LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Availability enquiry / contact | Identify the booking | Pre-contractual steps (item V) |
| Phone and e-mail | Availability enquiry / contact | Reply and confirm | Pre-contractual steps (item V) |
| Arrival and departure dates | Availability enquiry | Check availability | Pre-contractual steps (item V) |
| Number of adults and children | Availability enquiry | Allocate the right room — stated by you, never inferred | Pre-contractual steps (item V) |
| Promo code | Availability enquiry | Apply a rate condition, if any | Pre-contractual steps (item V) |
| Analytics cookies | Browsing, only after consent | Measure site usage | Consent (item I) |
| TripAdvisor widget | Browsing, only after consent | Show live reviews and ranking — it is a third-party tracker | Consent (item I) |
Children on a booking — a field, not a photograph
The availability enquiry asks how many adults and how many children, because that decides which room fits and how it is priced. It is stated by you, never inferred. [CONFIRM the children policy, cot availability and age-band pricing].
Recorded separately because it is a build rule here: the lodge lists a Play-Ground among its amenities, and it is referenced in copy as a facility. No image on this site shows children or minors — not at the playground, not at the pool, not on the trail, not on the beach.
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: Pousada Ilha Faceira, Campeche, Florianópolis (SC), Brazil. [CONFIRM the legal entity name, CNPJ, full address with postcode and the data protection officer — LGPD art. 41]. Landline +55 48 3364-0421 · Mobile +55 48 98850-6595 · E-mail [CONFIRM].
Note that the full address is not published on their homepage, and it has not been inferred here: a neighbourhood is not an address.
⚠️ We found no privacy policy and no cookie gate
Said plainly, because that is where the conversation should start: we could not locate a privacy policy or a cookie-consent mechanism on the fetched homepage [CONFIRM whether one exists on another page]. Both are mandatory under LGPD. Both were written from scratch for this mockup and need review and the owners’ confirmation before they go live.
⚠️ No WhatsApp number has been confirmed
There is no wa.me link anywhere on their site. The mobile number +55 48 98850-6595 is
published and carries a mobile prefix — but a mobile prefix alone does not confirm that the line
answers on WhatsApp. So this mockup does not build a link from a guess: every WhatsApp control is
visibly disabled and explains why when tapped. Both phone numbers work now, as calls, because those are
theirs and verified.
⚠️ The TripAdvisor ranking claim
Their homepage carries, hand-written and undated: “Our guesthouse is No. 1 of 321 in Florianópolis, according to TripAdvisor reviews.” Rankings move. A position fixed in the code that quietly ages stops being social proof and becomes advertising that has stopped being true — exposure under art. 37 of the Brazilian consumer code, not merely an embarrassment.
This mockup asserts no position at all. The module exists, but it renders the line only beside a visible date, and that date is a [CONFIRM] until the value is pulled live. The ten review handles and dates shown are the ones already on their homepage; each review’s text comes from TripAdvisor through the integration, and none has been written or rewritten here.
The TripAdvisor widget is a third-party tracker
Pulling the reviews live is the right thing to do, and it has a privacy cost: the widget hands the visitor’s IP and an identifier to TripAdvisor. So it sits in the marketing category of the consent gate and does not load before consent. In this build it is not even wired up. The map in the location section is an SVG drawn here, precisely so Google is not called without consent.
What this site stores
One thing: faceira.consent.v1, your cookie choice, in localStorage on this
device. It reaches no server and disappears when you clear site data.
The forms
There are two: the availability enquiry and the contact form. Both compose a text message and hand it to WhatsApp, in the language of the page you are on. Neither checks a calendar, neither writes to a server and neither confirms a booking. While the number is unconfirmed they send nowhere at all: they show the notice above. Dates render as DD/MM.
Rates
No rate appears in this build because none is published — their widget hides everything behind “consultar valores”. The proposed change is to show a range before the search, and that range appears here as a visible [CONFIRM], never as an invented figure.
Sustainability — what this site does not claim
“Sustainable refuge” is their page title, and two concrete things partly support it: the land is theirs with the vegetation preserved, and the route to the beach is a trail rather than a road. That is said. No environmental certification, energy system or waste programme has been asserted, because none was published — and a false environmental badge is among the most expensive claims there is to be caught on. [CONFIRM specific sustainable practices].
Ilha do Campeche
The island appears in the copy as landscape, and nothing more. No access is offered, promised or implied: visits carry a legally capped daily quota, as a protected archaeological and environmental site. [CONFIRM the current rules before any copy about visiting the island].
What this site does not claim
No rate, floor area, room category, unit count, occupancy, check-in time, cancellation policy, distance in minutes beyond the three of the trail (which is their own figure), rating, average, award, founding year, CNPJ or CADASTUR number appears without being marked [CONFIRM]. The room categories are empty for a specific reason: their accommodations page returns a 404 on both obvious paths, so there was nothing to read — and inventing a room is worse than leaving the slot marked. Every photograph is stock and the alt text on each one says it does not depict the lodge, the trail or the team.