LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Form / WhatsApp | Handle the request | Pre-contractual steps (item V) |
| Phone / WhatsApp | Form / WhatsApp | Reply to the enquiry | Pre-contractual steps (item V) |
| Newsletter, if subscribed | Send communications | Consent (item I) | |
| Items of interest | Reserve or set aside the item | Pre-contractual steps (item V) | |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: MULTI Open Shopping e Offices, SC-406 — Rod. Dr Antônio Luiz Moura Gonzaga, 3339 — Rio Tavares, Florianópolis/SC, Brazil. [CONFIRM the management company’s registered name and the CNPJ — neither is published]. Phone (48) 3307-4010 · WhatsApp (48) 98837-8334 · e-mail contato@multiopenshopping.com.br. [CONFIRM the data protection officer — LGPD art. 41].
Four forms, four purposes, four retention rules
Today a visitor, a prospective tenant, an event organiser and an advertiser all land in the same form. They are not the same question, and under the LGPD they are not the same processing either. In this build each has its own stated purpose and retention rule:
- Visitor — name, e-mail, subject and message. Legal basis: consent. Short retention, because the purpose is exhausted by the reply. [CONFIRM the period]
- Suite leasing — name, company, activity, area wanted, WhatsApp and message. Legal basis: pre-contractual dealings alongside consent. [CONFIRM the period]
- Event — name, type of event, preferred date, number of people and message. Legal basis: pre-contractual dealings. [CONFIRM the period]
- Advertising — name, company, format of interest and message. Legal basis: pre-contractual dealings. [CONFIRM the period]
The directory publishes third parties’ data
The directory lists the name, suite number, phone, website and individual hours of businesses that are not the controller. Each tenant needs a documented legal basis for that publication and a clear route to correct or remove their own entry. [CONFIRM the collection, approval and removal process]. The entries in this build carry only what their own site already publishes; nothing has been added, no logo has been used and no tenant has been invented. Using any tenant’s logo depends on that tenant’s permission.
Live information is consumer information
Opening hours and cinema showtimes displayed on a site are consumer information. A stale showtimes block that sends someone on a nine-kilometre drive is an information failure as well as a credibility one — it costs trust in everything else on the page, the hours included. So in this build every live-information block carries a visible “updated DD/MM” stamp, or it leaves the homepage and becomes a link to the source that is actually maintained. No showtime has been copied here.
Claims that need a current status
Three sentences on the current site need checking before any republication, under the Brazilian consumer code and CONAR norms:
- “the first and best open-air shopping centre in the south of the island” — “first” is a date claim and verifiable. “Best” is an unsubstantiable superiority claim and has not been reproduced in this build.
- “the first in the country to offer payment in cryptocurrencies”, since October 2018. [CONFIRM the basis of the claim and whether the service is still offered]
- “the only development with a pioneering solar energy system in Greater Florianópolis” — a 2018 exclusivity claim that may no longer hold. [CONFIRM]
Sustainability
The environmental information on this site is reproduced exactly as the development publishes it — the sewage treatment plant, 11,000 litres of rainwater capture, no plastic straws or cups in the food operations, organic-waste composting, the solar system in partnership with ElektSolar Innovations, two bike racks and one EV charging space. Nothing has been rounded, nothing added, and no blanket “sustainable” or “carbon neutral” label applied, because they do not use one. An unsubstantiated environmental claim is exposure under the consumer code.
Visitor footfall
The advertising section of this site publishes no footfall figure. Their current copy speaks of “a great many people” with no number, and an invented footfall figure sold to an advertiser is a commercial misrepresentation. [CONFIRM the real flow and how it is measured].
Commercial leasing
Leasing the suites is governed by the Lei do Inquilinato (Lei 8.245/91), not the Brazilian consumer code. Any advertised area, rate or availability must be accurate, and the rate has to say what it covers — rent, service charge, IPTU or the total. None of it is published today, so everything in this build is a placeholder.
Images
Every photograph is stock, used as a placeholder, and none shows children. That matters here in particular: the tenant mix includes a children’s ballet school and a baby-and-kids retailer, and the seasonal programme includes Father Christmas. None of those is illustrated with an image of a child in this build, and photography of children only enters from the development itself, with documented parental permission.