LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Booking form | Identify the booking | Pre-contractual steps (item V) |
| Email and phone / WhatsApp | Booking form | Confirm the booking | Pre-contractual steps (item V) |
| Check-in / check-out dates, guests | Booking form | Check availability | Pre-contractual steps (item V) |
| Special requests | Booking form | Handle the request | Consent (item I) |
| Guest details required at check-in | At check-in, in person | National guest register (FNRH) | Legal obligation (item II) |
| Newsletter, if subscribed | Send communications | Consent (item I) | |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: Pousada Ilha da Magia, Av. Pref. Acácio Garibaldi São Thiago, 23 — Lagoa da Conceição, Florianópolis - SC, 88062-600, Brazil. [CONFIRM the legal entity name, CNPJ and the data protection officer — LGPD art. 41]. Phone +55 48 3232-5038 · Mobile +55 48 99944-8484 · WhatsApp wa.me/554899448484 · E-mail contatoilhadamagia@hotmail.com.
⚠️ Neither this policy nor a cookie gate existed
Recorded plainly: we found no privacy policy and no cookie-consent mechanism on the current site. Both are mandatory under Brazil’s LGPD. Both were written from scratch for this mockup and need review and the company’s confirmation before they go live.
What this site stores
One thing: ilhadamagia.consent.v1, your cookie choice, in localStorage on this
device. It reaches no server and disappears when you clear site data. No third-party resource
loads before consent — the map in the location section is an SVG drawn here, precisely so Google is not
called without consent.
The forms, and what the availability enquiry actually does
There are three: the availability enquiry, the contact form and the WhatsApp buttons (booking, breakfast and tourism desk). All work the same way: they compose a text message and open WhatsApp with it ready, in the language of the page you are on.
Worth being explicit about one thing, because it is a point of the conversation: the availability enquiry checks no calendar and shows no rate. It asks. The widget on the current site apparently does not check either [CONFIRM what the current widget actually does and which engine sits behind it] — the difference is that this one says so plainly instead of looking like a booking engine it is not.
Booking data
A confirmed booking involves a name, contact details, dates and usually an identity document and a payment method. That processing happens off this site, in the conversation and in the pousada’s own system. [CONFIRM where booking data is held, for how long, who has access, and whether there is a third-party processor — booking engine, PMS or OTA channel]. Until that is answered, this policy asserts nothing about it.
Children
The rule you publish — children always accompanied at the pool — is reproduced on the site as a policy line, in text. And a build rule here: no image shows children or minors. The leisure areas are illustrated by the pool, the garden and the barbecue, with no people in frame.
The testimonials
The eight names in the reviews section are the ones already published on their own site, exactly as they appear there. None has been written, rewritten or invented, and each testimonial’s text migrates from that site. No rating, average or star appears, because they publish none — and an invented average would be misleading advertising under art. 37 of the Brazilian consumer code.
Prices
No nightly rate appears in this build because none is published: every card carries a visible [CONFIRM]. The same goes for the walk-in price of the breakfast buffet — and that one deserves attention, because a buffet open to the public is a consumer sale: under the consumer code and Decreto 5.903/2006 the price has to be visible before somebody sits down.
The Hotmail address
The public e-mail address is a Hotmail one. It works, but a mailbox on the domain itself buys more trust and better deliverability. [CONFIRM whether you want one]. And on any DNS migration, only the web records change — the MX records are never touched, precisely so e-mail does not go down in the middle of the move.
What this site does not claim
No rate, floor area, occupancy, unit count, check-in or check-out time, pet policy, parking capacity, rating, review average, award, founding year, CNPJ or CADASTUR number appears without being marked [CONFIRM]. The per-unit amenities listed are the ones they publish; where they publish none — Chalé Ônix, Chalé Rubí and the numbered suites — the card says so rather than filling in. Every photograph is stock and the alt text on each one says it does not depict the pousada.