1. Data controller
The Puerto Rico Traffic Safety Commission (CST) is the entity responsible for processing the personal data collected through this portal. This policy is governed by Act 39-2012 on Access to Public Information and the data-protection rules applicable in Puerto Rico.
2. Data we collect
- Course registration data (name, email) when the user creates an account.
- Contact form data (name, email, message).
- Anonymous technical browsing data (IP address, browser, pages visited) subject to cookie consent.
3. Purpose of processing
Data is used exclusively to: (a) manage the account and course progress, (b) respond to contact-form inquiries, (c) generate aggregated, anonymous usage statistics for the portal. It is neither sold nor shared with third parties for commercial purposes.
4. Legal basis
Processing is carried out on the basis of the user’s consent upon registering or submitting a form, and the CST’s legitimate interest in fulfilling its educational mandate under Act 22-2000.
5. Retention period
Account data is kept while the account is active. Contact-form data is kept for a maximum of 24 months after the last interaction. Anonymous statistics may be kept indefinitely.
6. Your rights
You have the right to request access, rectification, deletion, objection, and portability of your personal data, as well as to withdraw consent at any time. Requests are submitted in writing to comunicaciones@cst.pr.gov.
7. Security measures
The portal applies TLS encryption, security headers (CSP, HSTS, COOP), login-attempt limiting, and audited event logging. Access to personal data is restricted to authorized personnel.
8. Contact
For questions about this policy: Puerto Rico Traffic Safety Commission — comunicaciones@cst.pr.gov.