Privacy Policy

This Privacy Policy describes how Costa Vida ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you visit our website at mealcostavida.rest, place orders, use our digital services, or otherwise interact with us. Please read this policy carefully to understand our practices regarding your personal data and how we treat it.

By accessing or using our website, services, or products, you acknowledge that you have read, understood, and agree to the collection and use of your information in accordance with this Privacy Policy. If you do not agree with the terms described herein, please do not access or use our services.

We are committed to protecting your privacy and handling your personal information with transparency, integrity, and respect. This policy is designed to comply with applicable United States federal and state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and the Federal Trade Commission (FTC) Act governing unfair or deceptive trade practices.

1. About Costa Vida

Costa Vida is a food service company operating in the United States. We offer fresh, high-quality food products and dining experiences to our customers through our physical locations and digital platforms. Our contact details are as follows:

For all privacy-related inquiries, requests, or complaints, you may contact us using the email address provided above. We will respond to all legitimate privacy requests in a timely manner, in accordance with applicable laws.

2. Information We Collect

We collect various types of information in connection with your interaction with Costa Vida, our website, and our services. The categories of personal information we may collect include, but are not limited to, the following:

2.1 Personal Identification Information

When you create an account, place an order, sign up for our loyalty program, subscribe to our newsletter, or otherwise communicate with us, we may collect personal identification information such as:

• Full name
• Email address
• Mailing or delivery address
• Phone number
• Date of birth (for age verification and promotional purposes)
• Username and password (for account registration)
• Profile photo or avatar (if voluntarily provided)

2.2 Payment and Transaction Information

When you make a purchase through our website or affiliated platforms, we may collect financial and transactional data, including:

• Credit or debit card information (processed securely through our payment processors)
• Billing address
• Order history and purchase details
• Gift card numbers or promotional codes used
• Transaction IDs and payment confirmation details

Please note that we do not store full payment card numbers on our servers. Payment processing is handled by secure, PCI-DSS-compliant third-party payment processors.

2.3 Usage and Behavioral Data

When you browse our website or use our digital services, we automatically collect certain technical and behavioral information, including:

• Pages viewed and time spent on each page
• Links and buttons clicked
• Search queries entered on our website
• Items added to or removed from your cart
• Frequency and patterns of website visits
• Referring URLs (the website that directed you to ours)
• Exit pages and navigation paths

2.4 Device and Technical Information

We may collect information about the device and technology you use to access our services, including:

• IP address
• Browser type and version
• Operating system and version
• Device type (desktop, mobile, tablet)
• Device identifiers and hardware model
• Screen resolution and display settings
• Language preferences
• Time zone settings

2.5 Location Information

With your permission, we may collect information about your geographic location to help you find the nearest Costa Vida location, provide relevant local offers, or facilitate delivery services. Location data may be derived from your IP address or, if enabled, GPS coordinates from your mobile device.

2.6 Communications and Feedback

If you contact us via email, phone, online forms, or social media, or if you submit reviews, comments, or survey responses, we collect the content of those communications along with any contact information you provide. This includes customer service interactions, complaints, and compliments.

2.7 Cookies and Tracking Technologies

We use cookies, web beacons, pixel tags, and similar tracking technologies to collect information about your online activities over time and across different websites. Please refer to Section 8 of this policy for a detailed explanation of our cookie practices.

3. How We Use Your Information

Costa Vida uses the personal information we collect for a variety of legitimate business purposes. These purposes include:

3.1 Providing and Managing Services

• Processing and fulfilling your food orders, whether online, in-store, or through delivery partners
• Creating and managing your customer account
• Sending order confirmations, receipts, and delivery updates
• Administering our loyalty and rewards programs
• Responding to customer service inquiries and support requests
• Processing refunds, returns, and exchanges

3.2 Personalization and User Experience

• Personalizing your experience on our website, including displaying relevant menu items, promotions, and content based on your preferences and purchase history
• Remembering your account settings, saved addresses, and dietary preferences
• Recommending menu items based on past orders

3.3 Marketing and Promotions

• Sending you promotional emails, newsletters, and special offers (with your consent where required by law)
• Notifying you of new menu items, seasonal offerings, and limited-time promotions
• Conducting targeted advertising on third-party platforms such as social media networks
• Measuring the effectiveness of our marketing campaigns

You may opt out of receiving marketing communications from us at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at [email protected].

