LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Transfer booking form | Identify the passenger in arrivals | Pre-contractual steps (item V) |
| WhatsApp number | Booking form | Confirm price, time and meeting point | Pre-contractual steps (item V) |
| Origin, destination, date and time | Route picker | Assign the vehicle and driver | Pre-contractual steps (item V) |
| Passenger and suitcase count | Route picker | Choose the right vehicle | Pre-contractual steps (item V) |
| Flight number | Route picker | Track delays and adjust the wait — combined with the time and the hotel address it places a specific person at a specific place and hour | Pre-contractual steps (item V) |
| Hotel or destination address | Booking form | Carry out the transfer | Pre-contractual steps (item V) |
| Company and event details | Corporate form | Prepare a proposal | Pre-contractual steps (item V) |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
Why the flight number deserves its own paragraph
On its own a flight number is not much. Alongside the arrival time, the passenger’s name and the hotel address — which is exactly the set a transfer booking collects — it places a specific person, in a specific place, at a specific hour. That set deserves a defined retention period, access limited to whoever is running the job, and disposal at the end. [CONFIRM the retention period, who has access and how it is disposed of].
The practical consequence for the operation: that information should not circulate in a shared WhatsApp group or sit indefinitely in the history of a personal handset.
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: Passeios de Van Floripa, Av. das Nações, 192 — Canasvieiras, Florianópolis — SC, 88054-010, Brazil. [CONFIRM the legal entity name, CNPJ and the data protection officer — LGPD art. 41]. WhatsApp +55 48 99990-0608. E-mail: [CONFIRM] — the current site offers only a Wix form.
⚠️ Neither this policy nor a cookie policy existed
Recorded plainly, because that is where the conversation should start: Passeios de Van Floripa’s current site has no privacy policy and no cookie policy. Both are mandatory. Both had to be written from scratch for this mockup, and both need legal review and the company’s confirmation before they go live.
The broken WhatsApp link
Their page carries two WhatsApp links. One is correct: wa.me/554899900608. The other is
wa.me/48999900608, with no +55 country code — and that one fails on any
foreign phone, which is much of the audience for an airport transfer business in Canasvieiras. Every link
in this mockup uses the +55 form, and the link on the live site is worth fixing regardless of any
contract.
The forms and what they do
There are three: the route picker, the corporate form and the contact form. All work the same way: they compose a text message and open WhatsApp with it ready, in the language of the page you are on. None writes to a server, none sends on its own, and none confirms a booking. You see the message before you tap send. From that point the conversation is handled by WhatsApp under Meta’s policy.
What this site stores
One thing: pvf.consent.v1, your cookie choice, in localStorage on this
device. It reaches no server and disappears when you clear site data.
Nothing third-party loads before consent
No Google Analytics, no pixel, and no embedded map — the map in the contact section is an SVG drawn here, precisely so Google is not called without your consent. The photographs come from a stock image CDN. Analytics and marketing are off by default and “Reject all” carries the same weight as “Accept all”.
Registrations this site displays — and none of them invented
CADASTUR: registration with the Brazilian Ministry of Tourism is a legal requirement for a tourist transport operator and appears nowhere on the current site. [CONFIRM the number and whether it is active] — it is the first question of the meeting, and if there is no registration that is a conversation to have before the build, not after. Also [CONFIRM the CNPJ], [CONFIRM DETER/SC and municipal authorisation] — their declared service area is intrastate, so that is the live requirement — and [CONFIRM ANTT registration] if any service crosses a state line. Passenger insurance and its coverage: [CONFIRM]; no coverage figure has been written here.
Prices
No fare is published on the current site and none has been invented in this mockup: every cell of the route table is a visible [CONFIRM]. Once fares exist, the table is a price display governed by Brazilian consumer law and must state whether the price is per vehicle or per passenger, what it includes, what triggers a surcharge, and the cancellation and no-show policy — all in Brazilian reais (R$). Never in US dollars and never in pesos, which matters particularly on the Spanish page.
What this site does not claim
No price, journey time, passenger capacity, luggage allowance, opening hours, vehicle model, founding year, CNPJ, CADASTUR number, insurance policy, rating, review or testimonial appears without being marked [CONFIRM]. Both design references behind this build show star ratings and per-card prices; both were rejected. There is not one photograph of the vehicles, the team or the premises: the fleet silhouettes are drawings, and every photograph is stock, said so in its alt text. No image shows children — the child-seat policy is a line of text, not a photograph.