LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Form / WhatsApp | Handle the request | Pre-contractual steps (item V) |
| Phone / WhatsApp | Form / WhatsApp | Reply to the enquiry | Pre-contractual steps (item V) |
| Newsletter, if subscribed | Send communications | Consent (item I) | |
| Items of interest | Reserve or set aside the item | Pre-contractual steps (item V) | |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
| Delivery address and CPF | Checkout | To issue the invoice and deliver the order | Performance of a contract (item V) and legal obligation (item II) |
| Order history and customer account | Store registration | To follow orders, exchanges and returns. Subject to art. 18 rights — access, correction, portability and deletion | Performance of a contract (item V) |
| Body measurements given during size help | WhatsApp support | To recommend a size. These are data about a person’s body and deserve the same care as any other personal data | Consent (item I) |
| Return data | Troque Commerce | To process an exchange or return. Third-party processor | Performance of a contract (item V) |
| Newsletter email address | Newsletter form | To send news. A purpose distinct from the purchase, with its own revocable consent | Specific, highlighted consent (item I) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is
THE 4AM CULTURE COMERCIO LTDA — CNPJ 34.953.543/0001-45, published on their own site. Channel for exercising rights: atendimento@the4amculture.com.br. The full registered address [CONFIRM] — distance-selling rules require it to be easily accessible.
One small note: the site domain is .com and the support email domain is
.com.br. [CONFIRM which is canonical]
Your account, your orders and your rights (art. 18)
A customer account, order history, saved addresses and the membership programme are not features: they are a data-processing relationship. At any time, without giving a reason, you can:
- Access everything held about you
- Correct anything wrong or out of date
- Port the data to another supplier
- Delete the account and any data not tied to a tax obligation
- Withdraw any consent, the newsletter included
The response time and the procedure [CONFIRM]. Invoices and sales records carry their own statutory retention period and cannot be deleted on request — that is a legal obligation, not a choice.
Processors and international transfer
This is a Shopify store, and much of the processing happens outside Brazil. Each processor has to be named with its purpose, legal basis, retention period and, for those abroad, the basis for the international transfer (art. 33). The ones identifiable from the outside:
- Shopify — platform, customer accounts and payments
- Troque Commerce — exchanges and returns
- A wishlist app [CONFIRM which]
- Facebook and Google domain verifications — and, behind them, probably advertising pixels [CONFIRM which]
- Payment and anti-fraud providers [CONFIRM]
[CONFIRM the full list of apps installed on the store] — a policy that does not name its processors informs nobody of anything.
Newsletter
Newsletter consent is separate and separable from checkout: its own box, never pre-ticked, never bundled with a purchase (art. 8). Buying subscribes nobody, and unsubscribing affects no order.
Size help
When you send your measurements to the consultants, that is personal data about your body. It is used to recommend a size and nothing else — it does not feed an advertising audience or any segmentation. How long the conversation is kept [CONFIRM].
Refunds, exchanges and the right of regret
Seven calendar days from receipt to cancel for any reason, with a full refund including outbound shipping (CDC art. 49). Separately, a legal warranty of 30 days for non-durable goods and 90 for durable ones, against defects (art. 26). A goodwill exchange policy is additional and replaces neither. [CONFIRM the windows and who pays return postage in each case]
Terms of service
Term, renewal and cancellation of The 4am Zone, if it is paid or recurring [CONFIRM]. If it is free, just say so.
Customer images
No customer photograph is published without written image-rights consent. That applies to Instagram reposts too: being tagged is not a licence. [CONFIRM]