LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Booking / order form | Identify the booking or order | Pre-contractual steps (item V) |
| Phone / WhatsApp | Booking form | Confirm and notify changes | Pre-contractual steps (item V) |
| Date, time, party size | Booking form | Manage the dining room | Pre-contractual steps (item V) |
| Dietary restrictions and allergies | Booking form | Food safety — potentially sensitive data | Consent (item I) |
| Newsletter, if subscribed | Send communications | Consent (item I) | |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: Paradiso, Florianópolis (SC), Brazil. [CONFIRM the legal entity name, CNPJ, full address and the registered trading name]. Note that “Paradiso Mercato e Caffè” is a reading of the Instagram handle, not a confirmed name: nobody has told us what the company is called.
The only confirmed public channel is the Instagram profile @paradisomercatoecaffe, which serves a login wall to any server-side request. [CONFIRM the phone number, WhatsApp, e-mail and the data protection officer — LGPD art. 41].
No WhatsApp number was captured — and none has been invented
This is the most practical point in the whole mockup. There is no phone number, no WhatsApp and no e-mail. Rather than drop a stand-in number in, every WhatsApp control in this build is visibly disabled and explains why when tapped. The reason is simple: an invented number on a published site is not a layout detail, it is a stranger’s phone ringing. Confirm the business WhatsApp number and every button on the page works with no other change.
What this site stores
One thing: paradiso.consent.v1, your cookie choice, in localStorage on this
device, so you are not asked again. It does not leave the device, it reaches no server, and it
disappears when you clear site data in your browser.
Nothing third-party loads before consent
There is no Google Analytics, no pixel, no Instagram widget and no embedded map — the map in the “Find us” section is an SVG drawn here, precisely so Google is not called without your consent. The photographs come from a stock image CDN. The consent banner exists anyway, with analytics and marketing off by default and “Reject all” carrying the same weight as “Accept all”, so that any future tag arrives through the right door.
The forms
There are three — hampers and orders, booking/pre-order, and the order buttons on the menu. All work the same way: they compose a text message and hand it to WhatsApp. None writes to a server and none sends anything on its own. While there is no confirmed number they send nowhere at all: they show the notice above. [CONFIRM how long conversations are kept and who has access].
Price, product, and what this site refuses to assert
Nothing in the source spreadsheet described this business — not one word — and Instagram returned nothing usable. So:
- No dish, product, brand, importer, region, producer or DOP/IGP designation has been named. None. The mercato categories are categories, not items.
- No price has been invented. Every one reads [CONFIRM], in
BRL and in the form
R$ 00,00. Nothing has been converted to US dollars. - No Italian-family origin story has been written. It is the most tempting fabrication available on this lead and the one that collapses fastest under a customer’s first question.
- No rating, review, testimonial, follower count, founding year, CNPJ, licence or metric appears unmarked. The numbers band ships literally empty.
- Not even the business format has been assumed. The mockup carries an amber note just below the hero asking whether Paradiso is a deli, a café, a trattoria, or both.
Alcohol
If wine or any alcoholic drink is sold, the site carries the line “Sale prohibited to under-18s”, depicts no minors in any image, and any online ordering path for that category needs an age gate. [CONFIRM whether alcohol is sold]. Until that is confirmed the line is marked conditional rather than stated.
If you sell or ship online
That changes the project. Distance selling under the Brazilian consumer code requires a 7-day right of withdrawal, stated delivery timeframes and full supplier identification, plus handling of payment and address data that this policy does not cover because that store does not exist. No store has been quietly built into this mockup. [CONFIRM whether you sell or ship].
Images
Every photograph is stock, captioned as such in the gallery, and the alt text on each one says it does not depict Paradiso. No brand label is legible in any of them, deliberately. No image shows children. Real photography of the room, the shelves and the food is the first thing to replace before anything goes live.