Privacy Policy

1. Data controller

The controller of the databases described in this policy is Jason Gustavo Bustos Vásquez, national identity card (cédula) 1-1547-0070, operating under the trade name KcodeStudio.

Address: Urbanización Jesús, Calle 36E, Casa 36E — del Bar El Pará 600 m norte y 600 m oeste, Patalillo (San Antonio), Vázquez de Coronado, San José, 11104, Costa Rica.

• Email for privacy matters: contacto@kcodestudio.com
• Phone and WhatsApp: +506 6406-9541

2. Data collected through the contact form

When someone completes the contact form on the website, only the data that the person types into it is collected:

• The name the person provides.
• Email address.
• The content of the message written, including any information the person chooses to include about their project or company.

3. Data processed by K-Cita Bot on WhatsApp

K-Cita Bot is the WhatsApp appointment-scheduling assistant developed and operated by KcodeStudio. It runs on Meta’s WhatsApp Business Platform, which means the conversation travels through Meta’s infrastructure before reaching our systems.

When a person writes to K-Cita Bot, the following data is processed:

• The WhatsApp phone number the person writes from.
• The public WhatsApp profile name, as transmitted by the platform itself.
• The content of the messages the person sends to the bot and of the replies the bot returns.
• Date, time and technical message identifiers, generated by the WhatsApp platform.
• Appointment data: requested date and time, service or reason given, and any additional data the person voluntarily provides during the conversation.

K-Cita Bot does not request passwords, card numbers or banking details, and is not designed to collect sensitive data within the meaning of article 9 of Law No. 8968. If a person sends such data on their own initiative, it is deleted as soon as it is detected.

Conversation content is not used for advertising, is not shared with third parties for commercial purposes and is never sold.

4. Technical browsing data

The hosting provider generates automatic technical access logs, which may include the IP address, the date and time of the request, the browser type and the page requested. They are used exclusively to operate the service, diagnose failures and protect it against abuse.

This site does not use advertising or third-party tracking cookies for profiling purposes.

5. Purpose of processing

The data described is processed solely for the following purposes:

• Responding to enquiries received through the contact form and following up on the request commercially.
• Scheduling, confirming, reminding, rescheduling and cancelling appointments through K-Cita Bot.
• Preparing and sending quotations, and managing the contractual relationship with those who contract a service.
• Issuing electronic receipts and complying with the tax and accounting obligations required by Costa Rican law.
• Maintaining the security and correct operation of the site and its systems.

No automated decisions with legal effects are taken about individuals, and no behavioural profiles are built.

6. Legal basis

The basis legitimising the processing is the informed consent of the data subject, given expressly and freely in accordance with article 5 of Law No. 8968: by submitting the contact form or voluntarily starting a conversation with K-Cita Bot, the person provides their data with knowledge of this policy.

Where a contractual relationship already exists, processing is additionally based on the performance of that relationship and, as regards invoicing, on compliance with the legal obligations applicable to the controller.

Consent may be withdrawn at any time, without retroactive effect, through the means indicated in the data deletion section.

7. Retention period

Data received through the contact form that does not lead to a contract is retained for a maximum of 12 months from the last contact, and is then deleted.

Data processed by K-Cita Bot is retained while the person has active appointments and for up to 12 months after the last appointment attended, in order to evidence the service provided and handle complaints.

Client data under a contractual relationship is retained for the term of the contract and, once terminated, for the statutory and tax limitation periods required by Costa Rican law, blocked and accessible only to address legal responsibilities.

In all cases, a deletion request is handled under the procedure described below, except for data that must be retained by legal obligation.

8. Processors and international transfers

The following providers are used to deliver the service. They process data on behalf of the controller and solely according to its instructions:

• Netlify, Inc. (Estados Unidos) — Website hosting and technical access logs.
• EmailJS (Estados Unidos) — Delivery of messages submitted through the contact form.
• Supabase, Inc. (Estados Unidos) — Database storing client management and quotation records.
• Zoho Corporation (India / Estados Unidos) — Email service for the contacto@kcodestudio.com address.
• Meta Platforms, Inc. — WhatsApp Business Platform (Estados Unidos) — Transport of the WhatsApp messages exchanged with K-Cita Bot.

Some of these providers host or process information outside Costa Rica, mainly in the United States. By providing their data, the data subject consents to that international transfer under article 14 of Law No. 8968. Each provider’s own data processing terms apply, requiring equivalent security and confidentiality measures.

Beyond these processors, data is not disclosed to third parties, except at the request of a competent judicial or administrative authority.

9. Rights of access, rectification, cancellation and objection

Every data subject may exercise, free of charge, the rights of access to their data, rectification of inaccurate or incomplete data, cancellation or deletion when it is no longer necessary, and objection to processing.

To exercise them, simply write to contacto@kcodestudio.com stating the right you wish to exercise and providing one detail that identifies the record: the email address used to submit the form, or the WhatsApp number used to talk to K-Cita Bot.

Every request is answered within a maximum of 5 business days from receipt, in accordance with article 7 of Law No. 8968.

10. Data deletion procedure

Anyone may request the deletion of all their data, both from the contact form and from K-Cita Bot. The procedure is free of charge and does not require giving a reason.

Deletion means that previous appointments or requests linked to that data can no longer be processed.

11. Security measures

Reasonable technical and organisational measures are applied to protect data against loss, unauthorised access, alteration or disclosure: encrypted transmission via HTTPS across the whole site, administration areas restricted by credentials and token authentication, and access to information limited to the people who need to process it.

No system is completely infallible. In the event of a security incident affecting personal data, the affected individuals and the competent authority will be informed in accordance with the applicable regulations.

12. Minors

The services on this site and K-Cita Bot are aimed at adults and businesses. Data from minors is not knowingly collected. If it is detected that data from a minor has been received without the authorisation of their legal representative, it is deleted immediately.

13. Complaints to the supervisory authority

Regardless of the above, any data subject may file a complaint with the Agencia de Protección de Datos de los Habitantes (PRODHAB) of Costa Rica if they consider that the processing of their data does not comply with Law No. 8968.

14. Changes to this policy

This policy may be updated to reflect legal, technical or operational changes. The version in force is always the one published on this page, with its last updated date at the top. If a change were to substantially affect the processing of data already collected, it will be communicated through the available contact channels.