LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Tour / proposal form | Identify the enquiry | Pre-contractual steps (item V) |
| Phone / WhatsApp and email | Form | Reply to the enquiry | Pre-contractual steps (item V) |
| Company and headcount | Form | Size the proposal | Pre-contractual steps (item V) |
| Plan of interest and start date | Form | Prepare the proposal | Pre-contractual steps (item V) |
| Contract details | At contracting, off the website | Formalise the contract | Legal obligation (item II) |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
| Member-area login, password and history | Member registration | Room booking, billing and history. Subject to art. 18 rights — access, correction, portability and deletion | Performance of a contract (item V) |
| Company incorporation documents | Taking a fiscal or commercial address | To support registering, transferring or opening the company at the address | Performance of a contract (item V) and legal obligation (item II) |
| Mail received in the client’s name | Fiscal address | To receive, notify, hold and return it. Including mail from public bodies, which usually carries a deadline | Performance of a contract (item V) |
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
The member area
There is a member area with a login at /cliente. A login area means an account, a
password, a billing record and a booking history — and it is exactly what makes a privacy
policy and a consent bar mandatory rather than optional. Today the site has
neither.
Over that data you can, at any time and without giving a reason: access it, correct it, port it, delete whatever is not tied to a tax retention period, and withdraw consent (LGPD art. 18). The response time and the channel [CONFIRM]. What the member area actually does — booking? billing? both? — also [CONFIRM].
Fiscal address: documents and mail
Vilaj advertises the documentation it holds for the address — habite-se comercial, fire-service licences, IPTU, proofs. The other side of that is that Vilaj also comes to hold the client’s incorporation documents and to receive the client’s mail, including mail from public bodies with deadlines on it.
The contract has to state how mail is received, notified, held and returned, and what happens to the registered address on termination. [CONFIRM the terms] Third-party mail is not opened. [CONFIRM — if envelopes or contents are scanned, that is additional processing and has to be written down]
Cookies and what runs today
The current site is Squarespace and has no consent bar, which means the platform’s own analytics and any embedded script load before any choice is made. In this proposal everything non-essential is off by default, rejecting is as easy as accepting, and nothing is pre-ticked. [CONFIRM the full list of scripts and integrations]
Retention
Enquiries that did not become a plan [CONFIRM]. Member accounts and contracts follow the applicable tax and civil periods [CONFIRM]. Company documents held for the fiscal address have their own period [CONFIRM with the accountant].
Plan terms
Minimum term, cancellation notice, renewal and refunds for the Full-Time Plan and the Hour Packages [CONFIRM all of them]. For an hour package, whether unused hours expire is a material term and belongs beside the price, not here. For a room, the cancellation window and the no-show rule likewise.
Vilajer company logos
The logo wall publishes third-party company marks. Each one needs written permission from the company that owns it, and no real mark appears in this mockup. [CONFIRM]