TCS’ Privacy Notice Costa Rica
Last updated on 18 August 2026
You have reached the TCS privacy addendum for Costa Rica. To go back to the general TCS privacy notice, please click here.
Introduction
Your privacy is important to us, so we consider it important for you to know what personal data we, Tata Consultancy Services ("TCS" or "we"), collect from you (and third parties), why we collect it, how we use it, and what rights you may have as a data subject or consumer.
Please note: All information in this privacy notice will apply to you unless otherwise stated based on your residence status. For additional terms that may apply to you based on your residency status, please refer to your country-specific terms at the end of this notice. In this notice, the term "personal data" will be used to represent any information relating to an identified or identifiable individual; country-specific notices may adopt different terminology.
We encourage you to read this notice, along with any additional and more specific information we may provide to you at various times when we collect or process personal data on TCS websites, products or applications, events, and initiatives, so that you are aware of how and for what purpose we process your personal data. (Please note: We issue a different privacy notice that will apply when there is an employment relationship between TCS and its employees.)
How we will use your personal data
We may collect different types of personal data in a number of different ways and use it for different purposes:
1.1. To secure access to our website and online services.
In general, you will be able to visit TCS.com and its affiliated websites on the World Wide Web without telling us who you are. Our web hosts or affiliates that provide analytics and performance improvement services may collect:
This information is aggregated to measure the number of visits, average time spent on the site, pages viewed, and other similar information. TCS uses this information to measure site usage, improve content, and ensure safety and security, as well as improve the performance and user experience of the website. In a few situations, your registration will be required to access an authenticated area of the website: in these cases, we will also collect your username and password.
We may also obtain data from third parties, including:
TCS uses cookies (small text files placed on your device) and similar technologies to facilitate the smooth functioning of our websites and to help collect data: please read the cookie policy. Please note that our websites may include links to third-party websites whose privacy practices differ from those of TCS; If you provide personal data to any of those websites, your data will be governed by their privacy statements.
1.2. To respond to your questions, support, and contact requests.
If you contact us with questions, requests for more information about initiatives or products, or other generic support inquiries, we may need to process personal data about you, such as:
For information on the management of your contact details, email subscriptions and promotional communications, please use the contact form of tcs.com or affiliated websites where you have provided your personal data.
1.3. Subscriptions to our promotional communications.
If you sign up to receive marketing communications from TCS, we may send them by email, postal mail, telephone, or any other means of communication. For information on the management of your contact details, you can access the contact details provided in the event privacy notice or in the emails you receive, or you can use the contact form on tcs.com or on the affiliated websites where you have provided your personal data.
1.4. To manage events and initiatives.
TCS frequently hosts events and initiatives, either free of charge or by invitation only. In these cases, this privacy notice applies to both participants and speakers, along with any other supplementary information provided in connection with each event. To enable participants to join events (including pre- and post-event communications), we are required to collect and process a limited amount of information, such as:
Where a hospitality service is provided, we may also collect, store and process "special categories" of more sensitive personal data (SPI), such as dietary requirements or personal disabilities. This shall be done only and to the extent permitted by law. Events may be recorded, so photographs and videos may also be collected; In such cases, you will be informed by a specific notice at the place where the recording was made. This material may later be used by TCS for other compatible purposes, in accordance with the notices it receives. In addition, during the course of the events, we may collect data about you from you, which we may later use to contact you again for feedback and/or to provide you with more business information about TCS; This will be done with your consent, whenever necessary.
We may also obtain data from third parties, including third-party event organizers when the event is sponsored by TCS. The organizers could provide the list of attendees. In such cases, the privacy statement of those third parties to whom you provide your personal data will apply to you.
1.5. Promote TCS' brand, products, initiatives, and values with marketing communications.
TCS has a strong and legitimate interest in promoting its brand, products, initiatives and values. In Costa Rica, the processing of personal data for marketing purposes will be carried out only with the express consent provided for in this document, previously informed to the owner, under the exceptions provided for in Article 5 of Law No. 8968. In order to further those goals, we process personal data about our business contacts, including TCS' current and potential customers, third parties, and intermediaries with whom TCS interacts in the course of its business. TCS may collect details about you, including your name, contact details and other information such as your job title, employer, areas of business interest and other business details. We may process such data using software or platforms that allow us to manage our customer relationships. We collect such data directly or indirectly from you or from third parties, such as business partners, data brokers, social media, marketing companies, and publicly accessible sources such as social media sites, where it is lawful to do so. In such cases, we will also comply with any additional restrictions imposed by the region in which your data was collected, as well as the source of your data. TCS may also collect data from our email and calendar systems in connection with interactions between TCS associates and contacts or third parties.
