At Magma Club we respect your privacy and protect your personal data under Costa Rica's Personal Data Protection Law (Law 8968).
1. Data controller
Magma Club, with address at Mercadito Arenal Building, La Fortuna, Costa Rica. Contact: privacy@magmaclubcr.com.
2. Data we collect
- Purchase data: name, email, phone, ID (for SINPE Móvil) and card data (processed by Tilopay under PCI-DSS — we never store it).
- Navigation data: technical and analytics cookies (see Cookies Policy).
- Newsletter: email if you voluntarily subscribe.
3. Purpose
We use your data to process ticket purchases, send you the QR ticket, answer inquiries, and improve the site. With your consent, to send event information.
4. Legal basis
- Contract performance: to process your purchase and deliver your ticket.
- Consent: for newsletter and analytics cookies.
- Legal obligation: invoicing and tax withholdings as per law.
5. Third parties
We share strictly necessary data with: Tilopay (payment processing), Supabase (secure data hosting), Resend (transactional email delivery), Google (anonymized analytics).
6. Retention
We keep purchase data for the period required by Costa Rican tax law (at least 4 years). Newsletter data is kept until you unsubscribe.
7. Your rights
You may exercise your rights to access, rectify, erase, object, and portability by writing to privacy@magmaclubcr.com. You may also file a complaint with PRODHAB.
8. Security
We apply reasonable technical and organizational measures. Payments are processed on PCI-DSS certified Tilopay servers. We never store full card numbers.