Privacy Policy

This Privacy Policy describes how Costa Vida ("we," "us," "our," or "the Company") collects, uses, discloses, and protects your personal information when you visit our website at mexicancostavida.click, place food orders, interact with our services, or otherwise engage with us. Please read this policy carefully to understand our practices regarding your personal data and your rights in relation to it.

By accessing or using our website, submitting an order, signing up for our newsletter, or otherwise interacting with Costa Vida, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our website and services immediately.

We are committed to protecting your privacy in accordance with applicable United States federal and state laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Federal Trade Commission Act (FTC Act), and other applicable consumer protection statutes.

1. About Us

Costa Vida is a food service company operating in the United States. We are committed to providing our customers with high-quality Mexican-inspired food and beverages through our website and physical locations. Our contact details are as follows:

2. Information We Collect

We collect various types of information in connection with your use of our website and services. The categories of personal information we may collect include, but are not limited to, the following:

2.1 Personal Identification Information

When you register an account, place a food order, make a reservation, or contact us directly, we may collect personal identification information such as:

• Full name
• Email address
• Telephone number
• Mailing or delivery address
• Date of birth (where required for age verification or promotional purposes)
• Username and password for account management
• Profile picture (if voluntarily provided)

2.2 Payment and Financial Information

When you place an order or make a purchase through our website, we collect payment-related information, which may include:

• Credit or debit card details (processed securely through third-party payment processors)
• Billing address
• Transaction history and order records
• Digital wallet information (e.g., PayPal, Apple Pay, Google Pay)

Please note that Costa Vida does not store full payment card numbers on its servers. Payment processing is handled by PCI-DSS compliant third-party payment service providers.

2.3 Order and Dietary Information

As a food service business, we may collect information related to your food preferences, dietary restrictions, allergies, and order history to better personalize your experience and fulfill your requests safely.

2.4 Usage Data and Analytics Information

We automatically collect certain information about your device and how you interact with our website. This includes:

• IP address
• Browser type and version
• Operating system and device type
• Pages visited and time spent on each page
• Referring URLs (the page that directed you to our website)
• Clickstream data and navigation patterns
• Date and time of your visits
• Search queries made on our website
• Error logs and crash reports

2.5 Cookie and Tracking Technology Data

We use cookies, web beacons, pixel tags, local storage objects, and similar tracking technologies to collect information about your browsing behavior on our website. This data may include session identifiers, preferences, and behavioral patterns. For more details, please refer to Section 8 – Cookie Usage of this policy.

2.6 Communications Data

If you contact us via email, phone, web form, social media, or any other channel, we may retain records of those communications, including the content of your messages and any files or attachments you send us.

2.7 Location Data

With your consent, we may collect geolocation data to help you find the nearest Costa Vida location, calculate delivery distances, or provide location-based promotions. You may disable location tracking at any time through your browser or device settings.

2.8 Social Media and Third-Party Account Information

If you choose to log in or register using a third-party social media account (such as Facebook, Google, or Apple), we may receive certain profile information from that platform, subject to your privacy settings on those platforms.

3. How We Use Your Information

Costa Vida uses the personal information we collect for the following purposes:

3.1 Service Provision and Order Fulfillment

• To process and fulfill food orders, including delivery and takeout
• To create and manage your user account
• To send order confirmations, receipts, and status updates
• To process payments and manage billing
• To respond to your inquiries, complaints, and customer service requests
• To accommodate dietary preferences and allergy requirements

3.2 Website Operation and Improvement

• To operate, maintain, and improve the functionality and performance of our website
• To detect and prevent technical errors, fraud, and security incidents
• To conduct internal analytics and understand how users interact with our services
• To test new features and improvements before deployment

3.3 Marketing and Promotional Communications

• To send promotional emails, special offers, newsletters, and marketing communications (with your consent where required)
• To personalize your experience and deliver targeted content based on your preferences and order history
• To run loyalty programs, sweepstakes, contests, and other promotional activities
• To display personalized advertisements on our website and third-party platforms

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any promotional email or by contacting us directly at [email protected].

3.4 Legal Compliance and Protection

• To comply with applicable laws, regulations, and legal obligations
• To respond to lawful requests from government authorities or law enforcement agencies
• To enforce our Terms of Service and other legal agreements
• To protect the rights, property, and safety of Costa Vida, our customers, and the public
• To detect and prevent fraud, unauthorized access, and other illegal activities

3.5 Business Operations

• To manage our business operations, including accounting, auditing, and reporting
• To conduct market research and customer satisfaction surveys
• To evaluate and facilitate business transactions such as mergers or acquisitions

4. Legal Basis for Processing Personal Information

We process your personal information on the following legal grounds:

• Contractual Necessity: Processing is necessary to fulfill your orders and perform our contractual obligations to you.
• Legitimate Interests: We process certain data based on our legitimate business interests, such as improving our services, preventing fraud, and conducting analytics, provided such interests are not overridden by your rights.
• Consent: Where required by law, we will obtain your explicit consent before processing your data, particularly for marketing communications and certain cookies.
• Legal Obligation: We may process your data to comply with applicable laws and respond to valid legal requests.

