LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Availability enquiry / contact | Identify the booking | Pre-contractual steps (item V) |
| WhatsApp and e-mail | Availability enquiry / contact | Reply and confirm | Pre-contractual steps (item V) |
| Check-in and check-out dates | Availability enquiry | Check availability | Pre-contractual steps (item V) |
| Number of adults and children, and children’s ages | Availability enquiry | Allocate the right unit and price it — stated by you, never inferred | Pre-contractual steps (item V) |
| Type of accommodation | Availability enquiry | Route the enquiry | Pre-contractual steps (item V) |
| Whether a pet is coming | Availability enquiry | Apply the pet policy (size, fee and advance notice) | Pre-contractual steps (item V) |
| Event or retreat details | Events form | Prepare a proposal | Pre-contractual steps (item V) |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
Children on a booking — a field, and nothing beyond it
The availability enquiry asks how many children and, if any, their ages. It is the same pair of fields their own form already uses, and it exists to allocate the right unit and price it. It is stated by you, never inferred. [CONFIRM the children policy and age-band pricing].
Two build notes worth recording. First, no image on this site shows children or minors. Second, one of the certifications their site cites is precisely the certificate against the sexual exploitation of children in tourism. That is a serious commitment — and for that exact reason it is the mark that least belongs on a page without being current. It appears here as a marked slot, alongside the other two.
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
Controller: Pousada Vila Tamarindo Eco Lodge, Av. Campeche, 1836 — Campeche, Florianópolis, SC, Brazil. [CONFIRM the legal entity name, CNPJ and the data protection officer — LGPD art. 41]. Phone +55 48 99183-3464 · E-mail reservas@tamarindo.com.br.
⚠️ We found no privacy policy on the current site
Recorded plainly: we could not locate a privacy policy or a cookie gate on their site. Both are mandatory under Brazil’s LGPD. Both were written from scratch for this mockup and need review and the owners’ confirmation before they go live.
⚠️ The award claims and the three certifications
This is the part that matters most in this conversation, and it is good news in disguise: they have substance to spare and are using the wrong words to describe it.
The awards
The current site says “the various awards received confirmed the quality and excellence of this small and charming ecological hotel” and refers to an “award-winning garden”. Not one award is named anywhere on the site. An award claim with no award, no body and no year is advertising that cannot be substantiated — exposure under art. 37 of the Brazilian consumer code. Neither line made it into this mockup. [CONFIRM which awards, who granted them and in what year — or drop both]
The certifications
The site cites three: the Programa de Certificação do Turismo Sustentável (with APEX support and BIRD funding), the Sistema de Gestão Sustentável (with the Instituto de Hospitalidade and the Programa Bem Receber), and the certificate against the sexual exploitation of children in tourism. None carries a certificate number or a validity date. Certification programmes lapse, and several of these belong to a phase of Brazilian tourism policy that has since changed.
So no mark is displayed in this mockup. All three appear as marked slots, and there is
a switch at the top of script.js that controls it — it is off.
[CONFIRM the number and validity of each, or remove them]
⚠️ The breakfast contradiction
Two pages of their site say different things about the same thing. The homepage calls the homemade breakfast a “signature”; the Sustainability page says “the homemade breakfast (temporarily suspended)”. One of them is wrong, and the person who finds out is the guest who has already booked. This mockup shows both, side by side, rather than picking one. [CONFIRM the current status]
⚠️ No WhatsApp link exists on the current site
+55 48 99183-3464 carries a mobile prefix and is probably the WhatsApp line — but probably is not confirmed, and this mockup does not build a link from a guess: if the line does not answer there, the message simply never arrives. The number works now, as a call.
The sustainability fee
They have charged a sustainability fee since October 2020, allocated 100% to sustainable purposes. It is good policy and a good selling point — and it is also a mandatory charge. Under the Brazilian consumer code and Decreto 5.903/2006, a mandatory amount must appear clearly before the booking closes, not as a surprise at check-in. [CONFIRM the amount and where it is disclosed in the booking flow]
What this site stores
One thing: tamarindo.consent.v1, your cookie choice, in localStorage on this
device. It reaches no server. The map in the location section is an SVG drawn here, not an
embedded map, precisely so Google is not called without consent.
The forms
There are two: the availability enquiry and the events and retreats form. Both compose a message and hand it to WhatsApp; neither writes to a server and neither confirms a booking. Dates render as DD/MM. Events and nightly bookings have separate forms on purpose: they are different sales, with different timescales and different questions.
What this site does not claim
No rate, floor area, bed configuration, occupancy, sustainability fee amount, pet fee, distance in minutes, rating, review, award, current certification, CNPJ or CADASTUR number appears without being marked [CONFIRM]. The only year published is 1999, because it is theirs.
All the sustainability content is transcribed from their own page, word for word — nothing was added, and nothing needed to be: it is the most substantial documentation in this entire batch. The two diagrams (the irrigation loop and the ventilation axis) are drawings, because no photograph shows a closed loop or a wind axis. Every photograph is stock and the alt text on each one says it does not depict the lodge, the garden, the demolition-wood furniture or the team.