Privacy Policy

This Privacy Policy describes how Costa Vida ("we," "us," "our," or the "Company") collects, uses, discloses, and protects your personal information when you visit our website at food-costavida.top (the "Site"), place food orders, use our services, or otherwise interact with us. Please read this policy carefully. By accessing or using our Site and services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

We are committed to protecting your privacy and handling your personal information responsibly, in full compliance with applicable United States federal and state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Federal Trade Commission Act (FTC Act), and other applicable regulations governing the food service industry.

1. About Us

Costa Vida is a food service business operating in the United States. We provide food-related products and services to our customers through our website and other channels. Our contact information for all privacy-related matters is as follows:

For any questions, concerns, or requests relating to this Privacy Policy or our data practices, you may contact us at the email address provided above. We are dedicated to responding to all privacy inquiries in a timely and professional manner.

2. Scope of This Privacy Policy

This Privacy Policy applies to:

• All visitors to our website at food-costavida.top
• Registered users and account holders
• Customers who place food orders online or through our services
• Individuals who subscribe to our newsletters, promotions, or marketing communications
• Individuals who participate in surveys, contests, or promotional events
• Any person who contacts us via email, phone, or other communication channels

This policy does not apply to third-party websites, applications, or services that may be linked from our Site. We encourage you to review the privacy policies of any third-party platforms you visit independently, as we are not responsible for their data practices.

3. Information We Collect

We collect various types of information in connection with your use of our services. The categories of personal information we collect are detailed below.

3.1 Personal Identification Information

When you register for an account, place an order, subscribe to our communications, or otherwise engage with our services, we may collect the following personal identification information:

• Full name — used to personalize your experience and address correspondence
• Email address — used for order confirmations, account management, and marketing communications
• Phone number — used for order-related notifications and customer support
• Billing and delivery address — used to process and fulfill your food orders
• Date of birth — used to verify age eligibility where required
• Username and password — used to secure and manage your account

3.2 Payment and Financial Information

When you make a purchase or place a food order through our Site, we collect payment-related information. Please note that we do not store your full credit or debit card numbers on our servers. Payment processing is handled by trusted, PCI-DSS-compliant third-party payment processors. However, we may retain:

• Last four digits of payment card numbers (for reference purposes)
• Billing address associated with the payment method
• Transaction identifiers and order history
• Payment status and confirmation records

3.3 Order and Transaction Information

As a food service provider, we collect detailed records of your interactions with our ordering system, including:

• Food items ordered, customizations, and special instructions
• Order dates, times, and frequency
• Delivery or pickup preferences
• Order history and past purchases
• Loyalty program participation and reward points
• Customer feedback, ratings, and reviews

3.4 Usage and Technical Data

When you visit our website, we automatically collect certain technical information about your device and how you use our Site, including:

• IP address — used for security, fraud prevention, and approximate geographic location
• Browser type and version
• Operating system and device type (desktop, mobile, tablet)
• Pages visited and navigation paths through our Site
• Time and duration of your visits
• Referring URLs — websites that directed you to our Site
• Click patterns and interaction data
• Search queries entered on our Site
• Error logs and performance data

3.5 Location Information

With your permission, we may collect precise geolocation data from your device to provide location-based services, such as identifying the nearest Costa Vida location or estimating delivery times. You may disable location services at any time through your device settings, though this may limit certain features of our service.

3.6 Cookie and Tracking Data

We use cookies, web beacons, pixel tags, and similar tracking technologies to collect information about your browsing behavior on our Site. This includes session identifiers, preference settings, shopping cart contents, and analytics data. For detailed information about our use of cookies, please refer to Section 9 of this Privacy Policy.

3.7 Communications and Customer Support Data

When you contact us for support, submit feedback, or communicate with us by any means, we collect and retain records of those communications, including:

• Email correspondence and attachments
• Chat transcripts (if applicable)
• Survey responses and feedback forms
• Social media messages and mentions directed at us

3.8 Information from Third Parties

We may receive information about you from third-party sources, including:

• Social media platforms if you connect your social account to our services
• Analytics providers and advertising partners
• Delivery platform partners and food aggregators
• Publicly available databases for fraud prevention and identity verification

4. How We Use Your Information

We use the personal information we collect for specific, legitimate business purposes. We process your data only when we have a valid legal basis for doing so, which may include contract performance, legal compliance, legitimate business interests, or your explicit consent.

