LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Booking form | Identify the booking | Pre-contractual steps (item V) |
| Email and phone / WhatsApp | Booking form | Confirm the booking | Pre-contractual steps (item V) |
| Check-in / check-out dates, guests | Booking form | Check availability | Pre-contractual steps (item V) |
| Special requests | Booking form | Handle the request | Consent (item I) |
| Guest details required at check-in | At check-in, in person | National guest register (FNRH) | Legal obligation (item II) |
| Newsletter, if subscribed | Send communications | Consent (item I) | |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: Pousada Bangalôs da Mole, Praia Mole, Florianópolis (SC), Brazil. [CONFIRM the legal entity name, CNPJ, full address and the data protection officer — LGPD art. 41]. There is no website, no published phone number and no published e-mail address. The only public channel identified is the Instagram profile @oyopousadabangalosdamole, which sits behind a login wall and returns nothing to a server-side request.
⚠️ The franchise question comes before this policy
Their public handle begins with a franchise prefix. If the affiliation is live, the controller of booking data may not be the pousada alone: a franchise platform typically runs the booking engine, holds the guest data and sets the policy. That changes the content of this entire page. [CONFIRM the franchise relationship and, if there is one, who controls booking data and under whose policy].
Until that is clarified, this policy describes only what this site does, which is little, and deliberately so.
⚠️ No WhatsApp number was captured — and none has been invented
There is no phone number, no WhatsApp and no e-mail. Rather than drop in a stand-in number, every WhatsApp control in this build is visibly disabled and explains why when tapped. An invented number on a published site is not a layout detail: it is a stranger’s phone ringing. Confirm the number and the whole page works with no other change.
What this site stores
One thing: bangalos.consent.v1, your cookie choice, in localStorage on this
device. It reaches no server and disappears when you clear site data.
The Instagram feed sits behind consent
The Instagram embed is a third-party tracker: loading it hands your IP and an identifier to Meta before you do anything at all. So it sits in the marketing category and does not load without consent. Until then the section shows static stock images and no request leaves this page for Meta. In this build the real embed is not even wired up.
The forms
There are two: the availability enquiry and the contact form. Both compose a text message and hand it to WhatsApp. Neither checks a calendar, neither writes to a server and neither confirms a booking. While there is no confirmed number they send nowhere at all: they show the notice above. Dates render as DD/MM.
Rates, and the deliberate silence about them
No rate appears in this build because none is published. One more thing worth recording: nowhere have we written that booking direct is cheaper. Franchise and OTA agreements commonly impose rate parity and forbid advertising a lower direct rate; such a line going live can be a breach. It only ships after [CONFIRM the contractual freedom to make it].
Reviews
No review, rating, average or award appears on this site. Beyond there being none verified, there is a question of ownership: if the pousada was on a franchise platform, the review history may belong to that platform and may not be yours to republish. [CONFIRM].
What this site does not claim
No bungalow count, unit type, occupancy, bed configuration, rate, distance in metres or minutes, amenity, check-in time, cancellation policy, pet policy, language spoken at reception, founding year, CNPJ or CADASTUR number appears without being marked [CONFIRM]. The site plan is illustrative and says so on its own face; the markers are generated from a list, so the real count drops in without a redraw. No address has been inferred from the name: “da Mole” points at Praia Mole, but a name is not an address.
A question worth asking early that this site does not answer: [CONFIRM whether there is step-free access]. Bungalows scattered on sloped coastal ground frequently have none, and a guest needs to know before booking, not on arrival.
Images
Every photograph is stock and the alt text on each one says it does not depict the pousada. None shows the bungalows, the grounds or the team. No image shows children. Real photography of each bungalow, inside and out, is the first thing to replace.