5. Sharing Your Information with Third Parties

Costa Vida does not sell your personal information to third parties. However, we may share your information with trusted partners and service providers under the following circumstances:

5.1 Service Providers and Vendors

We engage third-party companies and individuals to perform services on our behalf, such as:

• Payment processors and financial institutions
• Delivery and logistics partners
• Cloud hosting and data storage providers
• Email and marketing communication platforms
• Analytics and website performance tools (e.g., Google Analytics)
• Customer relationship management (CRM) software providers
• IT support and cybersecurity service providers

These third parties are contractually obligated to use your information only as directed by us and in accordance with this Privacy Policy. They are not permitted to use your personal data for their own independent purposes.

5.2 Business Transfers

In the event that Costa Vida undergoes a merger, acquisition, reorganization, sale of assets, or bankruptcy proceeding, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website if such a transfer occurs and your information becomes subject to a different privacy policy.

5.3 Legal Requirements and Law Enforcement

We may disclose your personal information if we believe in good faith that such disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or government request
• Protect and defend the rights or property of Costa Vida
• Prevent or investigate possible wrongdoing in connection with our services
• Protect the personal safety of users of our services or the public

5.4 Advertising and Analytics Partners

With your consent, we may share certain anonymized or aggregated data with advertising networks and analytics partners to help us understand our audience and improve our marketing efforts. This data does not directly identify you as an individual.

5.5 Affiliated Companies

We may share your information with our corporate affiliates and subsidiaries for the purposes described in this Privacy Policy. All affiliated entities are required to honor this policy.

6. Data Security

Costa Vida takes the security of your personal information seriously and implements a range of technical, administrative, and physical safeguards to protect your data from unauthorized access, disclosure, alteration, or destruction.

6.1 Security Measures

Our security measures include, but are not limited to:

• Encryption: We use Secure Socket Layer (SSL) / Transport Layer Security (TLS) encryption to protect data transmitted between your browser and our servers.
• Access Controls: Access to personal information is restricted to authorized personnel who need it to perform their job functions.
• Password Protection: User accounts are protected by password authentication. We encourage users to choose strong, unique passwords.
• Firewalls and Intrusion Detection: We employ firewalls and intrusion detection systems to monitor and protect our network.
• Regular Security Audits: We conduct periodic security assessments and vulnerability testing.
• PCI-DSS Compliance: Payment card data is processed in accordance with Payment Card Industry Data Security Standards.

6.2 Data Breach Response

In the event of a data breach that may affect your personal information, Costa Vida will notify affected individuals and relevant authorities as required by applicable law, including the FTC Act and applicable state data breach notification laws. We will take prompt remedial action to contain and address any security incidents.

While we strive to protect your personal information using commercially reasonable methods, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee the absolute security of your data.

7. Your Privacy Rights

Depending on your state of residence within the United States, you may have certain rights regarding your personal information. Costa Vida respects and honors these rights to the fullest extent required by law.

7.1 Rights Available to California Residents (CCPA/CPRA)

If you are a resident of California, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose what personal information we collect, use, disclose, or sell about you, including the categories and specific pieces of information.
• Right to Delete: You have the right to request the deletion of personal information we have collected about you, subject to certain exceptions provided by law.
• Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. Costa Vida does not sell personal information.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of sensitive personal information to only those uses necessary to provide the services you request.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge different prices, or provide a different quality of service based on your exercise of these rights.
• Right to Data Portability: You have the right to receive your personal information in a portable and readily usable format.

7.2 General Rights for All Users

Regardless of your state of residence, Costa Vida extends the following rights to all users:

• Access: You may request access to the personal information we hold about you.
• Correction: You may request that we correct any inaccurate or incomplete information.
• Deletion: You may request deletion of your personal information, subject to certain legal exceptions.
• Opt-Out of Marketing: You may opt out of receiving marketing communications at any time.
• Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time.

7.3 How to Submit a Privacy Request

To exercise any of your privacy rights, please contact us using one of the following methods:

• Email: [email protected]
• Website: mexicancostavida.click

We will respond to verifiable consumer requests within 45 days of receipt. If we require more time, we will notify you of the extension and the reason for it. We may need to verify your identity before processing your request. You may designate an authorized agent to submit a request on your behalf, in which case we may require written proof of authorization.

8. Cookie Usage

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze site traffic, and deliver personalized content and advertisements.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: These cookies are essential for the website to function properly and cannot be disabled. They enable core functions such as security, network management, and account authentication.
• Performance and Analytics Cookies: These cookies collect information about how you use our website, such as which pages you visit most often and whether you receive error messages. This data is used to improve how our website works.
• Functionality Cookies: These cookies allow our website to remember choices you make (such as your preferred language or location) and provide enhanced features.
• Targeting and Advertising Cookies: These cookies are used to deliver advertisements that are relevant to you and your interests. They may be set by us or by third-party advertising partners.

8.2 Managing Cookies

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may impact the functionality of our website. For more detailed information about the cookies we use and your choices regarding cookies, please refer to our full Cookie Policy, available on our website at mexicancostavida.click.

