Skip to content
Drifter
ES Free quote

Privacy Policy

Last updated: October 14, 2026

This policy explains what personal data I process when you visit smallbizbuilt.com, message me, or when I contact you to offer my services. It is written in line with Costa Rica's Law No. 8968 on the Protection of Individuals regarding the Processing of their Personal Data and its Regulations (Executive Decree No. 37554-JP). It also includes the information and rights required by the EU General Data Protection Regulation (GDPR), in case it applies to you.

In short
  • This site uses no first-party cookies, no analytics, no advertising and no trackers, and it loads no third-party fonts or scripts.
  • The form does not send your data to any server of mine: it opens WhatsApp with your message already written, and it is only sent if you send it.
  • I don't sell your data or use it for third-party advertising.
  • You can ask me to show, correct or delete your data at any time, free of charge.

1. Who is responsible

  • Controller: Frank Joseph Rhoades, trading as "Drifter's Web Design" ("I").
  • Address: 300 MTS Sur de la Escuela Lourdes de Naranjo, Mano izquierda, portón rojo casa verde, Apto #2. Cirrí Sur, Alajuela, Costa Rica 20604.
  • Email: [email protected] · WhatsApp: +506 7049 8378

For any question, or to exercise your rights, write to that email or WhatsApp number.

2. What data I process, why, and on what basis

a) When you visit the site

Data: IP address, browser and device type, pages requested, date and time, and approximate country. Cloudflare, my hosting and security provider, processes it to deliver the site to you.

Purpose: to show the site, keep it secure and prevent abuse. I do not use this data to profile you.

Basis (GDPR): legitimate interest in keeping the site working and secure (Art. 6(1)(f)).

b) When you message me

Data: your name, your business name, your WhatsApp number or email, the package you are interested in, and the content of your message.

Purpose: to reply, prepare a quote and, if you hire me, deliver the service.

Basis: your consent (the form checkbox or the act of writing to me) and steps taken at your request before a contract (GDPR Art. 6(1)(a) and 6(1)(b)). Giving me this data is voluntary; without it I can't reply to you.

c) If you are a client

Data: contact and billing details, and the business information you give me (logo, photos, hours, texts).

Purpose: to build and maintain your website and Google profile, invoice you and meet my tax obligations.

Basis: performance of the contract and compliance with legal obligations (GDPR Art. 6(1)(b) and 6(1)(c)).

d) If I contacted you first

Sometimes I message businesses that, from what is publicly visible, have no website or outdated information.

Data: business name, address, phone or WhatsApp number, website and reviews that are publicly visible (for example, on Google Maps).

Purpose: to offer you my services in a short, respectful message.

Basis: legitimate interest in offering my services to businesses (GDPR Art. 6(1)(f)), with your right to object at any time. In my first message I identify myself and tell you where I got your details. If you tell me you're not interested or ask me not to write again, I stop contacting you and delete your data; I keep only the minimum (your name or number) so I don't contact you again.

3. Sensitive data

I don't need sensitive data (for example health, religion, political opinions, ethnic origin or sex life). Please don't include them in your messages. If I receive them by mistake, I delete them.

4. Who I share data with

  • Cloudflare, Inc.: hosting, content delivery and site security. Its privacy policy.
  • WhatsApp (Meta): when you message me on WhatsApp, the messaging service processes your message and contact details under its own policy. For people living outside Europe the service is provided by WhatsApp LLC; in Europe, by WhatsApp Ireland Limited. Its privacy policy.
  • My email provider, when you write to me by email.
  • Authorities and professionals (for example accountants), only where the law requires or where necessary, and bound by confidentiality.

I don't sell or hand over your data to third parties for their own commercial purposes.

5. Transfers outside Costa Rica

Some of these providers process data outside Costa Rica and the European Union, for example in the United States. By accepting this policy in the form, or by writing to me through those channels, you expressly authorize that processing. Each provider publishes the safeguards it applies; I encourage you to read their policies.

6. Cookies and similar technologies

This site installs no first-party cookies, uses no local storage, analytics or advertising, and loads no fonts, scripts or images from other sites.

Cloudflare may set a strictly necessary security cookie (for example __cf_bm) when it enables bot protection. It only protects the site, doesn't track you across sites and, by default, is processed in the United States. If I ever add analytics or other cookies, I'll update this policy and ask for your consent where required.

7. How long I keep your data

  • Messages from people who don't hire me: up to 12 months from the last contact; then I delete them.
  • Outreach with no reply: up to 12 months; then I delete it.
  • Clients: for the duration of the relationship and as long as tax and accounting rules require.
  • Do-not-contact requests: only the minimum needed to honor your request.
  • Technical site data: according to Cloudflare's policies.

8. Your rights

In Costa Rica (Law No. 8968)

You have the right to access your data, correct it, request its deletion and withdraw your consent (without retroactive effect). I handle these requests free of charge and reply within five business days of receiving them. To exercise them, write to [email protected] with your name and how we spoke, so I can find your data.

If you believe I did not respect your rights, you can file a complaint with the Data Protection Agency of the Inhabitants (Prodhab): www.prodhab.go.cr.

If the GDPR applies to you (EU / EEA)

In addition, you have the right to restriction of processing, to data portability, to object to processing based on legitimate interest (including outreach) and to withdraw your consent at any time. You can also lodge a complaint with the data protection authority of your country. I do not make automated decisions or build profiles about you.

9. Security

The whole site is served over HTTPS. I limit access to your data to what is needed to assist you, and I use providers that publish their security measures. No system is completely secure; if an incident affecting your data occurs, I will tell you without undue delay.

10. Minors

My services are for businesses and people over 18. I do not knowingly collect data from minors.

11. European Union

My services are offered to businesses in Costa Rica and are not directed at people in the European Union, the EEA or the United Kingdom; for that reason I have not appointed an EU representative. Even so, this policy includes the information and rights the GDPR requires in case it applies to you.

12. Changes to this policy

I may update this policy. The date above shows the latest version; if the change is important, I'll announce it on the site.

13. Contact

[email protected] · WhatsApp +506 7049 8378
Frank Joseph Rhoades · 300 MTS Sur de la Escuela Lourdes de Naranjo, Mano izquierda, portón rojo casa verde, Apto #2. Cirrí Sur, Alajuela, Costa Rica 20604

See also the Terms of Use.

© 2026 Drifter's Web Design · Costa Rica Privacy · Terms · Español