3.4 Analytics and Business Intelligence

• Analyzing website traffic, user behavior, and service performance
• Understanding customer preferences and trends to improve our menu and services
• Conducting market research and customer satisfaction surveys
• Generating aggregated, anonymized statistical reports

3.5 Security and Fraud Prevention

• Detecting, preventing, and investigating fraudulent transactions and unauthorized access
• Verifying the identity of users and protecting account security
• Monitoring for suspicious activity and enforcing our Terms of Service
• Complying with legal obligations related to security and fraud reporting

3.6 Legal and Regulatory Compliance

• Complying with applicable federal and state laws and regulations
• Responding to lawful requests from government authorities and law enforcement
• Exercising or defending legal claims and rights
• Maintaining records as required by applicable tax and accounting laws

4. How We Share Your Information

Costa Vida does not sell your personal information to third parties for monetary compensation. However, we may share your information in certain circumstances as described below:

4.1 Service Providers and Business Partners

We work with trusted third-party companies and individuals that assist us in operating our business, including:

• Payment processors who handle secure payment transactions
• Delivery and logistics partners who fulfill food delivery orders
• Email service providers for sending transactional and marketing communications
• Analytics providers such as Google Analytics for website usage analysis
• Cloud storage and hosting providers for data storage and website infrastructure
• Customer support platforms for managing service requests
• Marketing and advertising platforms for running digital advertising campaigns

All service providers are contractually obligated to use your personal information only for the purposes we specify and to maintain appropriate security measures. They are not permitted to use your data for their own independent marketing purposes.

4.2 Legal Requirements and Government Authorities

We may disclose your personal information to law enforcement agencies, government authorities, courts, or other third parties if we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, subpoena, court order, or governmental request
• Protect the rights, property, or safety of Costa Vida, our customers, or the public
• Detect, prevent, or address fraud, security, or technical issues
• Enforce our Terms of Service or other agreements

4.3 Business Transfers

If Costa Vida is involved in a merger, acquisition, sale of assets, financing, or bankruptcy proceedings, your personal information may be transferred as part of that business transaction. We will notify you of any such change in ownership or control of your personal data, and the acquiring entity will be required to honor this Privacy Policy or provide you with a new policy that offers equivalent protections.

4.4 Aggregated and Anonymized Data

We may share aggregated, de-identified, or anonymized information that cannot reasonably be used to identify you with partners, advertisers, or the public for business analysis, research, or promotional purposes. This type of data sharing does not constitute the sharing of personal information.

5. Data Security

Costa Vida takes the security of your personal information seriously. We implement and maintain a variety of technical, administrative, and physical security measures designed to protect your personal data from unauthorized access, disclosure, alteration, destruction, or loss.

5.1 Technical Safeguards

• Secure Socket Layer (SSL) and Transport Layer Security (TLS) encryption for all data transmitted between your browser and our servers
• Encryption of stored sensitive personal data, including passwords and payment information
• Firewalls, intrusion detection systems, and regular security audits
• Secure access controls and multi-factor authentication for internal systems
• Regular software updates and vulnerability patching

5.2 Administrative Safeguards

• Employee training on data privacy and security practices
• Strict access controls limiting employee access to personal data on a need-to-know basis
• Confidentiality agreements with employees and contractors
• Regular internal reviews of data handling practices

5.3 Incident Response

In the event of a data breach or security incident that affects your personal information, we will notify you and relevant regulatory authorities as required by applicable law, including applicable state data breach notification laws. We will take prompt action to contain and remediate any breach and to assess the scope and impact of the incident.

