LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Form / WhatsApp | Handle the request | Pre-contractual steps (item V) |
| Phone / WhatsApp | Form / WhatsApp | Reply to the enquiry | Pre-contractual steps (item V) |
| Newsletter, if subscribed | Send communications | Consent (item I) | |
| Items of interest | Reserve or set aside the item | Pre-contractual steps (item V) | |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
| Skin type, skin condition, allergy and pregnancy | A request for a recommendation, in store or by message | To recommend a product safely. It is health data (art. 5, II) from the moment it is written down, and it is only processed under specific, highlighted consent | Specific consent (art. 11, I) |
| A vegan, organic or ingredient-free preference | Conversation with staff | To filter a recommendation. It can reveal a philosophical conviction, which is also sensitive data under art. 5, II | Specific consent (art. 11, I) |
| Purchase history in the physical shop | Counter sale | To issue the invoice, handle exchanges and meet the statutory warranty | Performance of a contract (art. 7, V) and tax obligation (art. 7, II) |
| Data from people buying on the online shop | A shop on another domain, if it is the same company | To process the order and the delivery. [CONFIRM whether the online shop is the same legal entity] — if it is not, there are two controllers and the databases do not merge | Performance of a contract (art. 7, V) |
In a cosmetics shop, skin is a health subject. Anyone asking for a recommendation mentions acne, eczema, rosacea, pregnancy or an allergy without thinking twice — and the moment that becomes a note, a record or a saved message, it is sensitive data under LGPD art. 5, II. Art. 11 is narrower than art. 7: it requires specific, highlighted consent for a stated purpose. A vegan preference falls under the same rule, because it can reveal a philosophical conviction.
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is: to be confirmed
A privacy policy has to name the controller, the CNPJ and a channel for art. 18 requests. A public record exists under TERRA MAYA COSMETICOS NATURAIS LTDA, with a CNPJ, but it came from a company-data aggregator rather than from the business — and records of that same class carry, for this business, a website that has not existed for years.
So none of it has been printed here as fact. [CONFIRM registered name, CNPJ, address and the data officer (DPO)] A registration detail copied from an aggregator is exactly the kind of thing you discover is wrong after you publish it.
Skin, allergies and pregnancy
Recommending a cosmetic well means knowing who it is for. The problem is not the conversation at the counter — it is what happens after it: the customer record, the WhatsApp history, the recommendations spreadsheet. If the information is kept, it needs specific consent, a written purpose and a retention period. If it is not kept, better still — and that is worth telling the customer.
What must never happen: using a skin condition to segment a campaign, build an ad audience or feed an automated recommendation. [CONFIRM what is kept today and where]
Two web addresses, and what that means for the data
The domain the press points at, terramayacosmetica.com.br, does not resolve.
A shop exists at terramaya.com.br and we could not confirm it is the same
legal entity.
That is not only a marketing question. If they are two companies, they are two controllers: someone who bought from one is not the other’s data subject, the databases cannot be merged into one mailing list, and each answers for its own art. 18 requests. Settling who owns which address comes before any campaign goes out. [CONFIRM]
Two Instagram profiles
A direct message is not a data-subject channel: it has no deadline, no auditable record, and it depends on somebody seeing the message. With two profiles it gets worse, because a deletion request can land on the account nobody watches. A dedicated e-mail address solves it. [CONFIRM]
Cookies
Everything non-essential is off by default, rejecting is as easy as accepting, and nothing is pre-ticked. A shop with an online catalogue almost always ends up with a social pixel and a shopping feed: both are marketing cookies and both wait for the opt-in. [CONFIRM the list when the site goes live]
Retention
Enquiries that did not become a purchase [CONFIRM]. Sales, invoices and exchanges follow the applicable tax and civil periods [CONFIRM with the accountant]. Information about skin is deleted once it is no longer needed for the recommendation, and the customer can ask for deletion at any time.
Exchanges, withdrawal and warranty
A purchase made away from the premises — website, WhatsApp, social media — carries seven days of withdrawal under CDC art. 49, counted from receipt. An opened cosmetic is the classic edge case and the policy has to be written down before the purchase, not at the moment of the exchange. [CONFIRM the exchange policy]
The statutory warranty is 30 days for non-durable goods, which covers most cosmetics (CDC art. 26, I). Expiry date and batch belong to the manufacturer and must be legible on the label.
Product claims
Cosmetics are regulated by ANVISA and cannot carry a therapeutic claim: to treat, cure or relieve a symptom changes the product’s category. “Organic”, “vegan” and “cruelty free” depend on certification per product, and an environmental claim has to be provable under CONAR’s standard. Under the CDC (arts. 30 and 37), whatever is published binds the shop. [CONFIRM product by product]