Privacy Policy

1Controller

This policy explains how Krgo collects, uses, keeps and shares the personal data of the people who use the platform, under Law 8968 on the Protection of the Individual with regard to the Processing of their Personal Data and its regulations.

It is written from what the platform does today, not from what it might do. Every category of data, every provider and every cookie named here corresponds to something that exists in the system.

2Who it applies to

It applies to anybody who visits the platform, creates an account, places an order or subscribes to the newsletter.

It does not apply to the origin marketplaces' own sites, nor to third-party sites the platform may link to, which are governed by their own policies.

3What we collect

The table lists every category of personal data the platform stores today, what it is used for and how long it is kept.

Named under the table are three things the platform does not store: an absence is a disclosure too, and it is the one most people want to read first.

4Where the data comes from

Data reaches Krgo by four routes and no others:

• From the customer: what they type when registering, when asking for a link to be read, when filling in a delivery address and when paying.
• From Google or Facebook, when the customer chooses to sign in with one of those accounts: name, email address and profile photograph, and nothing else.
• From the payment gateway: the outcome of the charge and the customer's identifier in its system. Never the card details.
• From the use of the platform: the IP address and browser a session is opened with, and the technical records the application produces.

5What we use it for

The data is processed for these purposes only:

• Creating and maintaining the account, and verifying the email address.
• Working out the price of a shipment, issuing the order and charging for it.
• Buying the product at origin, importing it and delivering it to the address given.
• Issuing the electronic invoice and meeting tax and customs obligations.
• Reporting the state of the order and handling enquiries and complaints.
• Protecting the platform from abuse: usage limits, fraud prevention and fixing failures.
• Sending the newsletter, only to those who asked for it.

6On what basis

Processing is carried out with the informed consent of the data subject, given when the account is created and when these documents are accepted, and as far as necessary to perform the service the customer asks for.

Some processing is also carried out to meet legal obligations: electronic invoicing, keeping accounting records and the information importing requires.

Consent may be withdrawn at any time, without retroactive effect. Withdrawing it over data that is necessary to provide the service means Krgo can no longer provide it.

7Payment data

The card charge is processed by ONVO Pay, a payment services provider established in Costa Rica.

The fields the card is typed into are drawn by the provider itself inside the purchase page. The number, the expiry date and the security code travel straight to it: they do not pass through Krgo's servers, they are not written to its logs and they are in none of its tables.

What Krgo stores about a payment is the identifier the provider assigns it, the amount, the currency, the state and the date. That is enough to reconcile the order and to issue its invoice.

8Automated decisions and language models

The platform uses automatic tools on the product's data, not on the customer's: reading the listing from the origin marketplace, translation, tariff classification and weight estimation.

What is sent to those providers is the listing's link and its public content. They are not sent anybody's name, email address, phone number, address or order history.

No decision affecting the customer is taken by automated means alone. Reviewing the seller and reviewing a product before it can be bought are decisions made by a person, and an automatic answer is shown labelled as approximate while nobody has confirmed it.

Use of the platform is not used to build advertising profiles or to make decisions about anybody's credit or solvency.

9Who it is shared with

Krgo shares strictly what is necessary with the origin seller, the carriers, the customs broker and the delivery company, so the parcel can be bought, imported and delivered; and with the authorities where the law requires it.

Krgo also relies on infrastructure and service providers that process data on Krgo's behalf and under its instructions. None of them sells the data or uses it for its own purposes. They are these:

10International transfer

Most of the providers in the table above are outside Costa Rica, mainly in the United States, and provide their services from there. Using the platform involves an international transfer of data to them.

Krgo transfers data only for the purposes described in this policy and requires each provider to apply security measures equivalent to its own.

By accepting this policy the data subject consents to that transfer, under article 14 of Law 8968.

11How long it is kept

Each category states its period in the table in section 3. As a general rule, data tied to an order is kept while the relationship is live and afterwards for as long as tax and customs rules require.

Data not tied to a legal obligation is deleted or anonymised once it is no longer needed for the purpose that justified it.

12Security

Krgo applies technical and organisational measures in proportion to the data it holds:

• Passwords are stored irreversibly hashed and nobody at Krgo can read them.
• Traffic between the browser and the platform is encrypted.
• Files — the package photographs and the review photographs — are stored in a bucket with no public access: they are reached through signed, short-lived links generated on each request.
• Error reports are scrubbed before they leave: they carry no user identity, no cookies, and neither the headers nor the body of the request.
• Internal access is limited by role, and every administration screen demands its own.
• No system is infallible. Krgo will inform the data subject and the competent authorities if it detects a security breach affecting their data.

13Your rights

At any time the data subject may access the data Krgo holds about them, correct it where it is inaccurate, ask for it to be deleted where it is no longer needed, withdraw the consent given, and object to processing that is not indispensable to providing the service.

Requests are handled through the contact channels the platform publishes. Krgo may ask for reasonable identification before answering, precisely so that one person's data is not handed to another.

The data subject may also go to the Agencia de Protección de Datos de los Habitantes (PRODHAB) if they consider their request was not dealt with.

14Deleting the account

The data subject may ask for their account to be deleted. Doing so removes what identifies the person and what is no longer necessary: the delivery addresses, the open sessions, the notifications, the history of links sent and the newsletter subscription.

What the law requires to be kept is not deleted: paid orders, their breakdowns and the invoices issued. A paid order is a promise already kept, and its accounting record does not depend on the account continuing to exist.

Reviews already published are withdrawn or depersonalised at the data subject's request.

15Minors

The platform is aimed at adults with the capacity to contract and to pay with a card in their own name. Krgo does not knowingly collect data about minors.

If Krgo finds that it has collected data about a minor without the authorisation of whoever represents them, it will delete it.

16Cookies

The platform uses a small number of cookies, all of them necessary to function or to remember a preference. No advertising or audience-measurement cookies are used.

The detail is in the cookie policy, which forms part of this policy and is linked at the foot of this page.

17Newsletter and marketing messages

The newsletter is sent only to those who expressly asked for it. What is stored about a subscription is the email address and the language it was asked for in, and nothing else.

Every send carries the way to unsubscribe, and unsubscribing takes effect immediately.

An order's operational emails — the confirmation, the reminders and the state notices — are not marketing messages and cannot be switched off while the order is in progress.

18Database registration

Law 8968 requires databases intended for the distribution, dissemination or trading of personal data to be registered with PRODHAB.

19Changes to this policy

Krgo may update this policy. The version in force is the one published on this page, with its last-updated date.

Where a change widens the purposes of processing or brings in a new provider that receives personal data, Krgo will say so by email before it takes effect.

20Contact

Enquiries about this policy and the exercise of the rights described are handled through the channels Krgo publishes on the platform.