Your data is used by us in part to administer, manage and develop our business and services; such as identifying the business needs of existing and potential customers, analyzing and evaluating the strength of our interactions with certain business contacts, conducting analytics, including producing metrics such as relationship maps for our business leadership, and drawing up limited profiles in order to help us develop and deliver appropriate products and services to existing and potential customers. Analyses may be performed by us using algorithms that help us analyse and classify interactions with you depending on the frequency and duration of the interaction. We may also send you marketing communications and surveys to carry out market research or provide you with information about us and our services that we have reason to believe you would be interested in your professional capacity.
When we contact you, we may do so through different channels, such as email, phone calls, postal mail, or any other means of communication, for example, through social media sites such as LinkedIn. We will only send electronic marketing communications to business contacts in a business-to-business context, where we have your prior consent or where it is lawful to do so in the jurisdiction in which you are located. You may opt-out of receiving such communications at any time by using the contact form on TCS.COM or on affiliated websites where you have provided your personal data, by writing to our Data Protection Officers or the Privacy Officer (see section below) or by any other method provided from time to time (for example: the unsubscribe link at the bottom of the emails).
From time to time, we may use your name, quotes, photos, or videos to promote and amplify TCS' brand and activities. In such a case, you will receive appropriate additional information about the use of your personal data.
1.6. Manage, administer and comply with obligations arising from contracts and regulations
Where TCS has a contractual relationship with you (other than an employment relationship), your employer or your company, or is taking steps to establish such a contractual relationship, we may need to process your personal data, typically limited to name, company contact details and job title, in order to establish and/or fulfill the obligations arising from the same contract, such as providing you or your employer or company with the services you have requested or making use of the services that you or your employer or company offer to us. We will also process such personal data for ancillary tasks related to our day-to-day business activities such as accounting, auditing, reporting (to regulators and authorities) and to comply with applicable regulations.
Failure to provide certain information when requested may delay or prevent us from administering a service you have requested from us, or from responding to your inquiries and/or allowing you to join our initiatives.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose and applicable law. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.
Please note that we will only process your personal data without your express consent in the exceptional cases provided for by applicable regulations; in the case of Costa Rica, those contemplated in Article 5 of Law No. 8968.
How we will share your personal data
We may share your data with third parties, including service providers and other entities in the TCS group. Please note that TCS has not in the past, nor does it currently sell, under any circumstances, your personal data to any third party. In addition, TCS does not share your personal data with third parties for any additional purpose (as described below) unless necessary to comply with a legal obligation or legitimate business purpose where permitted by law.
Why might I share my personal data with third parties?
We may share your personal data with third parties where required by law, where it is necessary for one of the activities listed above, or where we have another legitimate legal basis to do so. We require third parties to respect the security of your data and to treat it in accordance with the law. Where required by law, we will seek your consent before transferring the data to third parties that are not part of the TCS group of companies.
Which third-party service providers process my personal data?
The term "third parties" includes third party service providers (including contractors and designated agents) and other entities in our group. Third-party service providers may carry out the following activities: hosting and other internet services, data storage and analysis, market research and campaign management, event organizers, and catering services. All of our third-party service providers are required to take appropriate security measures to protect your personal data in accordance with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only allow them to process your personal data for specific purposes and in accordance with our instructions and applicable law. We may also need to share your personal data with regulatory authorities or we may need to comply with the law in some other way.
When might I share my personal data with other entities in the group?
We may share your personal data with other TCS group entities as part of our regular business performance reporting activities, in the context of a business reorganisation or group restructuring exercise, to support system maintenance and data hosting, and where necessary to perform one of the activities listed above (see "How we will use information about you"). Other TCS group entities are required to take appropriate security measures to protect your personal data in accordance with our policies.
Transfer of your personal data outside your country of residence
We may transfer the personal data we collect about you to one or more countries outside your country of residence or outside the country in which you access this website, including India, for the purpose of performing one of the activities listed above (see "How we will use information about you"). - In such cases, we have put in place appropriate measures to ensure that your personal data is secure in accordance with the laws of the country in which you reside. If you need more information about these safeguards, you can request it from our data protection officers (see contacts below) or send an email to tcs.cpo@tcs.com.
How we'll keep your information safe
We have put in place appropriate technical, organisational and security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who need to know it. They will only process your personal data on our instructions and are subject to a duty of confidentiality.
We have established procedures to deal with any suspected data breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
How long we will keep your information
We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including to comply with any legal, accounting or reporting requirements. Details of retention periods for different aspects of your personal data are available in our retention policy upon request from our Data Protection Officers (see contact details below). To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, and whether we can achieve those purposes through other means, as well as the applicable legal requirements.
In some circumstances, we may anonymize your personal data so that it can no longer be associated with you, in which case we may use such information without notice to you.
