Privacy Policy
Effective date: 28 August 2025

Who we are
This Privacy Policy explains how Costa Renewables The Netherlands B.V. (KvK 59134461, VAT NL853332721B01) and Costa Renewables S.A. (Panama) (together, “Costa Renewables”, “we”, “us”) collect, use, disclose and protect personal data when you visit our websites, contact us, or purchase our products/services.
Contact (EU): Nieuwebildtdijk 322, 9076 PR St-Annaparochie, The Netherlands — info@costarenewables.com — +31 (0)6 5315 8072.
Contact (LatAm): csa@costarenewables.com. Costa Renewables

Scope
This Policy applies worldwide to our websites and related services. It covers personal data processed under: EU/UK GDPR, ePrivacy (cookies), California CPRA/CCPA, Brazil LGPD, and Canada PIPEDA (region-specific notices below). European CommissionGDPR.eucppa.ca.govoag.ca.govIAPPServiços e Informações do Brasilpriv.gc.ca

Data we collect

  • Identifiers & contact data: name, email, phone, company, role, addresses.

  • Commercial info: orders, invoices, delivery info.

  • Technical data: IP address, device/browser, pages viewed, timestamps; cookie/SDK identifiers (see Cookie Notice).

  • Communications: messages via forms, email, WhatsApp, social platforms.

  • Installer/partner data (B2B): certifications, VAT/KvK, logistics details.

Sources

Directly from you (forms, emails, calls), from your device (cookies/analytics), from delivery/installation partners (B2B), and from public/professional sources (e.g., business registers).

Purposes & legal bases (GDPR Art. 6)

  • Contract & pre-contract: to process inquiries, quotes, orders, deliveries, warranties. (Art. 6(1)(b))

  • Legal obligations: tax, accounting, compliance, safety recalls. (Art. 6(1)(c))

  • Legitimate interests: site security, fraud prevention, B2B relationship management, service improvement. (Art. 6(1)(f))

  • Consent: marketing communications; non-essential cookies/analytics/ads. (Art. 6(1)(a)) GDPR.eu

Cookies & similar technologies

We use strictly necessary cookies and, with your consent (where required), preferences, analytics, and marketing cookies. You can granularly accept/reject and change your choice any time via “Cookie settings”. See Cookie Notice below. European CommissionGDPR.eu

Disclosures (categories of recipients)

  • Operational vendors: hosting, security/CDN, email & CRM, payment/shipping providers.

  • Professional services: accountants, legal, compliance.

  • Installers/distributors (B2B) for fulfilment/aftercare.
    We do not sell personal data. For certain regions (e.g., California), “share” has a distinct legal meaning—see Regional Notices.

International transfers

We operate globally. Where EU/UK data is transferred outside the EEA/UK, we use recognized safeguards (e.g., EU Standard Contractual Clauses) or rely on adequacy decisions.

Retention

We retain personal data only as long as needed for the purposes above, legal retention duties, or to establish/defend legal claims (typically: contracts & invoices up to 7–10 years under tax law).

Security

We apply organizational and technical measures appropriate to the risks (access controls, encryption in transit, least-privilege, vendor due diligence). No method is 100% secure.

Your rights

EU/UK (GDPR): access, rectification, erasure, restriction, portability, objection; withdraw consent anytime; lodge a complaint with your supervisory authority (e.g., Autoriteit Persoonsgegevens in NL). Contact: info@costarenewables.com. Autoriteit PersoonsgegevensRijksoverheid
Brazil (LGPD): confirm processing, access, correction, anonymization/blocking/deletion, portability, information on sharing, consent revocation. Serviços e Informações do Brasil
Canada (PIPEDA): access and challenge accuracy; learn how we use/disclose personal info, including safeguards. priv.gc.ca+1
California (CPRA/CCPA): know/access, delete, correct, opt-out of sale/share of personal information, limit use of sensitive personal information, non-discrimination, right to use an authorized agent. We honor Global Privacy Control (GPC) signals. Submit requests: info@costarenewables.com. oag.ca.govcppa.ca.gov

Children

Our services are not directed to children under 16. We do not knowingly collect children’s data.

Automated decision-making

We do not make decisions with legal/equivalent effects solely by automated means without human involvement.

Controllers & how to contact us

Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Effective date” and, where required, provide additional notice.

Cookie Notice (overview)

Categories

  • Necessary (always active): core site, security, checkout (e.g., WooCommerce), consent storage.

  • Preferences: remember choices (language, region).

  • Analytics: aggregated usage stats (e.g., GA4).

  • Marketing: ad measurement/retargeting (e.g., Meta Pixel).
    Your choices: set or change at any time via “Cookie settings” in the footer. We store your choices for up to 6–12 months and then re-ask. European CommissionGDPR.eu