LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Booking / order form | Identify the booking or order | Pre-contractual steps (item V) |
| Phone / WhatsApp | Booking form | Confirm and notify changes | Pre-contractual steps (item V) |
| Date, time, party size | Booking form | Manage the dining room | Pre-contractual steps (item V) |
| Dietary restrictions and allergies | Booking form | Food safety — potentially sensitive data | Consent (item I) |
| Newsletter, if subscribed | Send communications | Consent (item I) | |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: Opoke! — which also appears as “Opoke Sushi” on the Google Maps listing embedded in their own website, and as “Opoke – The Raw Bar” in the page title. [CONFIRM the legal entity name, CNPJ, full address and which name is the official one]. The confirmed public channel is WhatsApp +55 48 98850-5102, published by them on their own site. [CONFIRM the e-mail address and the data protection officer — LGPD art. 41].
The bowl builder stores data on this device
This is the most significant collection on the site, which is why it sits at the top. The builder uses your browser’s localStorage for three things:
opoke.bowl.v1— the bowl you saved with the “Save my bowl” button: the chosen options, the quantity and the notes.opoke.track— whether you were looking at the Poke line or the Sushi line.opoke.consent.v1— your cookie choice, so you are not asked again.
None of it leaves your device. There is no server receiving it, no account, no user identifier, and none of these values is transmitted anywhere. They stay in your browser until you delete them — and the builder itself has a “Delete saved bowl” button that removes the record immediately. Clearing site data in your browser has the same effect.
Allergens: why the builder carries them into the message
ANVISA RDC 26/2015 makes allergen declaration mandatory, and a build-your-own flow that drops the allergen at the summary is a real risk, not a detail. So every option in the builder carries its allergen list and that list travels with the message composed for WhatsApp.
One important, deliberate caveat: because Opoke! publishes no ingredients at all, the allergens shown today are the categories possible for that type of step, not the composition of a real item, and each option says so. [CONFIRM the ingredient and allergen list item by item]. Also: soy sauce contains wheat, contrary to what most people assume, which makes the gluten declaration required by Lei 10.674/2003 particularly important here. [CONFIRM whether tamari is stocked].
Raw fish
Eating raw or undercooked fish carries a health risk, especially for pregnant, elderly, very young and immunocompromised people. No freshness, sourcing or “sashimi-grade” claim appears in this build, because none has been confirmed — and under art. 31 of the Brazilian consumer code a claim like that is verifiable and enforceable. [CONFIRM the exact advisory wording and the health licence].
The forms
There are four — the bowl builder, the postcode check, the catering request and the WhatsApp list. All work the same way: they compose a text message and open WhatsApp. None of them sends anything on its own, none writes to a server, and you see the message before you tap send. From the moment you send it, the conversation is handled by WhatsApp under Meta’s policy, outside this site’s control. [CONFIRM how long order conversations are kept].
The postcode check deserves its own sentence: it does not query any third-party service and does not pretend to know the delivery radius. It asks, on your behalf, over WhatsApp.
Price, fee and minimum order
No price appears in this build because none is published. When they do, the consumer code and Decreto 5.903/2006 require the price to be total and unambiguous and require the delivery fee and the minimum order to appear before checkout, never revealed only at the end. The builder’s total is designed for exactly that: it adds everything up in the open, with no hidden extra. Today it shows [CONFIRM] rather than a number, on purpose.
Cookies
This site loads nothing third-party: no Google Analytics, no pixel, no embedded map (the delivery-area map is an SVG drawn here, precisely so Google is not called without consent), no external chat widget. The consent banner exists anyway, with analytics and marketing off by default and “Reject all” carrying the same weight as “Accept all”, so that any future tag arrives through the right door.
What this site does not claim
No price, fee, minimum order, delivery time, opening hours, address, CNPJ, legal entity name, health licence, bowl name, roll name, supplier, rating, review, testimonial, nutritional figure or founding year appears in this build without being marked [CONFIRM]. The address has not been derived from the map coordinates. No delivery-app logo has been placed, because nothing on Opoke!’s site says they are on one. The photographs are stock and the alt text on each one says so.