Privacy Policy

1. Our Privacy Commitment

Every individual is entitled to a sphere of privacy. When collecting and processing personal information, private companies and public authorities must respect that sphere and the individual's right to control information relating to them.

We process personal information in accordance with applicable privacy and data-protection laws.

2. Personal Information We Collect

Depending on how you use the Website, we may collect:

• Name and contact information;
• Email address, telephone number, and mailing address;
• Information submitted through contact or inquiry forms;
• Account or transaction information, if applicable;
• Website usage, browser, device, and IP-address information;
• Cookies and similar technologies; and
• Any other information you voluntarily provide to us.

We do not intentionally collect sensitive personal information through the Website unless it is necessary, legally permitted, and supported by the appropriate consent or other lawful basis.

3. Consent

When required by applicable law, we will obtain prior, unequivocal, express, informed, and valid consent from the owner of the personal information or their legally authorized representative before collecting or processing personal information.

Consent must be provided in writing, including electronically. We will explain, in clear language:

• The identity of the person or entity responsible for the database;
• The personal information being collected;
• The purposes for which it will be used;
• Any intended disclosures or transfers;
• The rights available to the data subject; and
• How consent may be withdrawn.

You may withdraw your consent at any time by contacting us using the details in Section 13. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. How We Use Personal Information

We may use personal information to:

• Operate, maintain, and improve the Website;
• Respond to questions, requests, and communications;
• Provide information or services requested by you;
• Administer forms, registrations, or transactions;
• Maintain Website security and prevent fraud or misuse;
• Analyze Website performance and usage;
• Comply with legal and regulatory obligations; and
• Carry out any other purpose disclosed at the time information is collected.

We will not use personal information for purposes that are incompatible with the purposes described in this Policy unless we obtain additional consent or are otherwise legally authorized to do so.

5. Accuracy and Quality of Personal Information

If we maintain personal information about you in a database, we will take reasonable steps to ensure that the information is:

• Materially truthful;
• Complete; and
• Accurate and, where appropriate, up to date.

You may request access to your personal information and dispute, correct, or update information that is erroneous, incomplete, outdated, or misleading at any time.

6. Data-Subject Rights

Subject to applicable law, you may have the right to:

• Know whether we hold personal information about you;
• Access your personal information;
• Request correction, updating, or completion of inaccurate information;
• Request deletion or cancellation where legally permitted;
• Object to or limit certain processing;
• Withdraw consent; and
• Receive information about how your personal information is being used or disclosed.

To exercise these rights, submit a written request to contact@basswoodventures.com. We may request reasonable information to verify your identity and protect against unauthorized requests.

We will review and respond to requests within the period required by applicable law.

7. Disclosure and Data Transfers

We may disclose personal information where necessary to:

• Service providers that process information on our behalf;
• Technology providers and hosting providers;
• Payment, communications, analytics, or security providers;
• Professional advisers;
• Government authorities or regulators when legally required; or
• A successor entity in connection with a merger, acquisition, restructuring, or sale of assets.

The transfer of personal information from the person responsible for a database to a service supplier, technological intermediary, or entity within the same economic-interest group is not considered a transfer of personal information requiring separate authorization from the data subject, provided the transfer is made for legitimate business purposes and in accordance with applicable law.

These parties may use personal information only for authorized purposes and must apply appropriate confidentiality and security measures. We do not sell personal information unless permitted by law and clearly disclosed to you.

8. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, enforce agreements, and protect our legitimate interests.

When personal information is no longer required, we will securely delete, anonymize, or otherwise dispose of it in accordance with applicable law and our internal retention procedures.

9. Security Measures and Internal Protocol

Any company or individual that uses or manages personal information must take the necessary technical and organizational measures to keep that information in a secure environment.

We maintain safeguards designed to protect personal information against unauthorized access, alteration, disclosure, loss, destruction, misuse, or misplacement. These measures may include:

• Access controls and authentication procedures;
• Confidentiality obligations for personnel and service providers;
• Encryption or other protective technologies where appropriate;
• Secure storage and transmission procedures;
• Backup and recovery measures;
• Security monitoring and incident-response procedures; and
• Periodic reviews of our security practices.

We also maintain an internal privacy and security protocol describing the procedures to be followed during the collection, storage, use, disclosure, retention, and disposal of personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Security Breaches

If we become aware of a breach or irregularity involving personal information—including its loss, destruction, misplacement, unauthorized access, or disclosure—we will investigate the incident and take appropriate corrective and preventive measures.

Where required by applicable law, we will notify PRODHAB and affected data subjects within five business days after the breach or security vulnerability occurs, or after becoming aware of it, as applicable.

The notification may include:

• The nature of the incident;
• The categories of personal information affected;
• The likely impact of the incident;
• Immediate corrective measures taken;
• Further preventive or corrective measures; and
• Contact information for obtaining additional information.

11. Cookies and Similar Technologies

The Website may use cookies, pixels, log files, and similar technologies to:

• Operate essential Website functions;
• Remember preferences;
• Understand how visitors use the Website;
• Improve performance and content; and
• Support analytics or marketing activities, where permitted.

You may adjust your browser settings to refuse or delete cookies. Disabling certain cookies may affect Website functionality.

12. Third-Party Websites

The Website may contain links to third-party websites, applications, or services. We are not responsible for their privacy practices, content, security, or terms. We encourage you to review the privacy policies of any third parties before providing them with personal information.

13. Contact Us

For questions, complaints, consent withdrawals, or requests concerning your personal information, contact us:

You may also contact PRODHAB, Costa Rica's data-protection authority, where applicable.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The revised version will be posted on this page with an updated "Last updated" date. If changes materially affect how we use personal information, we will provide any additional notice required by law.

15. Governing Law

This Privacy Policy is governed by the laws of Costa Rica. Any disputes relating to this Policy or the processing of personal information will be subject to the jurisdiction of the courts located in Costa Rica, unless applicable law provides otherwise.