Morales Inns & Suites Cookie Policy

1. Purpose and relationship to our Privacy Policy

This Cookie Policy explains how Morales Inns & Suites ("Morales Inns & Suites," "we," "us," or "our") uses cookies, local storage, pixels, tags, software development kits, application programming interfaces, device identifiers, tracking URLs, log data, and similar technologies (collectively, "Technologies") in connection with our websites, booking pages, guest portals, online forms, newsletters, digital communications, mobile experiences, and other services that link to this Policy.

This Policy supplements the Morales Inns & Suites Privacy Policy. The Privacy Policy explains how we collect, use, disclose, store, transfer, and protect personal information more broadly. If this Cookie Policy conflicts with a service-specific notice or legally required consent interface, the more specific notice or interface controls for that activity.

Privacy and cookie laws are territorial, and no single rule applies everywhere. We apply this Policy in light of internationally recognized principles of transparency, choice, data minimization, security, and accountability, together with the laws that apply to a particular visitor, service, device, or processing activity. These may include, where applicable, the EU ePrivacy framework and General Data Protection Regulation, the United Kingdom Privacy and Electronic Communications Regulations and UK GDPR, United States state privacy laws, Brazil's LGPD, Canada's privacy laws, Costa Rica's Law No. 8968, and other national or subnational requirements.

2. Who we are

Morales Inns & Suites is a Delaware-organized hospitality company within the Invstur Group. We may operate, manage, market, or support accommodations and digital services in multiple countries, including services associated with properties in Costa Rica. A property or service location is not necessarily the company's legal domicile.

3. What cookies and similar technologies are

Cookies are small text files that a website stores on or reads from a browser or device. They may contain a unique identifier, preference, session state, or other information that allows a site to recognize a browser or remember an action.

Session cookies generally expire when a browser session ends. Persistent cookies remain for a defined period or until deleted. First-party cookies are set by the domain a visitor is using. Third-party cookies or technologies are set or operated by another organization whose service is integrated into the site.

Other Technologies may perform similar functions. These include local and session storage, pixels, web beacons, tags, scripts, SDKs, APIs, server-side event tools, device or advertising identifiers, tracking URLs, and security or fraud-prevention signals. References to cookies in this Policy include these similar Technologies where the context permits.

4. Why we use Technologies

Depending on the service and the visitor's choices, we may use Technologies to:

• deliver pages, reservation searches, forms, and secure account or portal functions;
• maintain sessions, remember language, currency, dates, occupancy, property filters, and other selections;
• protect accounts, forms, reservations, and systems against fraud, abuse, automated attacks, and unauthorized access;
• process or support reservations, payments, identity verification, check-in, guest communications, and account functions;
• remember consent choices and prevent repeated display of the same notice;
• understand whether pages and features work correctly and diagnose errors;
• measure traffic, performance, navigation patterns, and campaign effectiveness;
• improve usability, accessibility, content, properties, and services;
• personalize content, recommendations, or communications where permitted;
• support advertising, retargeting, or measurement where legally permitted and enabled;
• enforce our Terms of Service and protect guests, staff, properties, systems, and legal rights; and
• comply with legal, regulatory, security, accounting, and recordkeeping obligations.

We do not use a Technology merely because it is available. We seek to limit use to purposes that are appropriate, proportionate, and accurately disclosed.

5. Categories of Technologies

The categories below describe the types of Technologies that may be used. The exact tools in operation may change as systems, vendors, and services evolve. A cookie preference tool or current cookie list, when available, provides more specific information about Technologies detected or configured at that time.

5.1 Strictly necessary Technologies

These Technologies are required to operate the service, provide a feature a visitor requests, maintain security, or comply with law. They may support page delivery, load balancing, network management, session continuity, secure areas, authentication, reservation steps, fraud prevention, form integrity, consent records, and privacy choices.

Strictly necessary Technologies generally cannot be disabled through our preference tool because the requested service may not function without them. A visitor may still block them through browser or device settings, but doing so may prevent pages, forms, booking functions, portals, or security controls from working.

5.2 Functional Technologies

Functional Technologies remember choices and provide enhanced features. They may remember language, currency, search preferences, accessibility settings, location selection, recently viewed properties, sign-in state, or content preferences. They may also support embedded maps, media, chat, or other optional features.

Where required, these Technologies are used only after consent. Disabling them may reduce personalization or prevent an optional feature from working as expected.