4.1 Providing and Managing Our Services

• Processing and fulfilling your food orders, including delivery or pickup coordination
• Creating and managing your customer account
• Sending order confirmations, receipts, and status updates
• Processing payments and managing billing inquiries
• Providing customer support and responding to your inquiries
• Managing loyalty programs, rewards, and promotional offers

4.2 Improving Our Services and Products

• Analyzing usage patterns to improve the functionality and design of our website
• Conducting research and development to expand our food offerings
• Monitoring and analyzing trends in customer preferences and ordering behavior
• Testing new features, promotions, and menu items
• Generating aggregate, anonymized statistical reports about our business performance

4.3 Marketing and Promotional Communications

• Sending you promotional emails, newsletters, and special offers about Costa Vida products and services
• Personalizing marketing content based on your order history and preferences
• Displaying targeted advertisements on our Site and third-party platforms
• Conducting contests, sweepstakes, and promotional campaigns
• Notifying you about seasonal menu changes, new locations, and special events

You may opt out of receiving marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us directly at [email protected]. Please note that even if you opt out of marketing communications, we may still send you transactional or service-related messages.

4.4 Security, Fraud Prevention, and Legal Compliance

• Detecting, investigating, and preventing fraudulent transactions and other illegal activities
• Verifying your identity and authenticating account access
• Monitoring our systems for security threats and vulnerabilities
• Complying with applicable laws, regulations, and legal obligations
• Enforcing our Terms of Service and other agreements
• Responding to lawful requests from government authorities and law enforcement agencies

5. Sharing Your Information with Third Parties

We respect your privacy and do not sell your personal information to third parties for their independent marketing purposes. However, we may share your information with trusted third parties in the following circumstances:

5.1 Service Providers and Business Partners

We work with carefully selected third-party service providers who assist us in operating our business and delivering our services. These providers are contractually obligated to handle your data securely and only for the purposes we specify. Categories of service providers include:

• Payment processors — to securely handle financial transactions
• Delivery and logistics partners — to fulfill food delivery orders
• Cloud hosting and IT infrastructure providers — to maintain our website and data systems
• Email and marketing automation platforms — to send communications on our behalf
• Analytics providers (e.g., Google Analytics) — to analyze website usage and performance
• Customer support software providers — to manage support interactions
• Advertising networks — to deliver targeted advertisements
• Fraud prevention and identity verification services

5.2 Legal Requirements and Law Enforcement

We may disclose your personal information to government authorities, regulatory bodies, law enforcement agencies, or courts when required to do so by applicable law, legal process, or lawful government request, including but not limited to:

• Responding to subpoenas, court orders, or other legal processes
• Complying with requests from regulatory agencies, including the Federal Trade Commission (FTC)
• Investigating and reporting potential violations of law
• Protecting the rights, property, or safety of Costa Vida, our customers, or the public

5.3 Business Transfers

In the event that Costa Vida undergoes a merger, acquisition, reorganization, bankruptcy, asset sale, or similar business transaction, your personal information may be transferred as part of that transaction. We will provide notice to affected users in the event of such a transfer, and this Privacy Policy will continue to govern your personal information following any transfer.

5.4 With Your Consent

We may share your personal information with third parties in other circumstances when you have given us your explicit consent to do so, such as when you participate in co-branded promotions or choose to connect third-party applications to your account.

6. Data Security

Costa Vida takes the security of your personal information seriously. We implement a comprehensive set of technical, administrative, and physical security measures designed to protect your data from unauthorized access, disclosure, alteration, loss, or destruction.

6.1 Technical Security Measures

• SSL/TLS Encryption: All data transmitted between your browser and our website is encrypted using Secure Socket Layer (SSL) / Transport Layer Security (TLS) technology.
• Secure Data Storage: Personal information is stored on secured servers protected by firewalls, intrusion detection systems, and access controls.
• Password Hashing: Account passwords are stored in hashed and salted format and are never stored in plain text.
• Regular Security Audits: We conduct regular security assessments, vulnerability scans, and penetration testing of our systems.
• Two-Factor Authentication: Where available, we offer and encourage the use of two-factor authentication to protect account access.

