Privacy policy

1. Controller and legal framework

1.1. The controller of the personal data described in this policy is Emmatech, the trade name of Emmanuel Villegas Sibaja, an individual with Costa Rican identity card 1-1856-0855, domiciled in the district of Jesús, canton of Atenas, province of Alajuela, Republic of Costa Rica ("Emmatech"), who can be reached at info@emmatechcr.com.

1.2. Processing is governed by Costa Rica's Law on the Protection of Individuals with regard to the Processing of their Personal Data, No. 8968, its regulations and the other applicable rules of the Republic of Costa Rica.

2. Scope and definitions

2.1. This policy applies to the website emmatechcr.com, to Centra, to the systems Emmatech builds for its clients and to those systems' optional connection with Google Drive. Centra's terms of service are in the Terms of use.

2.2. For the purposes of this policy:

• Personal data is any information about an identified or identifiable individual.
• Data subject is the individual the data refers to.
• Controller is whoever decides the purpose and content of a database.
• Processor is whoever processes personal data on a controller's behalf and following its instructions.
• Processing is any operation on personal data, such as collecting, storing, using, disclosing or deleting it.

3. The website

3.1. Visit counts. The site counts visits with Umami, an analytics service that uses no cookies, does not store IP addresses and does not follow people across other sites. Emmatech does not use Google Analytics or social media pixels.

3.2. Contact. The WhatsApp buttons open that app with a suggested message, without going through Emmatech's servers. The messages and emails a person sends Emmatech, with whatever data they include, are used to answer their inquiry and, where applicable, to prepare and carry out the business relationship.

3.3. External services. The site loads its fonts from Google Fonts, so Google may see the IP address it is visited from. Centra looks up the exchange rate in the public service of Costa Rica's Ministry of Finance, without sending it any personal data.

4. Centra

4.1. Account data. For the person who registers a business, and for each user added later, Centra keeps their name, email address, phone number when given, business name, role and permissions. Passwords are stored transformed with an irreversible cryptographic function, so nobody, Emmatech included, can know them.

4.2. Technical and security data. To protect accounts, Centra records the IP address of sign-in attempts and of certain requests, to limit abusive attempts, as well as each user's last access date. For each sign-in it records the date, the time and the type of device and browser, which the business's administrators can see. On sign-up, a check against bots analyzes technical signals from the browser. Centra also keeps a change log showing which user made each change and when, visible to the business's administrators.

4.3. Access hours. Each business's administrators can set the days and hours in which each user may use Centra. Outside those hours, Centra does not let the user sign in and locks the screen if it was already open, using the server's time or, offline, the device's.

4.4. Payments. PayPal payments are made on PayPal's platform. Emmatech neither sees nor stores card or PayPal account details, and only receives from PayPal the subscription status and billing dates. For SINPE Móvil payments, Emmatech keeps the receipt the customer sends, with the payer's name, the amount, the date and the reference, as proof of payment. To record it, the receipt is read by an artificial intelligence service that receives only that image.

4.5. Emails. Centra sends emails to confirm the address, reset passwords, invite users and report on the subscription status, through an email delivery provider. Emmatech does not send advertising.

4.6. Offline use. To work without internet, Centra keeps in the device's browser a copy of the information the user views, the changes waiting to be synchronized and a fingerprint of the password that cannot be used to recover it, used only to unlock the screen offline. That copy is erased when the session is closed.

5. Data clients record in Centra

5.1. The information each business records in Centra, such as data about its customers, suppliers and staff, belongs to that business and is kept in its own database, separate from any other business's.

5.2. For that information, the business using Centra is the controller and Emmatech acts as processor: it processes it only to provide the service, does not sell it or use it for its own purposes, and accesses it only when the business asks for support or when a competent authority orders it under the law.

5.3. Anyone who wants to exercise their rights over data recorded by a business that uses Centra should contact that business. Emmatech will help the business handle the request, and will forward it if it receives it directly.

5.4. When a person accepts an invitation to use Centra, they are asked for their identification number, phone number, date of birth, address and an emergency contact, and optionally an IBAN bank account. That data goes into the staff record of the business that invited them, which is its controller under clause 5.2, and only the people that business gives access to its team or payroll can see it.

6. Custom systems

6.1. The systems Emmatech builds for a client run on that client's infrastructure, and the data in them belongs to the client. Emmatech acts as processor: it accesses them only when the client asks for support, with access that expires automatically, and every access and change is recorded in a log the client can review.

6.2. Anyone who uses one of those systems as an employee or customer of a business should contact that business, which decides what data is kept and for how long. Emmatech can put them in touch if asked.

7. Google Drive connection

The custom systems keep a daily backup. In addition, once a month they can send a copy to the client's own Google Drive, so that its backups are not all in one place. This connection is optional and is turned on by one of the client's administrators.

Permission requested

Only one: https://www.googleapis.com/auth/drive.file

Use of the permission

To create a folder in the client's Drive and upload to it, once a month, the backup file of its own system. Nothing else.

