LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Contact form | Identify who got in touch | Pre-contractual steps (item V) |
| Phone / WhatsApp | Contact form | Reply to the enquiry | Pre-contractual steps (item V) |
| Contact form | Reply to the enquiry | Pre-contractual steps (item V) | |
| City / area | Contact form | Assess the service area | Pre-contractual steps (item V) |
| Description of the job | Contact form | Prepare the quote | Pre-contractual steps (item V) |
| Photos sent via WhatsApp | When you send them | Assess the job and quote | Pre-contractual steps (item V) |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
| City and neighbourhood | Contact form | To check the property is in the service area — Palhoca, Florianopolis, Sao Jose, Balneario Camboriu | Preliminary steps to a contract (item V) |
| Project type and property type | Contact form | To route to the right practice area: design, interiors, renovation or full turn key | Preliminary steps to a contract (item V) |
| Email address for the e-book | E-book form | To send the material and later content. A distinct purpose from the contact form, with its own consent | Specific, highlighted consent (item I) |
| Advertising and browsing identifiers | Only after marketing consent | To measure conversions and build remarketing audiences in Google Ads | Consent (item I) — never legitimate interest |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Three consent points, not one
This site asks for data at three moments and each has a different purpose, so each carries its own checkbox, unticked by default, with the purpose written beside it: the contact form, the quote request and the e-book download. Reusing a single “I agree” across all three does not meet LGPD art. 8, which requires consent for determined purposes.
Consenting to the e-book does not authorise commercial contact about a project, and requesting a quote does not authorise a newsletter. Any of the three can be withdrawn at any time, without giving a reason, through the channel below.
Google Ads, remarketing and measurement
Paid traffic campaigns point at this site. The Google Ads conversion and remarketing tags are marketing cookies and do not fire before opt-in in the cookie bar. That applies to the campaign landing pages too.
The practical consequence, said out loud because almost nobody says it: anyone who rejects marketing is not counted in conversion measurement. The right way to handle that is consent mode or server-side tagging — not firing the tag anyway. [CONFIRM which tags exist today, who administers the account and whether consent mode is configured]
Virtual reality and 360° tours
No tour loads automatically. The viewer is a click-to-load facade: until you click, no request leaves your browser for the platform hosting the tour, and no third-party cookie is written. [CONFIRM the platform and its privacy policy]
Photography, projects and client confidentiality
Every published project image depends on two things: a usage licence from the photographer, per image, and a written release from the property owner. Before and demolition imagery needs the same release as the finished photography.
One concern specific to this region: Pedra Branca and Alphaville are gated communities. Publishing a recognisable address or a floor plan of a private residence is a matter of the resident’s security, not only their privacy. [CONFIRM]
Retention
How long the data from an enquiry that did not become a project is kept: [CONFIRM]. Enquiries that become contracts follow the applicable tax and civil retention periods [CONFIRM]. E-book sign-ups are kept until withdrawal [CONFIRM].
Map
No third-party map is embedded. The location block is a drawing of our own and becomes a link out to the visitor’s maps app — no request leaves before a deliberate click.