Privacy Policy

1. Data controller

The entity responsible for processing personal data is:

STIPANOV VENTURE LIMITADA
Costa Rican legal entity number: 3-102-711324
Trade name: Blackbox Custom 4x4
Registered address: Province of Guanacaste, Canton of Santa Cruz, Tamarindo, Condominio Villa Verde, 300 meters east of Centro Comercial Plaza, 50 meters south and 100 meters to the end, Costa Rica.
Privacy contact email: jbermudez@blackbox4x4custom.com

In this Policy, “Blackbox,” “we,” “us,” or “our” refers to STIPANOV VENTURE LIMITADA.

2. Scope

This Policy explains how Blackbox collects, uses, stores, shares, and deletes personal data through:

• The Blackbox customer relationship management system (“CRM”).
• Websites, forms, and digital channels operated by Blackbox.
• Blackbox business accounts and pages on WhatsApp, Instagram, Facebook, and Messenger.
• Integrations with Meta Platforms, including APIs, permissions, tokens, and webhooks.
• Automated assistants, chatbots, and customer service tools operated by Blackbox.

This Policy covers data received and controlled by Blackbox. Meta Platforms, Inc. and its affiliates independently process information under their own terms and privacy policies.

3. Personal data we collect

Depending on the channel and interaction, we may process the following categories:

3.1 Identification and contact data

• First and last name.
• Telephone number and WhatsApp-associated number.
• Email address.
• Country, city, address, or other contact details provided by the person.
• Username, profile name, or profile photo made available through the relevant channel.

3.2 Meta and channel identifiers

• User, Page, business account, or conversation identifiers assigned by Facebook, Instagram, Messenger, or WhatsApp.
• Message, conversation, contact, and professional account identifiers.
• Information needed to link a conversation to the corresponding CRM record.

3.3 Communication content

• Messages sent or received.
• Images, videos, audio, voice notes, documents, and other attachments.
• Reactions, replies, comments, and conversation-related data.
• Message timestamps and sent, delivered, read, or error statuses.

We do not ask people to send passwords, full payment card numbers, banking credentials, complete identity documents, or other highly sensitive identifiers through chat.

3.4 Commercial and CRM information

• Product, vehicle, accessory, spare part, or service inquiries.
• Vehicle information voluntarily provided, such as make, model, year, license plate, or VIN.
• Quotes, sales opportunities, preferences, requests, appointments, and follow-ups.
• Customer service, purchase, service, complaint, and communication history.
• Tags, internal notes, lead or customer status, and assigned representative.
• Consent records, communication preferences, and opt-out requests.

3.5 Technical and security data

• IP address and technical data included in requests to our systems.
• Access, error, audit, activity, and security logs.
• Webhook information, event type, date, time, and processing result.
• Information required to verify the authenticity and integrity of requests originating from Meta.

3.6 Derived information

We may generate operational information from interactions, such as inquiry classification, priority, sentiment, intent, service category, or routing recommendations. This information is used to organize and improve customer service.

4. How we obtain data

We may obtain information:

• Directly from the person when they send a message, complete a form, request a quote, or use our services.
• Through APIs and webhooks from WhatsApp Business Platform, Instagram Messaging API, Messenger Platform, and other authorized Meta products.
• From authorized Blackbox personnel who create or update CRM records.
• From legitimate public or commercial sources where permitted by applicable law.

5. Purposes of processing

We use personal data to:

1. Receive, identify, organize, and respond to messages sent to Blackbox.
2. Provide automated customer service and enable transfer to a human representative.
3. Maintain the relationship history of prospects, customers, and suppliers.
4. Prepare quotes and coordinate appointments, services, installations, deliveries, and follow-ups.
5. Send confirmations, reminders, transactional updates, and service messages.
6. Send marketing communications when valid consent or authorization exists.
7. Manage communication preferences, consent, and opt-out requests.
8. Route conversations to the appropriate department or team member.
9. Analyze service quality and improve CRM and bot workflows.
10. Prevent fraud, abuse, spam, unauthorized access, and security incidents.
11. Maintain audit records and demonstrate legal and contractual compliance.
12. Respond to competent authorities and establish, exercise, or defend legal claims.

Data obtained through Meta services will only be used to operate communications, provide customer service, maintain the relationship requested by the person, and carry out purposes compatible with that interaction.

6. Automated assistants and human support

Some responses may be generated or selected by a chatbot or artificial intelligence system. When a conversation is handled by an automated system, we will seek to disclose this clearly.

Automation may answer frequently asked questions, collect initial information, classify requests, retrieve statuses, and route conversations. A person may request human support by writing “agent,” “representative,” “human,” or an equivalent request.

Blackbox does not rely exclusively on the bot to make decisions producing significant legal effects. Quotes, commercial terms, approvals, and material decisions may be reviewed by authorized personnel.

7. Consent and Blackbox-initiated messages

Where required, Blackbox will obtain consent before initiating promotional communications or sending WhatsApp message templates.

Consent may be obtained through forms, checkboxes, conversations, contact requests, purchase processes, events, or other lawful mechanisms. We may retain reasonable evidence of consent, including its source, date, and scope.