5.3 Performance and analytics Technologies

Performance and analytics Technologies help us understand how visitors use our digital services. They may collect information about pages viewed, links selected, referring pages, searches, device and browser characteristics, approximate location derived from IP address, session duration, errors, loading performance, and interaction patterns.

We may use this information in aggregated, pseudonymous, or identifiable form depending on the tool, configuration, and applicable law. We use it to measure and improve performance, content, navigation, campaigns, accessibility, and service quality.

Where required, these Technologies are used only after consent.

5.4 Advertising and targeting Technologies

Advertising and targeting Technologies may be used to measure advertising, limit repeated ads, understand campaign conversions, create or use audiences, personalize promotions, or show relevant advertisements on our services or on third-party services.

These Technologies may recognize a browser or device over time and across services. Depending on the jurisdiction, their use or related disclosure may be treated as targeted advertising, cross-context behavioral advertising, a sale, or sharing of personal information.

We do not currently sell personal information for money. We will not use advertising or targeting Technologies where consent or another legally required choice has not been obtained. Where applicable, we provide a method to opt out of qualifying sale, sharing, or targeted advertising.

5.5 Security, fraud-prevention, and trust Technologies

Some Technologies help detect malicious traffic, suspicious logins, payment fraud, reservation abuse, bot activity, credential attacks, scraping, spam, and violations of our policies. They may process device, browser, network, behavioral, and transaction signals.

These tools may be strictly necessary when used to protect a service, transaction, property, guest, account, or legal right. We apply safeguards appropriate to the sensitivity and purpose of the information.

5.6 Communications and email Technologies

Emails and digital messages may contain pixels, tagged links, or similar mechanisms that indicate whether a message was delivered, opened, or selected. Where permitted, we may use this information to operate transactional communications, measure newsletter performance, maintain suppression choices, troubleshoot delivery, or improve communications.

Marketing tracking is kept separate from communications required to administer a reservation, account, inquiry, security matter, or legal obligation. Marketing communications include an unsubscribe method where required.

6. Technologies used in reservations and guest services

Reservation and guest-service functions may rely on Technologies to preserve selected properties, dates, occupancy, rates, currency, language, add-ons, and progress through a booking or inquiry flow. They may also help prevent duplicate submissions, maintain security, support payment authentication, and connect a reservation or inquiry to the appropriate session.

A booking platform, payment processor, identity-verification provider, map provider, building system, messaging service, or other integrated partner may use its own Technologies under its own privacy and cookie notices. We do not control an independent third party's Technologies merely because its service is linked or embedded.

7. Third-party technologies and service providers

We may authorize service providers to operate Technologies for hosting, content delivery, security, fraud prevention, payments, analytics, communications, customer support, accessibility, maps, media, advertising, or other approved functions.

Third parties may process information as our service providers, processors, contractors, joint participants, or independent organizations, depending on the service and applicable law. Their own notices may apply when they independently determine purposes and means of processing.

We do not permit a provider to use information collected on our behalf for unrelated purposes unless separately authorized by law and appropriately disclosed. We seek contractual and technical controls appropriate to the provider's role.

8. Cookie preference and consent controls

Where required by law or made available as a service feature, we provide a cookie banner, preference center, or similar control. The interface may allow a visitor to:

• accept all optional Technologies;
• reject all optional Technologies;
• make category-level choices;
• revisit or withdraw consent;
• opt out of qualifying targeted advertising, sale, or sharing; and
• review information about categories or providers.

Strictly necessary Technologies remain active because they support functions, security, consent records, or services requested by the visitor.

A visitor's choice may be stored in a necessary consent cookie or similar record. If cookies are deleted, a browser is changed, a device is replaced, or a private browsing mode is used, the visitor may need to make the choice again.

Consent can be withdrawn as easily as it was given. Withdrawal applies to future use and does not affect processing already completed lawfully.

9. Browser and device controls

Most browsers and devices allow a user to block, delete, or receive warnings about cookies. Instructions vary by browser and device. Blocking all cookies may prevent reservation, account, preference, security, or form features from functioning.

Mobile operating systems may provide controls for advertising identifiers, tracking permissions, location, notifications, or app storage. These controls operate independently from our preference center and may affect other services on the device.

