Privacy Policy

Pacific Dirt Roads is responsible for the personal information described in this policy. This notice applies to our public website, booking flow, customer communications, and the restricted operational backoffice used by authorized staff.

Frente Taco Corner, Playa Carmen, Santa Teresa, Costa Rica. Email: info@quadtourscostarica.com. Phone: +506 2101-5736.

• Contact details, including your name, email address, phone number, and the communications you send us.
• Booking details, including the activity, dates, duration, party size, notes, quoted amount, payment status, and reservation history.
• Information our staff may need to operate a rental safely, such as identity-verification status, emergency contact details, internal service notes, and pre-delivery or return-condition photos.
• Limited technical and security information, such as IP address, request details, session data, and audit events used to secure the service and prevent abuse.

The public website does not request or store payment card details. Payment is collected on site. Authorized staff may record the amount, payment method, status, and receipt reference in the backoffice so we can reconcile and support your booking.

• To answer questions and prepare a quote you request.
• To create, confirm, change, support, or cancel rentals, tours, fishing trips, and related services.
• To coordinate inventory, vehicle handover and return, customer safety, and operational follow-up.
• To collect and reconcile on-site payments and send transactional confirmations or service updates.
• To maintain accounting records, resolve disputes, comply with legal duties, and protect our rights.
• To prevent fraud, abuse, unauthorized access, and other security incidents.

We ask for informed consent when you submit a website booking. The booking record includes the acceptance and policy version in effect at that time. Required information is identified in the form; optional notes can be left blank. We do not sell or rent personal information, and we do not use booking details for unrelated advertising without obtaining any consent required by law.

We use a limited group of providers to operate the service: Supabase for database, storage, and staff authentication infrastructure; Vercel for website hosting and delivery; and Resend for transactional email. Information is shared only to the extent reasonably necessary for each provider to perform its role or when disclosure is required by law. The public reservation flow does not use an online payment processor.

These providers may process information outside Costa Rica. We select established providers and use available contractual, access-control, and technical safeguards appropriate to the information and service. If you choose to contact us through WhatsApp or follow a link to another service, that provider processes information under its own privacy terms.

We keep personal information only while it remains reasonably necessary for the purpose for which it was collected. Booking, transaction, and accounting records may be retained for the period required to operate the service, answer claims, and comply with tax, accounting, or other legal obligations. Security and audit records are retained as needed to investigate abuse and protect the service.

When information is no longer necessary and no legal or dispute-related reason requires its retention, we take reasonable steps to delete, anonymize, or securely dispose of it. A valid deletion request may be limited where retention remains legally required.

We use administrative and technical safeguards designed to protect confidentiality, integrity, and availability. These include HTTPS, restricted staff access, server-side validation, rate limiting, audit records, private access to operational evidence, and a public booking flow that does not request card details. Details and our vulnerability-reporting process are in the Security Policy.

No internet service can guarantee absolute security. If we identify an incident involving personal information, we will investigate it, take proportionate containment and remediation steps, and make any notifications required by applicable law.

Costa Rica's Law No. 8968 provides rights concerning access to personal information, correction or updating of inaccurate information, deletion when legally appropriate, and consent to the transfer of data. Consent can be withdrawn without retroactive effect, subject to services already requested and applicable legal exceptions.

Send a free request to info@quadtourscostarica.com and describe what you need. We may ask for information reasonably necessary to verify your identity and protect other people's data. We aim to resolve a valid request in the five-business-day period established by Law No. 8968, or explain why a legal exception applies. You may also contact Costa Rica's data protection authority, PRODHAB, through prodhab.go.cr.

Website bookings must be submitted by an adult. If an activity includes a minor, the responsible adult should provide only the information reasonably necessary for the booking and safety of that participant.

Our use of browser storage is described in the Cookie Policy. External links, including WhatsApp and Google Maps, are governed by the third party's own terms and privacy notices once you leave this website.

We may update this policy when our services, providers, or legal requirements change. Material changes will be reflected on this page, and the date at the top identifies the current version. A booking records the policy version accepted when it was submitted.