LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Availability enquiry / contact form | Identify the booking | Pre-contractual steps (item V) |
| WhatsApp number | Availability enquiry | Reply and confirm the stay | Pre-contractual steps (item V) |
| Check-in and check-out dates | Availability enquiry | Check availability | Pre-contractual steps (item V) |
| Number of adults and children | Availability enquiry | Allocate the right unit — stated by you, never inferred | Pre-contractual steps (item V) |
| Preferred view | Availability enquiry | Filter units by view category | Pre-contractual steps (item V) |
| Google Tag Manager (GTM-MBQ68L5W) | Browsing, only after consent | Measure site usage — on the current site it fires without consent | Consent (item I) |
| Asksuite (booking assistant) | Browsing, only after consent | Chat-based service and booking — on the current site it loads without consent | Consent (item I) |
Children on a booking — a data field, not a photograph
The availability form asks how many adults and how many children. That is needed to allocate the right unit and price it correctly, and it is stated by you — never inferred. [CONFIRM the children policy, cot availability and age-band pricing].
Recorded separately because it is a build rule here: Pietra Flat has a Family Room and a Luxury Family Room Sea View in its inventory, and both are described in copy as family accommodation. No image on this site shows children or minors. The family units are illustrated by the room, the view and the layout.
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: Pietra Flat — which also appears as “HOTEL PIETRA FLAT” in the site’s own hero. [CONFIRM which is the trading name]. Address: Estr. Dom João Becker, 1389 — Praia dos Ingleses, Florianópolis, SC — 88058-600, Brazil. [CONFIRM the legal entity name, CNPJ and the data protection officer — LGPD art. 41]. WhatsApp +55 48 99800-8363. E-mail: flatpietra@gmail.com.
⚠️ There was no privacy policy and no cookie gate
This is the most urgent point in the conversation, which is why it sits at the top. The current site at
flatpietra.com.br loads Google Tag Manager (container GTM-MBQ68L5W) and the Asksuite
assistant (cdn.asksuite.com/infochat.js, company id pietra-flat) the moment the
page opens — before any consent, because no consent mechanism exists in the served HTML, and no
privacy policy link exists anywhere. Both set identifiers. That is LGPD exposure, not a technical
footnote.
In this mockup both sit behind the consent gate, in separate categories, with “Reject all” the same size as “Accept all” and both non-essential categories unticked by default. Neither is actually loaded here: a mockup does not fire anybody’s container.
What this site stores
One thing: pietra.consent.v1, your cookie choice, in localStorage on this
device. It reaches no server and disappears when you clear site data.
The forms
There are two: the availability enquiry and the contact form. Both compose a text message and open WhatsApp with it ready, in the language of the page you are on. Neither checks a calendar, neither writes to a server, and neither confirms a booking. You see the message before you send it. [CONFIRM which booking engine sits behind Asksuite and how long conversations are kept].
The hotel’s e-mail address
The public address is flatpietra@gmail.com. It works, but a mailbox on the domain itself
(something like reservas@flatpietra.com.br) is better for trust, for deliverability and for
continuity when somebody leaves the team. [CONFIRM whether one already exists].
And on any DNS migration, only the web records change — the MX records are never touched.
What this site does not claim
No rate, floor area, bed configuration, maximum occupancy, amenity, pool, parking, breakfast policy, rating, review, award, star classification, CNPJ or CADASTUR number appears without being marked [CONFIRM]. None of it exists in the current site’s bundle, and none has been invented. The eleven unit taglines are theirs, word for word, from the app’s own PT/EN/ES string tables — with one correction: the Portuguese garden-view tagline shipped live with a grammatical error (“voltada para ao jardim”), silently fixed here.
Also marked, and not resolved, is the positioning conflict: the lead sheet describes the property as hilltop, and their own site copy says “frente ao mar” — on the seafront. We built to what the site says and left the discrepancy visible.
Images
Every photograph is stock, captioned as such in the gallery, and the alt text on each one says it does not depict Pietra Flat. The view is literally the product, so real photography from inside each class — sea, side sea and garden — is the first thing to replace. No image shows children.