Limits of the permission

With that permission, the app can only see the files it created itself. It cannot read, list, modify or delete any other file in the client's Drive. Google enforces this limit on the permission, regardless of what the app does.

What is kept, and where

The backup stays in the client's Drive, in a folder of its account, and Emmatech receives no copy. From the authorization, the system keeps the credential Google issues to upload each month's file, encrypted within that same client's system database and for that sole purpose.

Limited use

Information received from Google APIs is used only to provide the backup service described. It is not sold, not transferred to third parties, not used for advertising or to train models, and no person reads it, unless the client expressly asks in order to solve a problem of its own.

Emmatech’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to revoke it

In either of these two ways:

• From the system, on the Backups screen, with the disconnect button. The credential is deleted at that moment.
• From the Google account, by removing the app's access in third-party apps with account access.

Files already in the Drive still belong to the client and remain in its account until it decides to delete them.

8. Purposes and consent

8.1. Emmatech processes personal data to:

• Create and manage accounts and provide the contracted services.
• Manage subscriptions, charges and payment receipts.
• Send the necessary communications about the service.
• Protect accounts and systems against unauthorized access and abuse.
• Answer inquiries, support requests and requests to exercise rights.
• Meet legal, accounting and tax obligations.
• Understand, in aggregate and without identifying anyone, how the site is used.

8.2. Emmatech does not use data for advertising, does not build commercial profiles of people and does not make automated decisions that have legal effects on them.

8.3. By creating an account, or by sending their data to Emmatech, the data subject gives free, express and informed consent to the processing described. The data marked as required at sign-up is needed to create the account; without it the service cannot be provided. The data subject may withdraw consent at any time, without retroactive effect, under section 12.

9. Recipients and transfers

9.1. Emmatech does not sell, rent or transfer personal data, nor share it with third parties for advertising.

9.2. To provide its services, Emmatech relies on providers that process data on its behalf and only for that purpose: a cloud infrastructure provider that hosts the site and Centra and runs the check against bots, PayPal for payments, an email delivery provider, an artificial intelligence provider to read SINPE Móvil receipts, Umami for visit counts and Google for the site's fonts and, when the client turns it on, the Google Drive connection.

9.3. Some of those providers process data outside Costa Rica. Emmatech chooses providers that offer adequate security and confidentiality guarantees, and sends them only the data their role requires.

9.4. Emmatech may disclose personal data when a competent authority orders it under the law.

10. Retention

• Centra account data: for as long as the account exists.
• A business's data in Centra: while its subscription is in force. If it stops paying, it is kept for three months in read-only mode and then deleted, under the Terms of use. Backup mechanisms allow data from the previous thirty days to be restored, so a deletion is completed in the backups at the end of that period.
• Payment records and receipts: for the period required by accounting and tax law.
• Security records: for as long as their purpose requires.
• Custom systems: daily backups for four weeks and monthly copies for one year, unless the client's contract provides otherwise.
• Google Drive credential: until the connection is revoked.
• Contact messages and emails: for as long as the relationship lasts and, afterwards, for the period required by law.

11. Security

Emmatech applies reasonable technical and organizational measures to protect data against loss, alteration and unauthorized access, including encrypted communications, a separate database for each business, irreversibly transformed passwords, limits on sign-in attempts, access according to each user's role and permissions, screen lock after inactivity, a change log and backups. No system is completely invulnerable; if an incident affecting personal data occurred, Emmatech would notify the affected data subjects and the authority, as required by law.

12. Data subjects' rights

12.1. Every data subject may at any time exercise their rights of access, rectification and deletion of their personal data, and withdraw their consent, under Law No. 8968.

12.2. To do so, they should write to info@emmatechcr.com from the email associated with their data or attaching a document proving their identity, stating the right they wish to exercise. The process is free of charge, and Emmatech will answer within the periods set by the law and its regulations.

12.3. Some data may be kept after a deletion request when a legal obligation requires it, such as the accounting records of payments.

12.4. A data subject who considers that their rights were not respected may go to Costa Rica's Data Protection Agency (Agencia de Protección de Datos de los Habitantes, Prodhab).

13. Cookies and local storage

The site uses no cookies. Centra uses a single, strictly necessary cookie to keep the user's session open. Both the site and Centra keep the language and theme preferences in the browser's local storage, and Centra also keeps the offline copy described in section 4.6.

14. Minors

Emmatech's services are aimed at businesses, not at minors. Emmatech does not knowingly collect data from minors. Businesses that record data about minors in Centra, for example about customers or staff, are responsible for having the authorization of their legal representatives.

15. Changes to this policy

Emmatech may update this policy. The current version is published on this page with its date. If a change substantially affects the processing of Centra users' data, Emmatech will notify them by email before it takes effect.

16. Contact

Emmatech, Costa Rica.
info@emmatechcr.com
+506 6273 6462

This policy is also available in Spanish. If the two versions differ, the Spanish version prevails.