Privacy Policy

Information you provide directly:

• Registration data: full name, email address, phone number, and encrypted password.
• Delivery addresses: complete address, location references, geographic coordinates (latitude and longitude), and descriptive alias (home, work, etc.).
• Payment information: debit and credit card data is processed and stored exclusively by our PCI-DSS certified payment processor. Fortunara Express only stores the last 4 digits and card type for visual identification purposes, never the full number or security code (CVV).
• Food preferences: information about allergies, intolerances, or other dietary restrictions that you voluntarily provide when placing an order.

Information collected automatically:

• Usage data: order history, restaurants visited, products added to cart, searches performed, and browsing preferences on the Platform.
• Device data: device type, operating system, browser version, unique device identifier (for push notifications), and application version.
• Location data: GPS coordinates when you grant explicit permission, used exclusively to calculate delivery distances, shipping costs, and verify service coverage.
• Cookies and session technologies: we use technical and functional cookies to maintain your session, remember your shopping cart, language preferences, and improve the overall user experience.

We use your personal information for the following legitimate purposes:

• Process, manage, and deliver your food orders efficiently.
• Calculate delivery costs based on actual distance between the restaurant and your delivery address.
• Process payments securely through our PCI-DSS certified payment processor.
• Communicate with you about your order status in real-time, service updates, and support responses.
• Send push notifications about your order progress (confirmation, preparation, dispatch, delivery), only with your prior consent.
• Verify your identity, prevent fraud, and protect the security of your account and the Platform.
• Continuously improve our services, personalize your user experience, and develop new features based on aggregated usage patterns.
• Comply with legal, tax, and regulatory obligations established by Costa Rican legislation.

We share your personal information only when strictly necessary to provide the service, in the following cases:

With Partner Restaurants:

We share your name, delivery address, special order notes, and food allergy information so the restaurant can correctly prepare and package your order. Restaurants do not receive your email or payment data.

With Drivers:

We share your name, delivery address with references, and phone number to facilitate successful delivery of your order. The driver only has access to this information during the active delivery process and loses access upon completion.

With the Payment Processor:

Payment data (card number, expiration date, CVV) is transmitted directly to our payment processor through an encrypted connection and never passes through Fortunara Express servers. The payment processor is PCI-DSS certified. See our payment processor's privacy policy for information on the treatment of your financial data.

By legal requirement:

We may disclose personal information when required by law, court order, administrative resolution, or competent authority of the Republic of Costa Rica, including the Data Protection Agency (PRODHAB).

We implement robust technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of all data in transit using HTTPS/TLS 1.2+ protocol.
• Passwords stored with secure hash algorithms (bcrypt) that prevent reading even by our team.
• JWT authentication tokens with automatic expiration and secure renewal.
• Complete delegation of payment processing to our PCI-DSS certified payment processor, with no storage of sensitive card data on our servers.
• Role-based access control: access to personal data by our team is strictly limited to the minimum necessary to operate the service.
• Continuous security monitoring, periodic audits, and regular updates to our systems and dependencies.

Despite our efforts and industry best practices, no electronic transmission or storage system is completely infallible. If you detect any suspicious activity in your account or believe your data has been compromised, contact us immediately at soporte@fortunaraexpress.com.

In accordance with Costa Rica's Law No. 8968 on Personal Data Protection, you have the following fundamental rights over your personal data:

• Right of access: inquire what personal data we have stored about you and for what purpose we process it.
• Right of rectification: request the correction of personal data that is inaccurate, incomplete, or outdated.
• Right of deletion: request the deletion of your personal data and the definitive cancellation of your account.
• Right of objection: oppose the processing of your data for specific non-essential purposes.
• Right of portability: request a copy of your personal data in a structured electronic format.

To exercise any of these rights, you may contact us at soporte@fortunaraexpress.com clearly indicating which right you wish to exercise, or use the options available directly in your user profile within the Platform. You can delete your account at any time from the "My Profile" section or from the dedicated "Delete Account" page.

We will address and resolve your request within a maximum of 5 business days, in accordance with the deadlines established by current Costa Rican legislation.

We use strictly necessary technical and functional cookies to:

• Keep your session securely logged in while you browse the Platform.
• Remember your language preferences (Spanish/English) and interface settings.
• Preserve your shopping cart contents during the browsing session.
• Ensure the correct technical operation of the Platform and prevent abuse.

We do not use advertising tracking cookies and do not share cookie data with third-party advertising networks. You can configure your browser to reject cookies, although this may affect essential functionalities such as login or the shopping cart.

With your explicit consent, we send push notifications to your device or browser to inform you about: the real-time status of your orders (restaurant confirmation, preparation start, driver pickup, driver en route, delivery completed), special offers and relevant promotions, and important service updates.

You can disable push notifications at any time from your mobile device settings or from your web browser's notification settings. Disabling them does not affect the service's operation, but you will not receive real-time updates about your orders.

We retain your personal data while your account is active and as necessary to provide our services continuously. Order history and transactional information is retained for accounting, tax, and legal purposes for a minimum period of 5 years, in accordance with Costa Rica's Tax Code and commercial legislation.

Upon deleting your account, we will anonymize or delete your personal data within a maximum period of 30 calendar days, with the exception of information we are legally required to retain (accounting records, tax information, and data necessary to comply with current legal obligations).

Our services are directed exclusively to persons aged 18 and over. We do not intentionally collect or solicit personal information from minors. If we become aware that we have collected personal data from a minor under 18 without the consent of their legal representative, we will proceed to delete such information from our systems immediately.

Some of our technology service providers (hosting infrastructure, analytics services, push notification platforms) may process data on servers located outside Costa Rica. In all such cases, we ensure that adequate contractual and technical safeguards exist for the protection of your personal data in accordance with the standards established by Costa Rican legislation and international privacy best practices.

We reserve the right to update and modify this Privacy Policy periodically to reflect changes in our data processing practices, legal requirements, or improvements to our services. Significant changes affecting your rights will be promptly notified through the Platform or by email to the address registered in your account. The last updated date is indicated at the beginning of this document.

Continued use of the Platform after publication of changes to this policy constitutes your acceptance of the modifications made. We recommend reviewing this policy periodically.

For inquiries, rights exercise requests, or complaints related to this Privacy Policy or the processing of your personal data, you may contact us through:

If you believe your data protection rights have been violated, you also have the right to file a formal complaint with the Data Protection Agency (PRODHAB) of the Ministry of Justice and Peace of Costa Rica.