6. Your Privacy Rights

Depending on your location, you may have certain rights with respect to your personal information. We respect and honor these rights as described below.

6.1 Rights for California Residents (CCPA/CPRA)

If you are a resident of California, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose what personal information we have collected about you, the categories and specific pieces of data, the sources from which it was collected, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to Delete: You have the right to request that we delete personal information we have collected about you, subject to certain exceptions (such as where we need the information to complete a transaction, comply with a legal obligation, or exercise certain other rights).
• Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information as defined under CCPA/CPRA. While we do not sell personal information for monetary consideration, we may share data with advertising partners in ways that may qualify as "sharing" under California law.
• Right to Limit Use of Sensitive Personal Information: You have the right to direct us to limit the use of sensitive personal information to only what is necessary to provide the requested services.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive a different price, level of service, or quality of goods as a result of exercising your privacy rights.

To exercise your California privacy rights, please submit a request to us at [email protected]. We will verify your identity before processing your request and will respond within 45 days, with an extension of up to 45 additional days if necessary.

6.2 General Rights for All Users

Regardless of your location within the United States, we provide all users with the following rights:

• Right to Access: You may request a copy of the personal information we hold about you by contacting us at the email address provided in this policy.
• Right to Correction: You may request that we update or correct inaccurate information in your account at any time by logging into your account or contacting our support team.
• Right to Deletion: You may request that we delete your account and associated personal information, subject to our legal obligations to retain certain records.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.
• Right to Opt Out of Marketing: You may unsubscribe from marketing communications at any time using the opt-out mechanism provided in our emails or by contacting us directly.

6.3 How to Submit a Privacy Request

To exercise any of the rights described above, please contact us using the following details:

• Email: [email protected]
• Website: mealcostavida.rest

When submitting a request, please provide sufficient information to allow us to verify your identity and locate your personal information in our systems. We may need to ask you for additional verification information to process your request securely.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law. The factors we consider when determining retention periods include:

• The nature and sensitivity of the personal information
• The purposes for which we collected and use the data
• Whether we can achieve those purposes through other means
• Applicable legal, tax, accounting, and regulatory requirements
• Whether a contract with you requires us to maintain certain records

7.1 Specific Retention Periods

When your personal information is no longer needed for the purposes for which it was collected, we will securely delete or anonymize it. If deletion is not immediately possible (for example, because the information is stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.

8. Cookie Policy

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze website traffic, and support our marketing activities. A cookie is a small text file that is stored on your device when you visit a website.

8.1 Types of Cookies We Use

8.2 Managing Your Cookie Preferences

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. However, please be aware that disabling certain cookies may affect the functionality of our website and your ability to use certain features. You may also opt out of interest-based advertising by visiting the Network Advertising Initiative (NAI) opt-out page at optout.networkadvertising.org or the Digital Advertising Alliance (DAA) opt-out page at optout.aboutads.info.

9. Children's Privacy

Costa Vida's website, online ordering system, and digital services are not directed to, and are not intended for use by, individuals under the age of 18 years. We do not knowingly collect, solicit, or maintain personal information from children under 18 years of age.

If we learn or have reason to suspect that we have inadvertently collected personal information from a child under the age of 18, we will take prompt steps to delete that information from our systems. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

We comply with the Children's Online Privacy Protection Act (COPPA), which prohibits the collection of personal information from children under the age of 13 without verifiable parental consent. If you are between the ages of 13 and 17, you may not use our services without the supervision and consent of a parent or legal guardian.

10. International Data Transfers

Costa Vida is based in the United States, and the personal information we collect is primarily stored and processed within the United States. If you are accessing our website or services from outside the United States, please be aware that your information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate.

The data protection laws of the United States and other countries may differ from those of your home country. By using our services or providing us with your personal information, you consent to the transfer of your information to the United States and to the processing of your information in accordance with this Privacy Policy.

