LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Form / WhatsApp | Handle the request | Pre-contractual steps (item V) |
| Phone / WhatsApp | Form / WhatsApp | Reply to the enquiry | Pre-contractual steps (item V) |
| Newsletter, if subscribed | Send communications | Consent (item I) | |
| Items of interest | Reserve or set aside the item | Pre-contractual steps (item V) | |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
| Delivery address and CPF | Reserving a piece that will be posted | To issue the invoice and send the piece. Reserving over WhatsApp becomes a distance sale, with everything that brings | Performance of a contract (item V) and legal obligation (item II) |
| Body measurements given during a size conversation | Size conversation | To say whether a piece will fit. These are data about the body of the person asking and they feed no list | Consent (item I) |
| WhatsApp or email on the drop list | Drop list form | To say when the rail is restocked. A single purpose, with its own consent and an easy way out | Specific, highlighted consent (item I) |
| Consignor details | Consignment form | To record the pieces received and pay the consignor | Performance of a contract (item V) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
The drop list — and what it is not
The list that says when the rail is restocked contains only people who asked to be on it, through its own form, with its own unticked box. It is not built from people who messaged asking the price of a dress, nor from people who reserved a piece, nor from people who bought once. Asking about a piece is not signing up to a list.
Leaving takes one word: reply “stop” in the conversation and it is done, with no reason required and no retention attempt. Consent is revocable at any time (LGPD art. 8, § 5), and revoking it affects no purchase already made.
Reserving a piece
Reserving over WhatsApp feels like a conversation, but when the piece goes by post it becomes a distance sale: a name, a phone number, a CPF for the invoice and a delivery address. Those data are used to invoice and to send, and nothing else. How long they are kept [CONFIRM] — invoices carry their own statutory period and cannot be deleted on request.
When someone asks what size they wear
If you send your measurements to find out whether a piece will fit, that is personal data about your body. It is used to answer your question and nothing else: it does not go on a list, it does not become a segment, and it is not stored for later. [CONFIRM how long conversations stay on the device]
Consignors
Someone leaving pieces hands over two things at once: personal data and property. The policy covers the contact details and the record of the pieces received; the consignment contract covers the split, the period, what happens to what does not sell and who is liable for loss or damage. [CONFIRM the real terms — no percentage or period has been published in this mockup]
Photographs of pieces, and photographs of people
Photographs of pieces belong to the shop. No customer photograph is published without written image-rights consent — and that includes Instagram reposts: being tagged is not a licence. If a consigned piece appears in a photograph its previous owner took, her permission is needed too. [CONFIRM]
No image of a child is published, in any section, including the children’s clothing one. Children’s stock is photographed as a garment — flat, on a hanger or folded.
Terms of use and shop information
This mockup was built from public secondary sources. The address, postcode, hours, phone, CNPJ and registered name are all [CONFIRM], and the CNPJ has to appear in the footer before any sale. A shop shipping across Brazil needs its fiscal position settled, including how consigned goods are treated [CONFIRM with the accountant].