10. Global Privacy Control and similar signals

Where required by applicable law, we recognize a valid Global Privacy Control or other legally binding universal opt-out signal as a request to opt out of qualifying sale, sharing, or targeted advertising for the browser or device sending the signal.

A signal may not apply to strictly necessary processing, processing outside the relevant law's scope, or activity that cannot reasonably be associated with the signal. Visitors may still need to use account-level or service-specific controls for choices that cannot be applied through a browser signal alone.

Because legal requirements continue to evolve, we may update how signals are recognized and documented.

11. Do Not Track

Some browsers transmit a "Do Not Track" signal. There is no universally accepted technical or legal standard for responding to all such signals. Unless applicable law requires otherwise, we may not respond to a general Do Not Track signal in the same manner as a legally recognized universal opt-out mechanism such as Global Privacy Control.

12. Data collected through Technologies

Depending on the Technology and context, information may include:

• cookie or device identifiers;
• IP address and approximate location;
• browser, device, operating system, and language;
• referring and destination URLs;
• pages, properties, rates, searches, filters, and content viewed;
• dates, times, session duration, clicks, scrolls, and navigation events;
• reservation, inquiry, account, or transaction events;
• campaign, source, and conversion information;
• error, crash, security, and performance data;
• consent and preference records; and
• information linked to an account, reservation, inquiry, or other personal information where permitted.

We do not ask visitors to place passwords, full payment-card numbers, security codes, door codes, or highly sensitive credentials into analytics or marketing tools.

13. Legal grounds

Where applicable law requires a legal basis, we may rely on:

• performance of a contract or steps requested before entering a contract;
• compliance with a legal obligation;
• legitimate interests, where those interests are not overridden by individual rights;
• protection of vital interests;
• establishment, exercise, or defense of legal claims; or
• consent.

For non-essential cookies and similar Technologies, we rely on consent where consent is legally required.

14. Retention and expiration

The duration of a Technology depends on its purpose. Session cookies generally expire when the browser session ends. Persistent Technologies may remain for a defined period, until their purpose is complete, until consent is withdrawn, or until they are deleted.

We seek to avoid retention longer than reasonably necessary. Consent and opt-out records may be retained to demonstrate compliance and respect choices. Security records may be retained as needed to detect repeated abuse, investigate incidents, and protect legal rights.

A current cookie list or preference center may provide the specific duration of individual Technologies where that information is available and required.

15. International processing

Our guests, providers, booking platforms, communications systems, and digital infrastructure may operate in different countries. Information collected through Technologies may therefore be processed in the United States, Costa Rica, and other countries.

Where required, we use recognized transfer safeguards such as adequacy mechanisms, standard contractual clauses, the United Kingdom International Data Transfer Agreement or Addendum, contractual and organizational safeguards, consent, or another lawful transfer basis.

16. Children and minors

Our public digital services are directed to adults arranging accommodation for themselves or authorized guests. We do not knowingly use optional advertising Technologies to profile children for independent marketing.

Information relating to minors may be processed when supplied by a parent, guardian, or authorized adult for a reservation, safety, accessibility, or legal purpose. If you believe a child has used our services without appropriate authorization, contact us.

17. Accessibility

We seek to make cookie notices and preference controls usable with keyboards, screen readers, zoom, and other assistive technologies. If you have difficulty using a preference tool or need help exercising a cookie-related choice, contact us at reservations@invstur.com.

18. Security

We use administrative, technical, and organizational measures designed to protect information processed through Technologies. Measures may include encryption in transit, access controls, secure configuration, logging, monitoring, vendor assessment, data minimization, and incident-response procedures.

No digital system is completely secure. Visitors should maintain current browsers, protect devices, and notify us of suspected unauthorized account or reservation activity.

19. Changes to this Policy

We may update this Cookie Policy to reflect changes in law, technology, services, providers, or business practices. The updated version will display a revised effective date and version number.

Where required, we will provide additional notice or request renewed consent before materially changing the use of non-essential Technologies. Archived versions may be retained for governance and legal-record purposes.

20. Contact and company information

Cookie questions, privacy requests, and preference assistance:

Morales Inns & Suites provides and supports hospitality services internationally, including services associated with properties in Costa Rica. A service location is not necessarily the company's legal domicile. A registered-agent or legal-notice address may be provided separately where required by applicable law or valid legal process.

For security, do not include full payment-card numbers, passwords, door codes, or other highly sensitive credentials in an ordinary email.