LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Tour / proposal form | Identify the enquiry | Pre-contractual steps (item V) |
| Phone / WhatsApp and email | Form | Reply to the enquiry | Pre-contractual steps (item V) |
| Company and headcount | Form | Size the proposal | Pre-contractual steps (item V) |
| Plan of interest and start date | Form | Prepare the proposal | Pre-contractual steps (item V) |
| Contract details | At contracting, off the website | Formalise the contract | Legal obligation (item II) |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
First: the current site is compromised
The domain maxfloracenter.com.br renders an injected SEO-spam block and the blog still carries
posts dated 09/10/2019 titled “Hacked by HZ grup”. The site is also served over plain HTTP with no
certificate, which means anything typed into a form there travels unencrypted. This point comes
before any privacy item: a privacy policy on a compromised site with no HTTPS protects nobody. Any rebuild
starts clean, with forced HTTPS and HSTS, and hosting, WordPress, FTP/SFTP and connected e-mail credentials
treated as compromised and rotated. [CONFIRM with their host / IT].
Who the controller is
Controller: Max & Flora, R. Lauro Linhares, 2055 — Trindade, Florianópolis — SC, 88036-003, Brazil. [CONFIRM the management company’s registered name and the CNPJ — neither is published]. Phone (48) 3234-8482 · e-mail atendimento@maxfloracenter.com.br. [CONFIRM the data protection officer — LGPD art. 41].
Two forms, two purposes, two retention rules
This site has two separate forms, and that is not a layout detail: a leasing prospect and a shopper are not the same enquiry, and today both land in the same inbox. Each has its own stated purpose and its own retention rule.
- I want to lease a suite — name, profession or speciality, WhatsApp, e-mail, area wanted and a message. Legal basis: pre-contractual dealings (art. 7, V) alongside your consent. [CONFIRM the retention period].
- I am a visitor / looking for a shop — name, e-mail, subject and message. Legal basis: consent. Short retention, because the purpose is exhausted by the reply. [CONFIRM the period].
CPF and CNPJ on the leasing enquiry
The leasing form carries a CPF or CNPJ field, and it is deliberately marked with an open question. Collecting an identifier at enquiry stage needs a documented legal basis and a minimisation review under the LGPD — it may only make sense at proposal stage, when there is a real credit assessment. [CONFIRM whether CPF/CNPJ is genuinely needed at this stage or only at proposal].
The professional directory publishes third parties’ data
The directory lists the name, speciality, suite, phone, hours and professional registration of people who are not the controller. Each tenant needs a documented legal basis for that publication and a clear route to correct or remove their own entry.
Beyond the LGPD, a directory listing a doctor, dentist, psychologist, lawyer or architect touches professional-council advertising rules — CFM/CRM, CFO/CRO, CFP/CRP, OAB and CAU — several of which require the registration number to appear beside the name. In this build no registration number has been invented, no promotional copy has been written on anyone’s behalf, and there is no superlative and no outcome claim on any card. The directory publishes only what each professional supplies and approves. [CONFIRM the collection, approval and removal process].
Commercial leasing is not a consumer relationship
Leasing the suites is governed by the Lei do Inquilinato (Lei 8.245/91), not the Brazilian Consumer Code. Any advertised rate, area or availability must be accurate, and the rate has to say what it covers — rent, service charge, IPTU or the total. The consumer code still applies to the retail side: a shop or food-court price must be accurate and in reais.
Accessibility
As a publicly accessible commercial building and an address housing consulting rooms, NBR 9050 applies: accessible entrance, lifts, accessible toilets and accessible bays. This build publishes only what is confirmed to exist. For a patient who depends on it, that is a material fact, not a nicety. [CONFIRM what the building actually provides].
What this site does not claim
No suite, area, availability, rate, floor plan, lease term, guarantee type, tenant, professional, registration number, CNPJ or review appears in this build without being marked [CONFIRM]. The building’s figures — 148 suites, 2 towers, 34 shops, 64 spaces, 18,957.37 m², 2,279.88 m², 3,137.61 m², 50 food-court seats, opened 09/06/2010 — are reproduced exactly as their own page publishes them, without rounding, converting, aggregating or restating, and even so the whole set needs re-confirming, because that page has not been updated since 2019.