orven.coffee Privacy Policy
Last update: October 9, 2026.
1. Who processes your data and how to contact us
Orven.coffee is a coffee sales site. The person or company responsible for deciding why and how personal data obtained through the site is processed is Jaime Solís, owner of the Orven brand, with address in San Marcos de Tarrazú, Costa Rica. For privacy requests, you can write to jaime@orven.coffee with the subject “Web Privacy Guidelines”. The physical address of the controller is different from the technical location where the data is hosted.
This policy explains how we process your data when you browse the site, create an account, or make a purchase. It is based on Law No. 8968, arts. 5 to 7, 10, 11 and 14 and its Regulation, Executive Decree No. 37554-JP.
2. Data we request and what we use it for
We request exclusively the data necessary for the informed purposes. Market research fields must be able to be omitted without affecting the order. When possible, we will use aggregated results for market analysis. We will not use optional data to decide whether to accept a purchase. Refusal to provide the necessary data may prevent account creation, delivery, or billing, as applicable.
3. Payments and hosting
Full credit or debit card details are managed by an external payment provider; Orven.coffee does not store them in its database. Based on the configuration communicated for the site, Orven receives only a token and the last four digits of the card. The payment provider will apply its own measures and privacy policies; its identity will be informed during the payment process.
The site's database is hosted by Wix, a technology infrastructure provider. This does not mean that the physical address of the data controller is at Wix, nor does it determine by itself the country where all data is stored. For details on the location where Wix hosts personal data, check this link https://es.wix.com/about/privacy
4. Consent and optional communications
Merely visiting Orven.coffee does not constitute consent to collect and use data from a form, conduct identifiable market research, or send advertising. Before collecting such data, we will duly notify users through a direct request for their consent. We will keep a record of the policy version and the choice made. Consent for optional purposes will be independent of that required to process the order. If we offer promotional emails in the future, we will ask for a separate choice and facilitate its revocation. You may withdraw your consent through the channels in section 8, without retroactive effects and without affecting the processing we must maintain due to a legal obligation.
5. Who we share information with
We will only disclose data to the extent necessary to providers involved in the site's operation (including Wix), the payment provider, delivery providers (including Correos de Costa Rica), those managing electronic invoicing, and authorities when there is a legal obligation or valid request. Each recipient will receive only the data relevant to their function. We will not sell personal information or use it for new, incompatible purposes without informing you and, where applicable, obtaining authorization.
When a provider accesses data outside of Costa Rica or there is a transfer to a database in another country, we will verify the applicable conditions, inform the data subject, and obtain the express authorization required by law before making the transfer. Hosting on Wix does not eliminate our responsibility to protect the data.
7. Retention
We will retain the data only for the time necessary for each purpose and, where applicable, to meet applicable billing, accounting, or claim obligations. Optional data used in market research will be deleted or de-identified when no longer necessary or when consent is withdrawn, unless a legal obligation requires maintaining specific information.
6. Security
We will apply proportionate technical and organizational measures to prevent loss, alteration, or unauthorized access to data; we will limit access to personnel and providers who need it and will require confidentiality. We will review the security configuration of the site and the hosting and payment providers. No online system can promise absolute security. Data protection is Orven's responsibility even when using external services.
8. Your rights and how to exercise them
You may request free access to the data we hold about you and know its purpose and use; request its rectification or update, cancellation or deletion, and demand confidentiality and control of its transfer. You may also revoke your consent for processing based on it. Write to jaime@orven.coffee with the subject “Web Privacy Guidelines” indicating your request and sufficient data to verify your identity without asking for excessive information. In accordance with Law No. 8968, art. 7, we will resolve the matter free of charge within five business days from receipt of the request. You may request deletion at any time; if certain records must be kept due to legal obligations or to attend to a pending procedure, we will explain what information cannot be deleted immediately, why, and for how long or under what criteria it will be kept. A canceled account does not necessarily imply the deletion of invoices whose retention is mandatory.
If you consider your privacy violated or are not satisfied with our response, you may file a complaint with the institution responsible for protecting personal data, without prejudice to other applicable legal avenues.
9. Cookies and similar technologies
The web hosting provider Wix, and third-party service providers included on the page, may use cookies or other technologies not necessary for the basic functioning of the site. In any case, you will be informed of them and an active choice will be requested before activating them when they collect personal data subject to consent; a means to modify that choice will be offered. We do not claim that the site is free of analytics or tracking tools until we verify their effective configuration.
10. Changes to this policy
We will publish any updates and their date here. If we incorporate new purposes that require consent, we will inform you before starting that processing and will request the pertinent authorization. Continued use or simple navigation does not replace such authorization.