6.2 Administrative Security Measures

• Access to personal data is restricted to authorized employees and contractors who require it for legitimate business purposes.
• All personnel with access to personal data are required to comply with confidentiality obligations and receive regular privacy and security training.
• We maintain documented data breach response procedures and are prepared to notify affected users and relevant authorities in the event of a significant data security incident as required by applicable law.

6.3 Limitations

Despite our best efforts, no method of data transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your personal information. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately at [email protected].

7. Your Privacy Rights

Depending on your state of residence in the United States, you may have certain rights regarding your personal information. We are committed to honoring these rights in accordance with applicable law.

7.1 Rights Under the California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have the following rights under the CCPA as amended by the CPRA:

• Right to Know: You have the right to request that we disclose what personal information we have collected about you, the categories of sources from which it was collected, the purposes for collection, and the categories of third parties with whom we have shared it.
• Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain legal exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising purposes. Costa Vida does not sell personal information for monetary consideration, but we may share data with advertising partners. You may exercise this right by contacting us.
• Right to Limit Use of Sensitive Personal Information: Where applicable, you have the right to limit our use of sensitive personal information to purposes permitted by the CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny services, charge different prices, or provide a different level of service based on your exercise of privacy rights.

7.2 General Privacy Rights for All U.S. Residents

• Right of Access: You may request a copy of the personal information we hold about you.
• Right to Correction: You may request that we correct inaccurate or incomplete personal information.
• Right to Deletion: You may request deletion of your personal information, subject to our legal obligations to retain certain data.
• Right to Data Portability: Where technically feasible, you may request that we provide your personal information in a structured, machine-readable format.
• Right to Withdraw Consent: Where we process your data based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.
• Right to Opt Out of Marketing: You may opt out of receiving marketing communications from us at any time.

7.3 How to Exercise Your Rights

To exercise any of the rights described above, please submit a request to us using one of the following methods:

• Email: [email protected]

When submitting a request, please include sufficient information to verify your identity and specify the nature of your request. We will respond to verifiable consumer requests within 45 days of receipt, with the possibility of a 45-day extension when reasonably necessary and with prior notice. We will not charge a fee for processing reasonable requests unless they are excessive, repetitive, or clearly unfounded.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. The specific retention periods vary depending on the type of data and the purpose for which it was collected:

At the end of the applicable retention period, we will securely delete or anonymize your personal information in accordance with our data disposal procedures. Anonymized data may be retained indefinitely for statistical and research purposes.

9. Cookie Policy

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze site traffic, and serve personalized content and advertising. Below is a brief overview of our cookie practices.

9.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work more efficiently and to provide information to website operators. We also use similar technologies such as web beacons, pixel tags, local storage objects, and session identifiers.

9.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the website to function properly. These enable core features such as shopping cart functionality, account authentication, and security. These cookies cannot be disabled.
• Performance and Analytics Cookies: Collect information about how visitors use our website, such as which pages are visited most often, how long users spend on each page, and any error messages encountered. This data helps us improve website performance.
• Functionality Cookies: Allow our website to remember choices you make (such as your preferred language, location, or saved cart items) and provide enhanced, personalized features.
• Targeting and Advertising Cookies: Used to deliver advertisements relevant to your interests. They also help us measure the effectiveness of our marketing campaigns and limit the number of times you see the same advertisement.

9.3 Managing Your Cookie Preferences

You can control and manage cookie settings in the following ways:

• Through our cookie consent banner displayed upon your first visit to the Site
• By adjusting your browser settings to refuse or delete cookies
• By using opt-out tools provided by third-party analytics providers such as Google Analytics (Google Analytics Opt-Out)
• By contacting us at [email protected] for assistance

Please note that disabling certain cookies may affect the functionality of our website and your ability to use certain features, including online ordering.

