Privacy Policy

1.Who we are and what this policy covers

This policy describes how the personal data of people who use the website consultasituaciontributaria.cr (the “site”) is processed, and how the rights that the law grants over that data can be exercised. It covers the tax status check, the contact request and access to WhatsApp from the site.

The data controller is:

• Legal name: Grupo Consultor JSRC
• Trade name: JRC Consulting Group
• Corporate ID (cédula jurídica): 3-101-815282
• Registered address: San José, Escazú, Trejos Montealegre, Costa Rica
• Email for personal data matters: info@jrc.cr
• Phone: 6055-6705

The data you provide through the site is stored in an automated database managed by JRC and used only for the purposes described in section 3. That database is for internal use: your data is not distributed, disclosed or sold.

Processing is governed by Law No. 8968, Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales (Costa Rica’s personal data protection law), its regulations (Executive Decree No. 37554-JP) and other applicable Costa Rican law.

2.What data we process and where it comes from

Only the data strictly needed for each purpose is processed, following the principle of data minimization:

• The ID number you check: when you press “Check”, your browser sends the number directly to the Ministry of Finance’s public service (api.hacienda.go.cr), which replies with the registered tax status. That exchange happens between your device and Hacienda: the number does not pass through JRC’s systems and is not stored in them.
• SME status: to see whether the ID number appears on the public list of active SMEs (PYMEs) of the Ministry of Economy, Industry and Commerce (MEIC), your browser downloads from this site one of the hundred files into which that list is split, chosen by the last two digits of the number, and the search runs on your own device. The hosting provider’s technical log shows which file was downloaded, which on its own does not identify anyone.
• The result of the check: the name or legal name, status, regime and activities come from official public sources. They are shown on your screen and disappear when you close or reload the page. The same applies to anything you mark after checking the CCSS, FODESAF or Central Bank lookups: it stays on your screen only.
• Contact request: if you ask us to contact you, we receive your name, your phone number or email, the result of the check (the name or legal name shown by Hacienda, the status, the type of ID and the help you requested) and the ID number checked, the latter because you expressly authorize it by ticking the box on the form.
• WhatsApp: pressing the WhatsApp button opens that app with a pre-written message stating the type of ID and the result, without the number or the name. The message is sent only if you decide to send it and, from that moment on, WhatsApp’s privacy policy also applies.
• Technical browsing data: the IP address, browser type and pages visited, which the hosting provider logs automatically for security purposes, and anonymous, aggregated visit statistics that do not use cookies. The statistics never include the number checked or the name.
• Proof of consent: when a contact request is sent, the date, time and IP address it was sent from are recorded. The law requires us to be able to show that consent was given.

We do not collect sensitive data (ethnic origin, political opinions, religious beliefs, health or sex life), nor do we ask you to provide it.

Checks about third parties. The information shown by Hacienda and MEIC is public, and the site allows any ID number to be checked. If you request contact regarding a person or company other than yourself, you declare that you act on their behalf or with their authorization.

Which data is required and what happens if you do not provide it. The check requires no data other than the ID number. To handle a contact request, your name and a phone number or email are essential: without them we cannot reply. Declining to provide them only prevents that service, with no other consequence.

Accuracy of the information. The contact details provided must be truthful and up to date. JRC is not responsible for consequences arising from inaccurate or outdated information provided by the data subject, who may request its correction at any time as described in section 7.

3.What we use your data for

Each piece of data is used only for the purpose for which it was provided:

• Showing you the result of the check on your screen.
• Handling your contact request and following up on it, which includes recording it in JRC’s internal sales management system.
• Preparing and sending quotes, when you request them.
• Keeping the site secure and preventing abuse, such as bulk or automated checks.
• Learning, in an aggregated and anonymous way, how many people use the site, in order to improve it.

Personal data is not sold, rented or transferred to third parties for commercial or advertising purposes.

4.Legal basis for processing

The check does not involve JRC receiving personal data, since the number travels directly from your device to Hacienda and the search in the MEIC list happens in your browser.