You may also opt out of certain third-party advertising cookies by visiting the Network Advertising Initiative opt-out page or the Digital Advertising Alliance opt-out page.

9. Data Retention

Costa Vida retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Upon expiration of the applicable retention period, we will securely delete or anonymize your personal information in accordance with our data retention and disposal procedures.

10. Children's Privacy

Costa Vida does not direct its website, online ordering system, or marketing activities to children under the age of 18. We do not knowingly solicit or collect personal information from minors. If you are under 18 years of age, please do not use our website or submit any personal information to us.

If we become aware that we have inadvertently collected personal information from a child under 18, we will take immediate steps to delete such information from our records. If you believe that we may have collected information from or about a minor, please contact us immediately at [email protected].

Our practices are designed to comply with the Children's Online Privacy Protection Act (COPPA), which applies to the collection of personal information from children under the age of 13 in the United States. We extend our protections to all individuals under 18.

11. International Data Transfers

Costa Vida is based in the United States and primarily operates within the United States. However, some of our third-party service providers, technology vendors, and analytics partners may be located in or operate from countries other than the United States.

If you are accessing our website from outside the United States, please be aware that your personal information may be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your home country.

When we transfer personal information internationally, we take appropriate steps to ensure that your information receives an adequate level of protection. These steps may include:

• Using contractual clauses approved by relevant data protection authorities
• Ensuring third-party recipients maintain adequate security standards
• Obtaining your consent where required by applicable law

By using our website and services, you acknowledge and consent to the transfer of your personal information to the United States and other countries as described in this Privacy Policy.

12. Third-Party Websites and Links

Our website may contain links to third-party websites, applications, and services that are not owned or controlled by Costa Vida. This Privacy Policy applies only to our website and services. We are not responsible for the privacy practices of third-party websites, and we encourage you to review the privacy policies of any third-party sites you visit.

The inclusion of a link to a third-party website does not imply our endorsement of that website or its privacy practices.

13. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activity tracked. At this time, our website does not respond to browser Do Not Track signals, as there is no universal standard for how websites should respond to such signals. However, we do offer other opt-out mechanisms as described in this Privacy Policy and our Cookie Policy.

14. Your California Privacy Rights – Additional Disclosures

In addition to the rights described in Section 7, California residents are entitled to the following disclosures under the CCPA/CPRA:

14.1 Categories of Personal Information Collected in the Past 12 Months

• Identifiers (name, email address, IP address, account username)
• Commercial information (order history, products purchased)
• Internet or other electronic network activity (browsing history, cookie data)
• Geolocation data (with consent)
• Inferences drawn from personal information (preferences, characteristics)
• Sensitive personal information (payment card data, account login credentials)

14.2 Business Purposes for Collecting Personal Information

We collect personal information for the business purposes described in Section 3 of this policy, including order fulfillment, security, analytics, and marketing communications.

14.3 Categories of Third Parties with Whom We Share Personal Information

• Payment processors
• Cloud hosting providers
• Delivery and logistics partners
• Marketing and advertising platforms
• Analytics service providers
• Legal and compliance advisors

14.4 Shine the Light Law

California Civil Code Section 1798.83 permits California residents to request certain information about our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us at [email protected].

15. Filing Complaints with Regulatory Authorities

If you believe that we have not handled your personal information in accordance with this Privacy Policy or applicable law, you have the right to file a complaint with relevant regulatory authorities.

15.1 Federal Trade Commission (FTC)

The FTC enforces federal consumer protection laws, including those relating to unfair or deceptive privacy practices. You may file a complaint with the FTC online at:

• Website: ftc.gov/complaint
• Phone: 1-877-FTC-HELP (1-877-382-4357)

15.2 California Privacy Protection Agency (CPPA)

California residents may file complaints related to CCPA/CPRA violations with the California Privacy Protection Agency:

• Website: cppa.ca.gov

15.3 State Attorney General Offices

Many U.S. states have Attorney General offices that handle consumer protection complaints, including privacy-related matters. You may contact the Attorney General in your state of residence for assistance.

Before filing a complaint with a regulatory authority, we encourage you to contact us directly so that we may have the opportunity to resolve your concerns:

• Email: [email protected]
• Website: mexicancostavida.click

16. Changes to This Privacy Policy

Costa Vida reserves the right to update or modify this Privacy Policy at any time. When we make changes, we will revise the "Last Updated" date at the top of this page and, where appropriate, notify you via email or a prominent notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our website or services after any changes to this Privacy Policy constitutes your acceptance of the revised policy.

If we make material changes that significantly affect your rights or how we handle your personal information, we will provide more prominent notice and, where required by law, seek your consent.

17. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our privacy practices, please do not hesitate to contact us. We are committed to addressing your inquiries promptly and professionally.

We aim to respond to all privacy-related inquiries within 30 business days. For requests submitted under the CCPA/CPRA or other applicable state privacy laws, we will respond within the timeframes required by law (generally 45 days, with possible extension of an additional 45 days when reasonably necessary).