LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Booking form | Identify the booking | Pre-contractual steps (item V) |
| Email and phone / WhatsApp | Booking form | Confirm the booking | Pre-contractual steps (item V) |
| Check-in / check-out dates, guests | Booking form | Check availability | Pre-contractual steps (item V) |
| Special requests | Booking form | Handle the request | Consent (item I) |
| Guest details required at check-in | At check-in, in person | National guest register (FNRH) | Legal obligation (item II) |
| Newsletter, if subscribed | Send communications | Consent (item I) | |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: Hotel Boutique Quinta das Videiras, Rua Afonso Luis Borba, 81 — Lagoa da Conceição, Florianópolis, SC — CEP 88062-040, Brazil. [CONFIRM the legal entity name, CNPJ and the data protection officer — LGPD art. 41].
Reservations: +55 (48) 3232-3005 · reservas@quintadasvideiras.com. Commercial and events: +55 (48) 99991-8065 · comercial@quintadasvideiras.com.
One practical infrastructure note: the website is quintadasvideiras.com.br but the e-mail
addresses are @quintadasvideiras.com, without the .br. It works, but it splits
the identity and complicates deliverability. [CONFIRM whether consolidating is worth
it]. And on any DNS migration, only the web records change — the MX records are never
touched.
⚠️ The current privacy policy needs auditing
Their site menu carries a “Políticas” item. It is worth opening it and checking whether it contains an LGPD-compliant privacy notice — an identified controller, purposes, legal bases, retention periods and a channel for exercising data-subject rights — or only house rules (check-in times, cancellation policy, pool rules). They are different documents and one does not substitute for the other. [CONFIRM]
⚠️ Three things this build did not publish, and why
This is the part of this policy that matters most on this lead. Three elements of the current site were not carried into the mockup, and each has a concrete reason.
1. The “10 best hotels in Brazil” ranking
Their homepage says: “We are among the 10 best hotels in Brazil.” With no awarding body and no year. It appears nowhere in this build. An unsourced ranking is advertising that cannot be substantiated — exposure under art. 37 of the Brazilian consumer code — and even if the source exists, an undated ranking ages and becomes false on its own. [CONFIRM the publication and the year, or drop it entirely]
2. The four 9,4/10 scores
The homepage displays four badges — 9,4/10 FANTÁSTICO, 9,4/10 EXCEPCIONAL, 9,4/10 FANTÁSTICO, 9,4/10 EXCELENTE — and no platform logo rendered, so where any of the numbers come from is unknown. No score has been printed in this mockup. The section exists, with marked slots for the platform, and the guidance is to pull live rather than hardcode: a fixed score ages exactly like a ranking. [CONFIRM which platforms]
3. The signed testimonials
The homepage carries two testimonials attributed to named people, each with a stated profession. Republishing a person’s name, their profession and a sentence attributed to them is a privacy and risk question, not merely an editorial one. LGPD treats a name as personal data, and attributing a statement to an identified person needs a legal basis — in practice, documented permission.
So the testimonial module in this build degrades gracefully: until written permission
exists it shows initials only and marks the text as to be confirmed. There is a switch at the top of
script.js that controls this, and it is off.
[CONFIRM written permission from each guest quoted]
There are also two pull-quotes on the homepage with no visible attribution at all. Before republishing them, where they came from needs establishing. [CONFIRM the source and date of both]
⚠️ No WhatsApp link exists on the current site
In Brazil WhatsApp is usually the primary channel — and there is not one wa.me link on
their site. The commercial number carries a mobile prefix and probably answers there, but
probably is not confirmed, and this mockup does not build a link from a guess: if the line
does not answer on WhatsApp, the message simply never arrives. The buttons stay disabled and explain that.
Both published phone numbers work now, as calls.
What this site stores
One thing: quinta.consent.v1, your cookie choice, in localStorage on this
device. It reaches no server and disappears when you clear site data. The map in the location
section is an SVG drawn here, not an embedded map, precisely so Google is not called without consent.
The forms
There are four: the availability enquiry, weddings and events, a table at the Bistrô and the newsletter. All compose a message and hand it to WhatsApp; none writes to a server and none confirms a booking. Dates render as DD/MM.
Two notes. First, weddings and room bookings have separate forms, because they are different sales with different timescales, values and questions — today they share one path. Second, the newsletter has its own unbundled consent, in a checkbox of its own, as LGPD requires — never folded into another form’s acceptance.
Accessibility
Worth recording as a finding: the current Wix-built site is leaking an accessibility helper string as visible navigation text — “Use tab to navigate through the menu items” appeared on both pages fetched. Not serious in itself, but it is a symptom: worth testing real keyboard navigation, with a visible focus state on every control.
What this site does not claim
No rate, unpublished floor area, rating, ranking, award, founding year, CNPJ or CADASTUR number appears without being marked [CONFIRM]. The suite measurements and descriptions are transcribed from their own /suites page, word for word — including where the Luxo category gave no description and Premium gave no floor area: the card says so rather than filling in.
The three building elevations are drawings, not photographs, and their alt text says so. There is no honest stock image of Casarão Lisboa, of a stained-glass Solarium whose frame came from Vietnam, or of Casa Porto — and putting the wrong building there would be worse than drawing one. Every photograph is stock and none depicts the hotel, the suites or the team. No image shows children. This is the property in the batch that most needs your own photography: it should end up with zero stock images.