LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Booking form | Identify the booking | Pre-contractual steps (item V) |
| Phone / WhatsApp and email | Booking form | Confirm the booking | Pre-contractual steps (item V) |
| Date and number of participants | Booking form | Check availability | Pre-contractual steps (item V) |
| Prior experience / certification | Booking form | Match the activity to the level | Pre-contractual steps (item V) |
| Health declaration | Before the activity, where required | Activity safety — sensitive health data | Consent (item I) |
| Emergency contact | Before the activity | Activity safety | Consent (item I) |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: Ocean Riders Kite Surf, Florianópolis (SC), Brazil. [CONFIRM the legal entity name, CNPJ and the meeting point — none of it is published]. The only public channel we could identify is the Instagram profile @oceanriderskitesurf, which sits behind a login wall and whose public card carries no contact detail. [CONFIRM the WhatsApp number, phone, e-mail and the data protection officer — LGPD art. 41].
⚠️ The medical disclosure is sensitive personal data
This is the most important point in this policy and the one that needs legal review before anything goes live at all. A kite school needs to know, before the first lesson, whether a student has a cardiac condition, epilepsy, is pregnant, has a shoulder or knee injury, or has had recent surgery. That is sensitive personal data under LGPD art. 11. In practice:
- It needs specific, separate, explicit consent — it cannot ride along with the general acceptance on a contact form.
- It needs a specific, stated purpose: assessing fitness for the activity, and nothing beyond that.
- It needs a stricter access regime — only those who need to see it, see it — and a defined retention period, with disposal at the end.
- It cannot be a web field feeding an ordinary inbox. The contact form in this build deliberately does not collect health data, and the note beneath it says so.
[CONFIRM the medical disclosure form, the collection flow, who has access, where it is held and for how long — and put all of it through legal review before it exists].
The liability waiver
Kitesurfing carries genuine injury risk and the waiver is signed before the first lesson. It is a contractual document, not a website checkbox. [CONFIRM the document exists and how it is signed].
The contact form
It asks for a name, WhatsApp number, e-mail, current level and a message. Legal basis: consent alongside pre-contractual dealings. It is used to reply and arrange the lesson, and nothing else. [CONFIRM the retention period]. The booking configurator checks no calendar, shows no price and fakes no availability: it composes a message and opens WhatsApp, and you decide whether to send it.
No wind data is presented as fact
The wind strip at the top and the season table are placeholders marked [CONFIRM]. No forecast has been fabricated and none has been pulled from a third-party service and presented as the school’s. If a real feed is wired in later it will be attributed to its source.
Prices and cancellation
No price appears in this build, because none is published. Under the Brazilian consumer code a price must be total, unambiguous and state exactly what it includes — how many hours, over how many days, whether equipment and insurance are in, and what happens to the hours if the wind dies. Cancellation and rescheduling terms for no wind, too much wind, storms or lightning must be published before any course is sellable. [CONFIRM the price table and the cancellation policy].
The ® symbol
Their Instagram display name renders as “OCEANRIDERS®”. The symbol has not been reproduced in this build: using ® without a registration is itself a misrepresentation. [CONFIRM the INPI registration before the symbol appears anywhere].
What this site does not claim
No certification, certifying body, instructor name, credential number, CADASTUR registration, Marinha vessel registration, insurance policy, price, hour count, founding year, rating, review, testimonial, student total or follower count appears in this build without being marked [CONFIRM]. No certifying body the school has not named itself is mentioned, and no certification logo or badge appears anywhere.