For the contact request, the legal basis is your informed and express consent, given by ticking the corresponding box before sending. That box is not ticked by default and expressly covers sending the ID number checked.

Data is also processed when necessary to perform a contract with the data subject or to comply with a legal obligation.

Consent may be withdrawn at any time, without giving a reason. Withdrawal does not affect the lawfulness of processing carried out before it.

5.How long we keep it

• Checks: not kept. JRC does not receive the number checked or the result, and the site does not store them in your browser.
• Contact requests that do not lead to a contract: six months from the last contact. After that period they are deleted.
• Clients: five years from the last service provided or the last document issued, because of the legal, accounting and tax obligations that apply to us. The tax statute of limitations in Costa Rica is four years; we keep one additional year as a margin.
• Hosting technical logs: the short period set by the provider for security purposes.

We review these periods regularly, at least once every six months, and data that has reached them is deleted or anonymized. If you prefer not to wait for that review, you can ask us to delete it at any time through the channels in section 7.

6.Who we share it with

Only with those needed for the service to work, and only for that purpose:

• Ministry of Finance (Hacienda): receives the number you check, directly from your browser, as the official source of the check. That processing is governed by its own policies.
• Site hosting: Vercel Inc. (United States), which also provides the anonymous visit statistics.
• Domain and network: Cloudflare, Inc. (United States), which manages the site’s domain and may route traffic between your browser and the hosting provider for security purposes.
• Internal management system: Heroku, by Salesforce, Inc. (United States), where the system that receives contact requests runs, and Google Cloud Firestore, by Google LLC (United States), where they are stored.
• Email: Google LLC (United States), the service used to notify JRC staff of each request and to write to you.
• WhatsApp: WhatsApp LLC, of Meta Platforms, Inc. (United States), only if you decide to write to us that way.

Except for the Ministry of Finance, these providers are outside Costa Rica, so your data may be stored abroad. By accepting this policy you consent to that transfer, which is made to providers that offer adequate levels of protection.

We may also disclose information when a competent authority requires it by a reasoned decision.

7.Your rights

Law No. 8968 grants you four rights over your data, which you can exercise at any time and free of charge:

• Access: to know what data of yours is processed, where it came from and the purpose for which it is used.
• Rectification: to have it corrected when it is incomplete, inaccurate or out of date.
• Erasure: to request its deletion when it is no longer needed for the purpose for which it was collected.
• Objection: to request that its processing for a specific purpose stop.

To exercise them, write to us at info@jrc.cr stating your name, the right you wish to exercise and a way to send you our reply. We will reply within the five business days set by the regulations to Law No. 8968.

If you believe your request was not properly handled, you may contact the Agencia de Protección de Datos de los Habitantes (PRODHAB), Costa Rica’s data protection authority, which oversees compliance with Law No. 8968.

8.How we protect your data

JRC applies reasonable security measures to prevent the loss of, unauthorized access to and misuse of information:

• Encrypted connection (HTTPS) across the whole site.
• The number checked does not pass through our systems, unless you ask us to contact you.
• Access to requests is restricted to the staff who handle them.
• Individual access credentials and passwords stored encrypted.
• Controls against automated sending of requests.

No system is infallible. If a security breach affecting your data were to occur, we will notify you in accordance with applicable law.

9.Cookies and data stored in your browser

This site does not set cookies, neither its own nor third-party cookies.

Nor does it store information in your browser: the number you check is not written into the page address, does not stay in the history and disappears when you close or reload the page. The visit statistics we use are anonymous and do not use cookies. Your language choice is not stored either: the English version is simply a different address (/en).

The official sites the site refers you to (the CCSS, FODESAF and the Central Bank) and WhatsApp may use their own technologies when you use them, subject to each one’s policies.

10.Minors

JRC’s services are intended for adults. We do not knowingly collect data from minors. If we detect that we have received data from a minor without the authorization of their legal representative, it will be deleted.

11.Changes to this policy

JRC may update this policy when the services offered or the applicable law change. Substantial changes will be communicated, before they take effect, through the contact details the data subject has provided. The date at the top shows the last update.