Website Privacy Policy

1 Who this notice covers

Toucan Valley S.A. is responsible for personal information collected through the public Toucan Valley website, direct booking tools, enquiry forms and the guest-facing My Trips area. This notice explains what we collect, why we use it, who may receive it and how a person may exercise privacy rights.

It applies to website visitors, prospective and confirmed guests, accompanying occupants, rental and sales enquirers, and people communicating with Toucan Valley through the site. Separate notices or platform terms may also apply when a booking begins on Airbnb, Booking.com, Vrbo or another provider.

Privacy contact: [INSERT PRIVACY EMAIL] Postal address: [INSERT POSTAL ADDRESS]

2 Information we collect

We ask for sensitive information only when necessary, for example an accessibility need, emergency, identity requirement or legal obligation. Do not submit passport, bank-card or health information through an ordinary message unless Toucan Valley specifically requests it through an approved secure process.

3 How and why we use information

• Respond to rental and sales enquiries and provide requested information.
• Create, administer, amend and support reservations; coordinate arrival, access, housekeeping, maintenance and guest services.
• Process charges, refunds and accounting records through approved booking and payment services.
• Operate My Trips, remember language choices, protect accounts and diagnose website or booking problems.
• Comply with tax, tourism, corporate, insurance, safety and lawful authority requirements.
• Prevent fraud, protect people and property, investigate complaints or damage, and establish or defend legal claims.

Toucan Valley uses personal information with informed consent, to take requested pre-contractual steps or perform a reservation or other agreement, to meet legal duties, and for other purposes permitted by Costa Rican law. We do not sell personal information or use booking data for unrelated marketing. Promotional email will be sent only where permitted, and the recipient may unsubscribe.

4 Cookies embedded tools and payment information

The site uses essential cookies or similar storage for security, sessions, language preferences and requested functions. The embedded Sirvoy booking tool and other approved services may set their own cookies. Any non-essential analytics or marketing technology must be identified and, where required, activated only after consent. Browser settings can block cookies, but essential features may then fail.

Full payment-card details must remain within Sirvoy Vault or another approved payment processor and must not be copied into website notes, email, screenshots or My Trips. Toucan Valley may retain transaction references, amounts, payment status and records needed for accounting, refunds or disputes.

5 Who may receive information

Access within Toucan Valley is limited to people who need the information for reservations, guest service, finance, safety, maintenance, claims, legal compliance or technical support. Shareholding or Board status alone does not authorize routine access to identifiable guest records.

• Sirvoy and approved website, database, email, payment, communications and security providers acting under applicable contractual and confidentiality controls.
• Airbnb, Booking.com, Vrbo or another booking channel where needed to administer a platform reservation or resolve a claim.
• Banks, accountants, attorneys, insurers and public authorities where reasonably necessary or legally required.
• Crew or contractors only to the extent needed to prepare or service the villa, provide access, accommodate a disclosed need or address an incident.

Some providers process data outside Costa Rica. Toucan Valley will assess the purpose, destination, contractual safeguards and security of cross-border processing and disclose only the minimum reasonably required.

6 Retention security and children

Records are kept only for the operational, contractual, tax, tourism, insurance, limitation or dispute period that applies. Information under audit, investigation, claim or legal hold is preserved until the matter ends. Unneeded records and duplicates are securely deleted, destroyed or anonymized.

Toucan Valley uses named accounts, role-based permissions, password protection, multifactor authentication where practical, secure backups, limited exports, access review and prompt removal of obsolete access. No internet system can be guaranteed completely secure; suspected misuse or loss should be reported immediately to the privacy contact.

The website is not directed to children. A booking must be made by an adult. Information about a minor is collected only from an authorized adult and only as needed for the stay, safety or law.

7 Your choices and rights

Subject to Law No. 8968 and applicable exceptions, a person may ask whether Toucan Valley holds their personal information, request access, correction, updating or deletion, withdraw optional consent, object to unauthorized use, or report a security concern. Toucan Valley may verify identity and may retain information that must be kept by law or for an existing claim. A person may also contact Costa Rica’s data-protection authority, PRODHAB.

Send a request to the privacy contact shown in Section 1. Identify the relevant booking, enquiry or account and the right requested, but do not send unnecessary identity documents by ordinary email.

8 Changes to this notice

Toucan Valley may update this notice when the website, providers or law changes. The current version and effective date will be posted on the public website. Material changes affecting existing information will be communicated where appropriate.

Legal and service references

This document should be read with applicable Costa Rican law and the current terms of relevant service providers. The principal references used for this draft are:

• Costa Rica Law No. 8968 on personal-data processing
• Costa Rican legal information system SINALEVI
• Sirvoy Privacy Policy
• Airbnb Host Privacy Standards
• Booking.com Privacy Notice
• Vrbo Privacy Statement

Approval and publication

The Board of Directors adopts this document by resolution. It takes effect on the approved date and may be published on the relevant part of the Toucan Valley website. Material changes require review and approval.