10. Children's Privacy

Costa Vida's website and services are intended for use by individuals who are 18 years of age or older. We do not knowingly collect, solicit, or process personal information from children under the age of 13, in compliance with the Children's Online Privacy Protection Act (COPPA), or from minors under 18 for certain sensitive data categories.

If you are a parent or guardian and believe that your child under the age of 13 has provided personal information to us without your consent, please contact us immediately at [email protected]. Upon verification, we will promptly delete such information from our records.

We do not knowingly direct marketing content to minors, and we take reasonable precautions to ensure that our services are not used by individuals under the age of 18. If we discover that we have inadvertently collected personal information from a minor, we will take appropriate steps to delete that information as quickly as possible.

11. International Data Transfers

Costa Vida is a United States-based business, and our primary data processing activities take place within the United States. However, some of our third-party service providers may be located in or operate from other countries, which means your personal information may be transferred to, stored, or processed in countries outside the United States.

When we transfer personal information internationally, we take appropriate measures to ensure that adequate levels of data protection are maintained, including:

• Entering into data processing agreements with international service providers that include appropriate data protection clauses
• Ensuring that transfers are made to countries with adequate data protection frameworks recognized under applicable U.S. and international law
• Applying technical and organizational safeguards consistent with applicable legal requirements

By using our services, you acknowledge and consent to the transfer of your personal information to the United States and potentially other countries as described in this section. If you have concerns about international data transfers, please contact us at [email protected].

12. Third-Party Links and Services

Our website may contain links to third-party websites, social media platforms, delivery partner pages, and other external services. These third-party sites have their own privacy policies and data practices, which are independent of and separate from this Privacy Policy. We do not control, endorse, or take responsibility for the privacy practices of any third-party websites or services.

We encourage you to read the privacy policies of any third-party websites you visit through links on our Site. Our Privacy Policy applies solely to information collected directly by Costa Vida through food-costavida.top and our affiliated services.

13. Do Not Track Signals

Some web browsers and devices offer a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activity tracked. Because there is currently no universally accepted standard for responding to DNT signals, our website does not currently alter its data collection or use practices in response to DNT signals from your browser. We will continue to monitor developments in this area and update our practices as industry standards evolve.

For California residents, please note that we do not sell personal information as that term is defined under the CCPA/CPRA, and we provide opt-out options for cross-context behavioral advertising as described in Section 7 of this Privacy Policy.

14. Changes to This Privacy Policy

We reserve the right to update, modify, or revise this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or business operations. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page
• Post a prominent notice on our website informing users of the changes
• Where required by law or where changes are significant, send a notification to registered users via email

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our website and services following the posting of any changes constitutes your acceptance of those changes. If you do not agree with the updated policy, please discontinue your use of our services and contact us if you wish to exercise any applicable data rights.

15. Filing Complaints with Data Protection Authorities

If you believe that we have not handled your personal information in accordance with applicable privacy laws, you have the right to file a complaint with the appropriate regulatory authority.

15.1 Federal Complaints — FTC

At the federal level in the United States, the Federal Trade Commission (FTC) oversees consumer privacy practices under the FTC Act. If you believe your privacy rights have been violated and you have been unable to resolve the matter directly with us, you may file a complaint with the FTC:

15.2 California Residents — California Privacy Protection Agency

California residents may also direct privacy complaints to the California Privacy Protection Agency (CPPA), which is responsible for enforcing the CCPA/CPRA:

15.3 State Attorney General Offices

Residents of other U.S. states may have the right to file complaints with their respective State Attorney General's office regarding alleged violations of state privacy laws. We encourage you to explore the resources available in your specific state of residence.

Before filing a formal complaint with any regulatory authority, we encourage you to contact us directly at [email protected] to allow us the opportunity to address your concerns. We are committed to resolving privacy issues promptly and transparently.

16. Contact Us

If you have any questions, concerns, requests, or feedback regarding this Privacy Policy or our data practices, please do not hesitate to reach out to us. We take all privacy inquiries seriously and will respond to your communications as promptly as possible.

When contacting us about a privacy matter, please include the following information to help us address your request efficiently:

• Your full name and contact information
• A description of your inquiry, concern, or request
• If submitting a data rights request, information sufficient to verify your identity
• Any relevant order numbers or account identifiers (where applicable)