LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Contact form | Identify who got in touch | Pre-contractual steps (item V) |
| Phone / WhatsApp | Contact form | Reply to the enquiry | Pre-contractual steps (item V) |
| Contact form | Reply to the enquiry | Pre-contractual steps (item V) | |
| City / area | Contact form | Assess the service area | Pre-contractual steps (item V) |
| Description of the job | Contact form | Prepare the quote | Pre-contractual steps (item V) |
| Photos sent via WhatsApp | When you send them | Assess the job and quote | Pre-contractual steps (item V) |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
The data controller is Studio Kaza Arquitetura, with its head office in São Bento do Sul (SC) and units in Curitiba (PR), Itapema (SC) and Campo Alegre (SC). [CONFIRM the legal entity name, CNPJ, and whether one registration covers all four units or each unit is separately registered]. The contact route for any request about personal data is contato@studiokaza.arq.br, which is currently the only published channel we can verify. [CONFIRM the name of the data protection officer — LGPD art. 41].
The contact form
The form on this site asks for a name, e-mail, phone number, project type, whether the project is turn key, and a message. The legal basis is your consent, given by ticking the box before you send, alongside the legitimate interest of replying to someone who approached the practice. The data is used only to answer your enquiry and to carry on the commercial conversation that follows from it. It is not sold, it feeds no third-party advertising, and it is not shared with any partner without a fresh legal basis. [CONFIRM the retention period — we suggest 24 months after last contact for enquiries that do not become contracts].
No broadcast video is embedded here
Studio Kaza appeared on programmes on RECORD and SBT. Those segments are copyrighted works and the channel marks are registered trademarks, so no player, iframe or video frame loads on this site. If one ever does, it will be under a written licence, click-to-load, and only inside the consented branch — because a video embed is a data transfer to a third party before you have even pressed play.
Construction, site and project records
Once a design becomes a building, the processing is no longer only about site visitors. Project documents, contracts, measurements, ART and RRT filings, site photographs and data about suppliers and occupants all exist outside this website and follow their own rules, including statutory retention periods for technical documentation. [CONFIRM how those records are held, for how long, and who has access].
Healthcare interiors and sensitive data
The practice states that it works in the healthcare sector. Health projects collect no patient data through this website, and nothing relating to anybody’s health is processed here. If a healthcare contract involves access to patient information — department plans, patient flows, records, or images of people receiving care — that is sensitive personal data (LGPD art. 11) and requires its own processing agreement with the healthcare operator, outside the scope of this site. [CONFIRM whether any healthcare contract grants access to patient data].
Project photography and releases
Private residences, corporate interiors and healthcare environments are published only with the written permission of the client or operator, and architectural photography is almost always licensed from a named photographer. In this mockup no image is Studio Kaza’s work — all of it is stock photography standing in as a placeholder. [CONFIRM a release per project and a credit plus usage licence per image, before anything is published].
What this site does not claim
No project name, client, city, year, area, award, publication credit, CAU, CREA, ART, RRT or CNPJ number appears in this build unless Studio Kaza has supplied and confirmed it in writing. The international award is described on their current site only as “Gold Winner”, which is a tier rather than the name of an award, so it is published as an award nowhere here. The line “one of the most recognised offices in the state” is a self-assessment and has not been reproduced as a fact either.