How to contact us
If you have a concern, complaint or question about this privacy notice, please direct it to the Chief Privacy Officer of Tata Consulting Services in tcs.cpo@tcs.com or contact us via the "Contact Us" form on tcs.com or affiliated websites where you provided your personal data stating your concern in detail.
For the purposes of data processed under this notice, the controller or company/service provider for the processing of your personal data collected through our websites is Tata Consultancy Services Limited, TCS House, 2nd Floor, Raveline Street, Fort Mumbai 400 001, India. For all other purposes stated above, the controller or company/service provider is the same entity, unless otherwise stated in another privacy statement communicated in each situation.
Right to revoke consent
In the limited circumstances and on a specific basis in your country of residence, where you have consented to the collection, processing and transfer of your personal data for a specific purpose, you may have the right to withdraw your consent to that specific processing at any time. You are informed that in Costa Rica, you may revoke the consent granted herein at any time, without retroactive effect, in accordance with Article 5 of the aforementioned law. To revoke your consent, please contact our Data Protection Officers (see contacts below). Once we have received notice that you have withdrawn your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we have another legal basis to do so.
Below is the list of data protection officers in the region
We have appointed Data Protection Officers (DPOs) to oversee the TCS' compliance with applicable data protection laws and this privacy notice. If you have any questions about this privacy notice or how we handle your personal data, please contact the DPO in your region:
For Costa Rica and Latin America: dpo.latam@tcs.com.
UK & Ireland Data Protection Officer
|
Data Protection Officer for Continental Europe
|
U.S. Data Protection Officer
|
Data Protection Officer of Canada
|
Data Protection Officer of Brazil:
|
Data Protection Officer for LATAM
|
APAC Data Protection Officer
|
|
Changes to this Privacy Notice
We reserve the right to update this privacy notice, at any time, and will provide you with a new privacy notice in the event of any material updates. We may also notify you by means from time to time about the processing of your personal data.
Protection of Personal Data in Costa Rica: Privacy Notice and Informed Consent
This Privacy Notice is based on the Law on the Protection of the Person against the Processing of their Personal Data (hereinafter "Law No. 8968") of the Republic of Costa Rica, and on its Regulations, Executive Decree No. 37554-JP, regulations that regulate the collection, use, storage, transfer and other forms of processing of personal data. Therefore, when we collect and use Personal Data, being defined by Law No. 8968 as any type of information about identified or identifiable natural persons (hereinafter "Personal Data"), we are subject to the legal body on the processing of Personal Data contained in Law No. 8968, its Regulations (Executive Decree No. 37554-JP and its amendments) and the guidelines of Prodhab.
1. Existence of a personal database.
The personal data we collect is as follows:
Personal data will be stored in the "TCS Customer and User Personal Database". This database is administered exclusively for internal purposes of TCS and is not intended for the distribution, dissemination or commercialization of personal data, so it is not subject to mandatory registration with the Agency for the Protection of Inhabitants' Data (Prodhab), in accordance with Article 21 of Law No. 8968 and Article 44 of its Regulations (Executive Decree No. 37554-JP, amended by Executive Decree No. 40008-JP).
2. Purposes pursued with the collection of Personal Data
We will use your Personal Data, applying all legal requirements of Law No. 8968 as well as any other applicable legislation. The foregoing is without prejudice to the exercise of their fundamental rights. Therefore, to find out how we will use your Personal Data, please refer to the "How we will use your personal data" section of this notice or to our general notice (https://www.tcs.com/who-we-are/legal/tcs-privacy-notice) where it is more specifically described. These purposes will be informed to you expressly, precisely, and unequivocally at the time of obtaining your consent, which will be recorded in a physical or electronic document, in accordance with Article 5 of Law No. 8968.
3. The treatment that will be given to the requested data
The personal data provided by the owners will be processed in accordance with the purposes described in this Privacy Notice. The processing applicable to each category of personal data is detailed in the specific activities described in this document. For greater clarity, data subjects may consult the section "How we will use your personal data", which describes the purposes of processing and the processing operations that TCS may carry out with respect to the personal data collected.
4. Effects of the lack of access to the owner's data or their refusal to hand them over, as well as their duty to inform us of any changes
You represent that you understand that the data collected by TCS is necessary for the purposes described above. Therefore, the effect of the delivery of the data is to make it possible to fulfill all these functions and the others that are detailed in this document. TCS will ensure that the personal data processed are current, truthful, accurate and appropriate for its purpose (Article 6 of Law No. 8968). We ask you to provide accurate, complete and updated information, and to notify us in a timely manner of any changes to your personal data.