When we transfer data internationally, we take steps to ensure that appropriate safeguards are in place to protect your personal information and to ensure that such transfers are made in compliance with applicable privacy laws. These safeguards may include contractual clauses with our international service providers that require them to maintain privacy protections equivalent to those described in this policy.

11. Third-Party Websites and Links

Our website may contain links to third-party websites, social media platforms, or other online services that are not operated by Costa Vida. These links are provided for your convenience and informational purposes only. We have no control over the content, privacy practices, or security measures of third-party websites, and this Privacy Policy does not apply to those websites.

We strongly encourage you to review the privacy policies of any third-party websites you visit. The inclusion of a link to a third-party website does not imply our endorsement of that website or its practices. Costa Vida is not responsible for the privacy practices or content of any linked third-party websites.

Third-party services we may link to or integrate with include, but are not limited to:

• Social media platforms (Facebook, Instagram, X/Twitter, TikTok)
• Third-party food delivery platforms
• Google Maps and location services
• Payment processing services
• Review and rating platforms

12. Marketing Communications and Opt-Out

With your consent (where required by applicable law), we may send you marketing and promotional communications via email, SMS, or push notifications. These communications may include information about new menu items, promotions, special events, loyalty rewards, and other updates from Costa Vida.

12.1 Email Marketing

You can opt out of receiving marketing emails from us at any time by:

• Clicking the "Unsubscribe" or "Opt Out" link included at the bottom of any marketing email we send you
• Contacting us directly at [email protected] with your opt-out request
• Managing your communication preferences in your online account settings

Please note that even if you opt out of marketing communications, we may still send you transactional or service-related emails, such as order confirmations, receipts, and account security notifications.

12.2 SMS and Text Messages

If you have opted in to receive SMS marketing messages from us, you may opt out at any time by replying "STOP" to any text message we send you, or by contacting us at our email address. Standard message and data rates may apply.

13. Changes to This Privacy Policy

We reserve the right to update, modify, or revise this Privacy Policy at any time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this policy, we will:

• Post the updated Privacy Policy on this page with a new effective date at the top
• Notify you by email (if we have your email address on file) for significant changes
• Display a prominent notice on our website to alert you to the changes

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal information. Your continued use of our website or services after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

If you disagree with the changes made to this Privacy Policy, you should cease using our services and may request the deletion of your account and associated personal information by contacting us at [email protected].

14. Filing Complaints with Regulatory Authorities

If you have concerns about how Costa Vida handles your personal information and are not satisfied with our response to your inquiry or complaint, you have the right to file a complaint with the appropriate regulatory authority.

14.1 Federal Trade Commission (FTC)

In the United States, the Federal Trade Commission (FTC) is the primary federal agency responsible for enforcing consumer privacy protections under the FTC Act. If you believe that our privacy practices are unfair or deceptive, you may file a complaint with the FTC:

• Website: www.ftc.gov/complaint
• Phone: 1-877-382-4357 (1-877-FTC-HELP)
• Address: Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580

14.2 California Privacy Protection Agency (CPPA)

If you are a California resident and wish to file a complaint regarding our compliance with the CCPA/CPRA, you may contact the California Privacy Protection Agency (CPPA):

• Website: cppa.ca.gov
• Email: [email protected]

14.3 State Attorneys General

Many states have attorney general offices that handle consumer privacy complaints. You may also file a complaint with the attorney general's office in your state of residence. We encourage you to visit your state's official government website for more information on how to submit a privacy-related complaint.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal information, or our privacy practices, please do not hesitate to contact us. We are committed to addressing your inquiries promptly and transparently.

When contacting us about a privacy matter, please include your full name, the email address associated with your account (if applicable), and a clear description of your request or concern. This will help us locate your information and respond to you more efficiently.

We aim to respond to all privacy-related inquiries within 30 business days. For California residents exercising CCPA/CPRA rights, we will respond within the statutory timeframe of 45 days, with a possible extension of an additional 45 days where reasonably necessary.