Privacy Policy
Last updated September 2026
Who is responsible for your data
The controller is 3-102-955556 Sociedad de Responsabilidad Limitada (cédula jurídica 3-102-955556), a company registered in Costa Rica that trades as Vantegris and Vantegris Consulting Limitada. Address: Provincia 06 Puntarenas, Cantón 11 Garabito, Jacó, Costado Este De La Municipalidad Garabito, Bufete Sanchez Chavarria, 61101, Costa Rica. In this policy "we" and "us" mean that company.
For anything about your personal data, write to ourproblem@vantegris.com.
What we collect
When you send an enquiry through the contact page, the floating contact button or the cost calculator:
- what you type: name, email, phone number, messenger handle (optional), the service you are interested in and your message;
- what our server sees: your IP address, the country Cloudflare derives from it, and your browser and device type (from the user-agent);
- what your browser reports, where cookies are allowed: time zone, screen size and language;
- how you reached us: the page you sent it from, the referring site, UTM campaign tags, and the first page, referrer, campaign tags and ad click ID (gclid / msclkid) of your first visit if they were stored in your browser. In Europe an ad click ID is only included once you have accepted cookies;
- where cookies are allowed, a random session ID kept in your browser and your Google Analytics client ID, so we can link the enquiry to the visit that produced it.
On the contact page and the contact button, your name, email, phone number and the service you are interested in are needed for us to reply. The cost calculator asks for your email and phone number, and the newsletter only for your email address. Everything else is optional.
When you contact us by Telegram or email. We receive what you send through that service. If you open Telegram or email from a button on this site, the draft message or subject may carry a short reference code. That code links the chat to the same visit details listed above (landing page, referrer, campaign, session ID, Analytics client ID) and to the country our server derives from your IP address when the code is created. The code is only created when you press the button, and in the EEA, the UK, Switzerland, Gibraltar, the Isle of Man and the Channel Islands (in this policy, "Europe") only after you have accepted cookies. If you later choose Essential only, the code is taken out of the links on the page and no new one is added. Telegram chats and emails to our address are copied into our CRM as enquiries.
When you subscribe to the newsletter. Your email address, the page you subscribed from, the referrer, UTM tags, your IP address and the country derived from it.
During an engagement. Company and ownership information and identity documents needed for your licence application and for our client acceptance and anti-money-laundering checks.
When you browse. Analytics data described in our cookies policy. In Europe, cookies for Google Analytics and Microsoft Clarity are only set after you click Accept, and Google Ads cookies are not set at all.
Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Answering your enquiry and preparing a proposal | Steps you ask for before a contract (Art. 6(1)(b)); for enquiries made on behalf of a company, our legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| Sending an automatic email confirming we received your enquiry | Legitimate interest in confirming receipt (Art. 6(1)(f)) |
| Delivering the services you engage us for | Contract (Art. 6(1)(b)) |
| Client acceptance, sanctions and anti-money-laundering checks, and keeping the records those rules require | Legal obligation where it applies to us (Art. 6(1)(c)); otherwise legitimate interest in not acting for prohibited clients (Art. 6(1)(f)) |
| Keeping enquiries in our CRM, alerting the team, and working out which channel or campaign brought each enquiry (including sending the Analytics client ID and sales stage back to Google Analytics) | Legitimate interest in running and measuring our sales process (Art. 6(1)(f)); the Analytics client ID and first-visit details stored in your browser are only used where cookies were allowed (consent, Art. 6(1)(a), in Europe) |
| Website analytics with cookies (Google Analytics, Microsoft Clarity) | Consent in Europe (Art. 6(1)(a)); elsewhere legitimate interest in improving the site, and you can switch it off under Cookie settings |
| Ad conversion measurement with cookies (Google Ads), outside Europe only | Legitimate interest in knowing which ads bring enquiries (Art. 6(1)(f)); you can switch it off under Cookie settings |
| Cookieless measurement (Ahrefs Web Analytics, Cloudflare Web Analytics, Google's cookieless pings to Google Analytics while consent is refused, and to Google Ads in Europe or wherever consent is refused) | Legitimate interest in knowing how the site is used (Art. 6(1)(f)) |
| Newsletter | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Security, spam filtering and rate limiting of our forms | Legitimate interest in keeping the site and our systems safe (Art. 6(1)(f)) |
| Establishing or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, you can object (see "Your rights" below). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who receives it
We do not sell personal data. These providers process it for us or receive it when you use their service:
- Cloudflare: delivers and protects this site, tells our server which country a request comes from, and runs cookieless Cloudflare Web Analytics, whose script removes everything after the "?" from page addresses before sending them (so no campaign tags or ad click IDs).
