYour name, phone number, dates, number of guests, room type and whatever you write. We use them to reply, confirm your booking and look after you during your stay.
• ID on arrivalWe ask for your cédula or passport to identify you when you check in. In the record of your stay we note the document type, its number and your nationality. The number and nationality are deleted 30 days after you check out, and they are never included in reports or exports.
• Requests from the room guide (QR code)Your room number (or your name, if you use the lobby code), the request, the quantity or time you choose, any notes you write and your language. They go to the hotel staff so they can handle them. You do not need an account.
• Electronic invoiceIf you ask for one, your name or company name, your cédula (individual or company) or passport number, and your email. We use them only to prepare and send the invoice. Invoices are issued under tax rules, which include reporting them to the tax authority (Ministerio de Hacienda).
• Invitation to review us (optional)If you agree, we write to you after your stay to invite you to leave a review on Google. You can say no, and it does not affect your booking.
• Visiting this websiteWhen you open the site, our hosting provider (Cloudflare) receives technical data, such as your IP address and browser type, to deliver the page and protect the site. We do not use it for advertising or to track you.

We do not ask for health data or other sensitive data, and we ask you not to write it in notes or messages. This site and the guide do not process payments or card data.

3. Which data is required

To answer a booking we need at least one way to reach you (your WhatsApp or phone number) and the dates. In the guide, the room number and the request are required, and your name only if you use the lobby code. For an invoice, your name, ID and email are required. Notes and the review invitation are optional.

If you do not give us the required data, we cannot handle that request. You can keep using the site as usual.

4. How long we keep it

We keep enquiry, booking and request data for 24 months after your last activity with the hotel. After that we delete it or make it anonymous. Invoice request details made through the guide are deleted from that system 90 days after they are handled. Invoices already issued are kept by the hotel for as long as Costa Rican tax rules require. Backups of the guide are kept for 30 days.

5. Who we share your data with

• OnePDAOur technology provider (hello@onepda.cc). It runs the digital room guide (hotel.onepda.cc). It handles data on the hotel's behalf, under a data processing contract and only on our instructions. It does not use the data for its own purposes or sell it.
• Cloudflare and BrevoProviders OnePDA uses for the guide: Cloudflare stores the database and its backups, and Brevo sends the hotel an email alert when a request arrives. Cloudflare also hosts this website.
• WhatsApp (Meta)If you write to us on WhatsApp, the service handles your number and messages under its own privacy policy.
• GoogleReviews and maps belong to Google. If you open Google Maps or leave a review, Google handles your data under its policy. We only see and reply to public reviews.
• AuthoritiesWhen the law requires it, for example the tax authority for invoices.

We do not sell your data or pass it to other companies without your express authorisation. Links to Facebook, Instagram, Waze and Google Maps open third-party sites, which have their own policies.

6. Data outside Costa Rica

The services we use store data on servers outside Costa Rica. The room guide database is on Cloudflare servers set to the European Union, the website is delivered from Cloudflare's global network, email alerts are sent by Brevo (European Union) and WhatsApp belongs to Meta. By giving us your data, you are informed of this and you authorise it. If you do not agree, you can make your enquiry or booking by phone.

7. Your rights

You can ask us to give you access to your data, to correct it, to delete it, and to decide whether you authorise us to pass it to others. You can also withdraw your authorisation at any time, without affecting what was already done. It is free. As a courtesy, you can also ask us to limit its use or to receive a copy in a readable format.

Message us on WhatsApp al +506 2685 5081 or call 2685 5081. Tell us what you want and which number or email you used. We may ask you to identify yourself.

We reply within 5 business days. If you withdraw your authorisation, we carry it out within 5 business days and tell anyone we have passed your data to. If we cannot grant your request, we explain why in writing.

If you think we did not handle your request properly, you can file a complaint with the Agencia de Protección de Datos de los Habitantes (Prodhab), www.prodhab.go.cr.

8. Security

The site and the guide use an encrypted connection (HTTPS). Staff log in to the guide with codes or PINs and have access according to their role, and the guide makes automatic backups. Anyone who handles your data must keep it confidential.

9. Cookies and storage on your device

This site does not use cookies or analytics or advertising tools, and it loads no third-party scripts. The fonts and the map are on our own server.

The room guide saves in your browser (local storage, not cookies) your language, your latest requests so it can show you their status and, if you use the lobby code, your name and room so you do not have to type them again. That data stays on your device and you can delete it in your browser settings.

10. Changes

We may update this policy. The date of the current version is at the bottom of the page.

Version: 29 October 2026