5. Your rights
You may exercise the rights of access, rectification, modification, revocation or deletion of the processing of your personal data, which are described below:
6. Recipients of the information, as well as those who will be able to consult it
We may share your data with third parties, including service providers and other entities in the TCS group. Please note that TCS has not in the past, nor does it currently sell, under any circumstances, your personal data to any third party. We may share your personal data with third parties where required by law, where it is necessary for one of the above activities, or where we have another legitimate legal basis to do so, we require third parties to respect the security of your data and to treat it in accordance with the law. Where required by law, we will seek your consent before transferring the data to third parties that are not part of the TCS group of companies.
The transfer of your personal data to third parties acting as controllers will always require your express and unequivocal consent, in accordance with Article 14 of Law No. 8968 and Article 40 of its Regulations. The transfer of personal data to processors, service providers, technology intermediaries or companies of the same economic interest group as TCS (such as Tata Consultancy Services Limited (India) is not considered a transfer; in such cases, the transfer is covered by contracts that impose on the recipient protection obligations at least equivalent to those assumed by TCS (Article 43 of the Regulation), as well as by the technical and organizational measures described in this notice. If you require further information about these safeguards, you can request it from our Data Protection Officers.
To do this, you must send a written request that can be sent to: dpo.latam@tcs.com. In the event that the information provided in the application is insufficient or erroneous to comply with it, TCS may require the holder to provide the necessary elements or documents to process it. On the other hand, the request for rectification must indicate what personal data it refers to, as well as the correction that is requested to be made and must be accompanied by the relevant documentation or proof that supports the validity of the request.
In the event of security incidents that compromise your personal data, TCS will inform you and, where applicable, Prodhab, within five business days from the date of knowledge of the incident, with the minimum information required by Articles 38 and 39 of the Regulations to Law No. 8968.
7. Mandatory or optional nature of the information requested
The personal data requested through this website may be mandatory or optional, as expressly indicated in each form or information collection mechanism.
By providing his/her personal data through the TCS website, the owner declares that he/she has been informed about the mandatory or optional nature of the information requested and about the consequences of not providing it, in accordance with the applicable personal data protection regulations of the Republic of Costa Rica.
8. Identity and address of the person responsible for the database.
The person responsible for the treatment and administration of the personal data contained in the database is TRES - ONE HUNDRED ONE - NINE HUNDRED FIFTY-ONE THOUSAND TWO HUNDRED TWENTY-ONE SOCIEDAD ANÓNIMA (TCS COSTA RICA), a company duly constituted in accordance with the laws of the Republic of Costa Rica, domiciled in San José, Escazú, Terraforte Building, second floor. For personal data collected in Costa Rica, this entity acts as the responsible party for the database for all purposes of Law No. 8968, and the provisions of this special section shall prevail over any indications otherwise contained in the general sections of this notice. If you have any questions about this privacy notice or how we handle your personal data, please contact the DPO in your region.
9. Granting of consent and authorizations
By signing this document, when used in a signable physical or electronic format, it constitutes the granting of the express, free, specific, informed, unequivocal and individualized consent of the owner for the processing of his/her personal data by TCS, in accordance with Article 5 of Law No. 8968 and Articles 4 and 5 of its Regulations. Each authorization is independent; The refusal to grant an optional authorization does not prevent the attention of its management nor does it affect the other authorizations. The boxes are always presented unmarked and TCS will keep a record of the granting (date, time and means used), since the burden of proof of consent falls on the responsible party (article 6 of the Regulations).
☐ Contact management and requests. I authorize the processing of my data to attend to my queries, requests for information and support, and to follow up on the proposed management. (Necessary to process its management).
☐ Promotional Communications. I authorize the sending of information about TCS products, services, initiatives, and events, in my professional capacity, by email, telephone, or other means. (Optional; you can withdraw at any time by using the cancellation link or by writing to dpo.latam@tcs.com).
☐ Event registration and management. I authorize the processing of my data to manage my registration, logistics and communications before and after the corresponding event. (Required to participate in events only.)
☐ Photographs and videos. I authorize the capture and use of my image and voice in photographs and recordings of events, for event memories and institutional communications of TCS, without transfer to third parties outside its economic interest group. (Optional).
☐ Non-essential cookies and analytics. I authorise the processing of my browsing data (IP address, device, language) using cookies and similar non-essential technologies, for the purposes of measuring and improving the website. (Optional; also manageable from the cookie preferences panel).
The holder may revoke any of the previous authorizations at any time, by the same means in which they were granted and without retroactive effect, by writing to dpo.latam@tcs.com; the revocation shall be executed within the following five working days (Articles 7 and 8 of the Regulations to Law No. 8968).
For use in signable format — Full name: _______________________________
Identity document: _______________________________
Signature: _______________________________ Place and date: _______________________________