- DigitalOcean: hosts the server that receives form submissions and keeps a backup copy of each enquiry and newsletter sign-up, and of submissions our spam filter holds back.
- Google: Google Analytics 4 (site analytics and the enquiry stage updates described above), BigQuery (where Analytics data and a daily copy of our CRM pipeline are stored for reporting, including name, sales stage, channel, campaign, service, country, the Analytics client ID and the first message of a chat), and Google Workspace (our mailbox). In Europe, accepting cookies covers analytics only. Google's advertising consent stays refused there, and Google Signals and ad personalisation are switched off. Until you accept, the page address Google Analytics receives has any ad click ID (such as gclid, msclkid or fbclid) taken out. After you accept, it receives the address you arrived on with Google's own ad click IDs (such as gclid) left in, for analytics only; click IDs from other ad networks (such as msclkid or fbclid) are still taken out. Elsewhere Google's advertising consent is granted by default, so Google may use the visit for ad measurement and ad personalisation under its own terms.
- Google Ads: conversion measurement. When you press a Telegram, email, phone or Book a call link, send a form or subscribe, Google's tag tells Google Ads. Outside Europe it does so with the Google Ads cookies listed in the cookies policy, unless you choose Essential only. In Europe, and wherever consent is refused, Google Ads gets only a cookieless ping about that action. In Europe that ping carries no ad click ID: the site takes out other networks' click IDs and Google's tag blanks its own.
- Microsoft: Clarity, which records how pages are used (clicks, scrolling, taps and mouse movement). In Europe the page address it records has any ad click ID removed. Clarity also contacts Microsoft domains (clarity.ms, bing.com) that can set Microsoft's own cookies.
- Ahrefs: Ahrefs Web Analytics, cookieless page-view counting. It receives the page address with any campaign tags. In Europe any ad click ID is removed from the address before Ahrefs loads, whether or not you accept. It also records the address of links you click; for the Telegram and email buttons after you accept (or outside Europe), that includes the reference code.
- NetHunt CRM: our customer database for enquiries and newsletter subscribers.
- Resend: sends the automatic confirmation email after you send an enquiry.
- Slack: internal alerts that tell our team a new enquiry has arrived.
- Telegram: if you message us there, Telegram handles that conversation under its own terms, and the chat is copied into our CRM.
During an engagement we also share what the application needs with the regulators, registries, registered agents, banks or payment institutions and local professional advisers involved in your case, and with affiliated entities that deliver part of the work. We disclose data to authorities where the law requires it.
International transfers
We are based in Costa Rica, and our providers operate in several countries, including the United States. When data protected by the GDPR or UK GDPR leaves the EEA or the UK, we rely on an adequacy decision where one covers the recipient, or on the standard contractual clauses included in our providers' data processing terms. You can ask us for more detail on the safeguard used for a particular provider.
How long we keep it
- Enquiries and CRM records: for as long as the conversation or client relationship is active, then for as long as we need them to handle follow-up questions, to establish or defend legal claims, and to meet record-keeping duties that apply to us.
- Client files and due-diligence records: for the period that anti-money-laundering and licensing record-keeping rules require after the engagement ends.
- Newsletter: until you unsubscribe. After that we keep only what we need to respect your choice.
- Analytics: according to the retention settings of each tool. Cookie lifetimes are listed in the cookies policy.
You can ask us to delete your data at any time. We will do so unless a legal duty or a pending claim requires us to keep it, and we will tell you if that is the case.
Your rights
Depending on the law that applies to you, you can ask us to:
- give you a copy of your data (access);
- correct it (rectification);
- delete it (erasure);
- limit how we use it (restriction);
- send it to you or another company in a machine-readable format (portability);
- stop using it where we rely on legitimate interest, and always stop using it for direct marketing (objection);
- withdraw consent at any time, without affecting what was done before. For cookies, use the Cookie settings button at the bottom of every page.
Email ourproblem@vantegris.com. We may ask you to confirm your identity, and we reply within one month. You also have the right to complain to a data protection authority, in particular the one in the country where you live or work or where you think the problem happened.
Children
Our services are for businesses. We do not knowingly collect data from anyone under 18.
Changes
We update this policy when our processing changes. The date at the top shows the latest version.
Vantegris and Vantegris Consulting Limitada are trade names of 3-102-955556 Sociedad de Responsabilidad Limitada (cédula jurídica 3-102-955556), registered in Costa Rica, Provincia 06 Puntarenas, Cantón 11 Garabito, Jacó, Costado Este De La Municipalidad Garabito, Bufete Sanchez Chavarria, 61101, Costa Rica. Services in certain jurisdictions are provided by affiliated entities. This page is general information, not legal advice.