LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Booking form | Identify the booking | Pre-contractual steps (item V) |
| Email and phone / WhatsApp | Booking form | Confirm the booking | Pre-contractual steps (item V) |
| Check-in / check-out dates, guests | Booking form | Check availability | Pre-contractual steps (item V) |
| Special requests | Booking form | Handle the request | Consent (item I) |
| Guest details required at check-in | At check-in, in person | National guest register (FNRH) | Legal obligation (item II) |
| Newsletter, if subscribed | Send communications | Consent (item I) | |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
A site that does not exist yet
This document accompanies a speculative mockup. There is no published site, no known domain, and even the trading name is unconfirmed — the lead sheet says “Island Vibe Nomads”, the profile says @nomades.vibedailha. [CONFIRM the trading name, the registered name and the CNPJ]. With no named controller, a site that collects personal data is not LGPD-compliant, which is why this is the first thing to resolve.
The advantage of starting from zero
This is the only lodging in this batch with no prior site to remediate — which means consent can be built correctly from the first line of code. Nothing non-essential runs before you switch it on, nothing is pre-ticked, and refusing is exactly as easy as accepting.
Instagram feed
If a live Instagram feed is embedded, it is a third-party processor: it loads Meta’s scripts and can record your visit. So it loads only inside the consented branch, never on page view, and the processor is disclosed in this policy. [CONFIRM embed access].
Content about visas and residency
Any published content about visas, residency or the digital-nomad visa is reviewed by someone qualified before it goes live. Wrong immigration guidance on a hospitality site does real harm to the reader — someone may plan a move across borders on the strength of it.
Ministry of Tourism registration
CADASTUR is mandatory for lodging businesses in Brazil, hostels included. [CONFIRM] — and if it does not exist yet, that is advice to give, not a gap to paper over.