A person may withdraw consent or ask us to stop communications at any time by writing “STOP,” “UNSUBSCRIBE,” or any unambiguous equivalent request. We will honor the request, except for communications strictly necessary to complete a requested service or comply with law.

8. Legal grounds

Depending on the circumstances, we process data based on:

• The person’s informed consent.
• Responding to a request or performing a pre-contractual or contractual relationship.
• Compliance with legal obligations.
• Protecting our systems, rights, and legitimate interests, provided the person’s rights do not override those interests.

Processing is carried out in accordance with Costa Rica Law No. 8968 on the Protection of Individuals regarding the Processing of Personal Data, its regulations, and other applicable law.

9. Data sharing and service providers

We do not sell or rent personal data.

We may share only the information necessary with:

• Meta Platforms and WhatsApp, to transmit messages, receive webhooks, manage business accounts, and use authorized Facebook, Instagram, Messenger, and WhatsApp features.
• Infrastructure and hosting providers, to operate servers, databases, storage, backups, and networks.
• CRM, automation, analytics, or artificial intelligence providers, when required to process, classify, or answer communications under our instructions.
• Support, email, notification, and security providers, to the extent required to provide their services.
• Authorized staff, contractors, and advisers, subject to confidentiality obligations.
• Administrative or judicial authorities, when required by law, a valid order, or the need to protect rights.
• Business acquirers or successors, in connection with a reorganization, merger, acquisition, or asset transfer, subject to appropriate safeguards.

Service providers may only use data to provide the contracted service and must apply reasonable security and confidentiality measures.

10. International transfers

Meta services and some technology providers may process or store information outside Costa Rica. When an international transfer takes place, we will apply reasonable measures intended to maintain an appropriate level of protection, security, and confidentiality under applicable law and our agreements with service providers.

11. Data retention

We retain data for as long as needed to fulfill the purposes described, maintain the commercial relationship, respond to requests, and comply with legal, accounting, contractual, or security requirements.

As a general rule:

• Conversations and CRM records may be retained while the relationship remains active and for up to five years after the last interaction, unless a different period applies.
• Technical, webhook, and security logs may be retained for up to twelve months, unless needed to investigate an incident.
• Consent and opt-out evidence may be retained for as long as needed to demonstrate compliance.

Data may be anonymized for statistical analysis. Backups are deleted or overwritten according to technical cycles. When law requires retention, the relevant information will be restricted and used only for the applicable legal purpose.

12. Security

We use reasonable technical and organizational measures, including as appropriate:

• Role-based access controls and least privilege.
• Authentication and protection of credentials, tokens, and secrets.
• Encryption in transit and safeguards for stored information.
• Webhook signature and authenticity validation.
• Audit logging, monitoring, and incident management.
• Backups and recovery procedures.
• Confidentiality obligations and staff access reviews.

No system is completely secure. If we identify an incident that may materially affect personal data, we will act in accordance with applicable law.

13. Individual rights

A data subject may request:

• Information about the processing of personal data.
• Access to data we maintain.
• Correction or updating of inaccurate or incomplete information.
• Deletion where applicable.
• Withdrawal of consent without retroactive effect.
• Objection to certain communications or processing.
• Restriction of processing where applicable.

To exercise these rights, contact us using the email below and provide enough information to identify the relevant record and request. We may require reasonable identity verification to prevent unauthorized access or deletion.

We will respond within the time limits established by applicable law. Exercising these rights is free, except for manifestly unfounded, repetitive, or abusive requests where permitted by law.

14. Deletion of Meta-related data

A person may request deletion of data received through Facebook, Instagram, Messenger, or WhatsApp by:

1. Emailing jbermudez@blackbox4x4custom.com with the subject “Data deletion request.”
2. Providing the channel used, profile name, telephone number or related email address, and a description of the data to be deleted.
3. Completing any reasonably necessary verification steps.

After validation, we will delete or anonymize data that we are not required to retain for legal compliance, security, fraud prevention, contractual obligations, or legal claims. We will confirm the result or explain any applicable limitation.

Deleting data stored by Blackbox does not automatically delete the person’s Meta account or data independently retained by Meta.

15. Children’s privacy

Our commercial channels and services are not intentionally directed to minors. We do not knowingly collect children’s data without valid parental or guardian authorization where required. If we receive a substantiated notice, we will review and delete the information as appropriate.

16. Third-party links and services

Conversations may include links to third-party websites or services. Blackbox does not control those parties’ privacy practices. People should review the relevant policies before submitting information.

17. Changes to this Policy

We may update this Policy due to legal, operational, or technological changes. The current version will be published with its update date. When a change is material, we may provide notice through our channels or request renewed consent where appropriate.

18. Contact

For privacy questions, complaints, or requests:

STIPANOV VENTURE LIMITADA
Costa Rican legal entity number: 3-102-711324
Email: jbermudez@blackbox4x4custom.com
Registered address: Province of Guanacaste, Canton of Santa Cruz, Tamarindo, Condominio Villa Verde, 300 meters east of Centro Comercial Plaza, 50 meters south and 100 meters to the end, Costa Rica.

Individuals may also contact Costa Rica’s Data Protection Agency (PRODHAB) using the procedures available under applicable law.