Política de privacidad del portal de propietarios

1 Purpose scope and controlling rule

This policy governs personal information stored, viewed, uploaded, exported or communicated through the password-protected Toucan Valley owner portal. It applies to shareholders, lot owners, directors, management, employees, crew, contractors, administrators and authorized advisers.

Core rule. Access follows the person’s current role and genuine need. A login, shareholder interest, Board position or technical administrator role does not create unrestricted permission to read, copy, download, publish or use personal information.

Privacy contact: [INSERT PRIVACY EMAIL] Postal address: [INSERT POSTAL ADDRESS]

2 Information held in the portal

• Account and profile details, including name, contact information, photograph, country, preferred language, login role, tags and security or activity logs.
• Shareholder, lot owner and corporate records, including corporation name, villa or lot association, ownership or voting information, start date and official records required for administration.
• Private administration details, which may include address, emergency contact, passport expiry, identity document where genuinely required, signatures, banking or payment information and restricted administrator notes.
• Rental and sales programme participation, villa records, availability, blocked dates, financial summaries, listings, enquiries and supporting documents.
• Maintenance requests, locations, descriptions, photographs, comments, priority, assignment, status and completion records.
• Directory choices, calendar events, communications, approvals, document-folder access and PDF or other authorized exports.

Toucan Valley will collect the minimum information reasonably needed for corporate governance, ownership administration, contracts, rental and sales programmes, maintenance, safety, accounting, legal compliance and portal security.

3 Role based access

4 Directory shareholder list and exports

Member directory

Directory participation is optional. A member may choose whether to display a preferred name, photograph, villa or lot identifier, selected contact details and broad location. Visibility choices must be respected and may be changed or withdrawn. Passport, bank, signature, emergency contact, private notes and precise home address must never appear in the directory.

Shareholder list and corporate inspection

The Board and Management may use the shareholder list for governance and corporate administration. A lawful right to inspect corporate books does not automatically authorize disclosure of unrelated personal data. Toucan Valley may use a summary, redaction, supervised inspection or adviser report and will obtain Costa Rican legal advice for disputed requests. Privacy must not be used to conceal material corporate finances, contracts, conflicts or misconduct.

Downloads and PDF exports

Only an authorized role may export a list or document. The export must contain only the required columns, be stored on an approved protected device or folder, be sent only to intended recipients and be deleted when its purpose ends. Portal data must not be copied to personal devices, private email, public links or broad messaging groups. Screenshots are treated as exports.

5 Guest bookings calendars and Sirvoy

The portal may display public or owner-only calendar events and Sirvoy availability. Board members and shareholders in the rental programme may receive calendar-only access showing dates, availability and blocked dates. They may not see guest identity, contact, messages, payment or other reservation details through that access.

Management and specifically assigned reservation, guest-service, finance or incident personnel may access the minimum identifiable guest information required for their duties. Shareholding or association with a villa alone is not a reason to disclose who is staying there.

6 Documents maintenance records and private fields

Corporate and shareholder documents must remain in nonpublic, password-protected folders separated by purpose and role. Identity, banking, personnel, legal, investigation and administrator-note records must be segregated from routine portal files. A public link must not be used for a private document.

An owner normally sees their own maintenance requests. Authorized Admin, Board, Management and Employee roles may have broader portal visibility under current permissions; each person must use that access only for assignment, supervision, safety, budgeting or governance. Ticket photographs and comments must avoid unnecessary images of people, identity documents, payment information or private living areas.

Private administrator notes are for restricted administrative use and are not visible to Board or Management through the portal. Notes must be factual, relevant, respectful and limited to what is necessary. They must not be used to hide a record that the Board or a shareholder is legally entitled to inspect.

7 Security duties

Use only your own named account. Never share a password, authentication code or recovery link.

Use a strong unique password and multifactor authentication where available. Lock devices and sign out on shared or unattended equipment.

Open, download or search only the information needed for an authorized task. Do not browse out of curiosity.

Do not upload personal information into a general folder, calendar entry, ticket or note when a restricted field or folder is available.

Report suspected loss, misdirection, unauthorized access, publication, altered permissions or account misuse immediately to Management, the privacy contact or a Board officer.

Management must review permissions at least annually and after every role change, and remove access promptly when duties end.

8 Use sharing retention and individual rights

Portal information may be used only for corporate governance, ownership and programme administration, accounting, maintenance, safety, legal compliance, claims, member communications and system security. It may be shared with approved accountants, attorneys, insurers, technology providers, banks or authorities only for an authorized purpose and in the minimum amount required.

Supabase and other approved hosting, database, authentication or backup providers may process portal data for Toucan Valley. Sirvoy processes booking information for Toucan Valley. Providers and cross-border processing must be reviewed for appropriate contractual, confidentiality and security protections.

Records are kept according to approved corporate, tax, labour, CCSS, tourism, insurance, contractual, limitation and dispute needs. Material subject to an audit, claim, investigation or legal hold must be preserved. Unneeded records, exports and duplicates must be securely deleted, destroyed or anonymized.

Subject to Law No. 8968 and applicable corporate-law limits, a person may request access to their own information, correction, updating or deletion, withdraw optional directory consent, or report unauthorized use. Toucan Valley may verify identity and will document the request and response. A person may also contact PRODHAB.

9 Administration incidents and enforcement

The Board designates a privacy coordinator and an administrator for portal accounts and permissions. The privacy coordinator maintains access and retention controls, coordinates requests and incidents, and reports material issues to the Board. The administrator carries out approved technical changes and must not use privileged access for any other purpose.

Toucan Valley will contain and investigate a suspected incident, preserve evidence, determine affected information and persons, obtain appropriate assistance, give legally required notices and correct the underlying weakness. Unauthorized access, disclosure, copying or use may result in removal of access, disciplinary or contractual action, termination or referral to legal authorities.

Legal and service references

This document should be read with applicable Costa Rican law and the current terms of relevant service providers. The principal references used for this draft are:

• Costa Rica Law No. 8968 on personal-data processing
• Costa Rican legal information system SINALEVI
• Sirvoy Privacy Policy
• Sirvoy guidance on its role as data processor
• Supabase Privacy Policy

Approval and publication

The Board of Directors adopts this document by resolution. It takes effect on the approved date and may be published on the relevant part of the Toucan Valley website. Material changes require review and approval.