LGPD · Law 13.709/2018
Privacy Policy
Last updated: [CONFIRM date]
[CONFIRM — this document is a structural template within the mockup. It must be reviewed by a lawyer and completed with the company's real details before launch. No company name, CNPJ, address, email or period below is real.]
1. Data controller
The controller of personal data processed through this site is [CONFIRM registered company name], CNPJ [CONFIRM], registered office at [CONFIRM full address], Florianópolis — Santa Catarina, Brazil.
Privacy contact: [CONFIRM DPO email]. Data Protection Officer: [CONFIRM name or “not applicable”].
2. What we collect and why
| Data | When | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name | Contact form | Identify who got in touch | Pre-contractual steps (item V) |
| Phone / WhatsApp | Contact form | Reply to the enquiry | Pre-contractual steps (item V) |
| Contact form | Reply to the enquiry | Pre-contractual steps (item V) | |
| City / area | Contact form | Assess the service area | Pre-contractual steps (item V) |
| Description of the job | Contact form | Prepare the quote | Pre-contractual steps (item V) |
| Photos sent via WhatsApp | When you send them | Assess the job and quote | Pre-contractual steps (item V) |
| Analytics cookies | Browsing, if permitted | Measure site usage | Consent (item I) |
| Marketing cookies | Browsing, if permitted | Measure campaigns | Consent (item I) |
| Photos of the room, reference screenshots and measurements | Estimate form or WhatsApp | To understand the piece and return a drawing and an estimate. They usually show the inside of the enquirer’s home | Performance of a contract or pre-contractual steps (art. 7, V) |
| The architect’s file (DWG, PDF, detailing) | Architect and designer channel | To estimate and build from the design. The file is a third party’s work and is not reused on another client | Performance of a contract (art. 7, V) |
| Address for measuring and installation | Visit scheduling | To measure on site and install. It involves entering the home at an agreed date and time | Performance of a contract (art. 7, V) |
| Photographs of the installed piece | Production and aftercare | Technical record and, only with separate written permission, portfolio use | Specific consent for portfolio use (art. 7, I) |
| Contact details arriving from a listings portal | Third-party directory, if an active listing exists | To answer the enquiry. They were collected by the portal, under its terms, and passed on | Legitimate interest (art. 7, IX), with a right to object |
This site asks for no sensitive data. What it does ask for, and what deserves attention, is something else: photographs of the inside of your home, the plan of your property, and the address where somebody will come in to measure and install. That is not sensitive data in the sense of art. 5, II, but it is more intimate than an ordinary contact form, and it is treated that way here.
3. Cookies
Essential cookies keep the site working and remember your consent choice; they cannot be switched off. Analytics and marketing cookies are off by default and are only enabled if you tick the matching option in the banner. You can revisit your choice at any time by clearing site data in your browser.
| Category | Default | Examples | Retention |
|---|---|---|---|
| Essential | Always on | Consent record (stored in your browser) | [CONFIRM] |
| Analytics | Off | [CONFIRM tool — e.g. Google Analytics 4] | [CONFIRM] |
| Marketing | Off | [CONFIRM tool — e.g. Meta Pixel] | [CONFIRM] |
4. WhatsApp
The buttons on this site open a WhatsApp conversation with a pre-filled message. From the moment you send that message, the processing of your data in that app is also governed by Meta Platforms' privacy policy, over which we have no control.
5. Sharing
We do not sell personal data. We share it only with processors necessary to deliver the service:
- Website hosting — [CONFIRM]
- Analytics tool, if permitted — [CONFIRM]
- WhatsApp / Meta Platforms, when you start the conversation
- Public authorities, where legally required
International transfers: [CONFIRM — likely, if hosting or analytics sit outside Brazil. State the countries and safeguards.]
6. How long we keep it
Contact data and enquiries: [CONFIRM period]. Consent records: [CONFIRM period]. After that, data is deleted or anonymised, unless a legal retention duty applies.
7. Your rights (LGPD art. 18)
At any time, free of charge, you may request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about your right to refuse consent and the consequences;
- withdrawal of consent.
To exercise any of these, write to [CONFIRM email]. We will reply within the statutory period. You may also petition the ANPD, Brazil's data protection authority.
8. Security
We apply technical and administrative measures to protect personal data. [CONFIRM measures — e.g. HTTPS, access control, backups]. In the event of a significant security incident we will notify you and the ANPD under art. 48.
9. Minors
This site is not directed at people under 18 and does not knowingly collect children's data. No image on this site depicts children or minors.
10. Changes
We may update this policy. The date at the top shows the last revision. Material changes will be flagged on the site.
Who the controller is: to be confirmed
A privacy policy has to name the controller, the CNPJ and a channel for art. 18 requests. None of the three was captured for Wood Art Marcenaria, and none was invented to fill this page. [CONFIRM registered name, CNPJ, address and data officer]
Over your data you can, at any time and without giving a reason: confirm the processing, access it, correct it, anonymise it, port it, delete whatever is not tied to a tax retention period, and withdraw consent (LGPD art. 18). The response time and the channel [CONFIRM].
The domain on our lead sheet is not theirs
This lead’s record listed akilar.com.br as Wood Art’s website.
That address belongs to AkiLar, a home-services listings portal based in
Jaraguá do Sul that sells advertising plans to trades and whose own terms disclaim
being a service provider. The strings “Wood Art” and “marcenaria”
do not appear on that page.
If a Wood Art listing really does exist inside the portal, that has a data-protection consequence: enquiries arriving through it were collected by the portal, under the portal’s terms, and passed on. The portal answers for that consent, and the workshop ends up processing data it did not collect. This needs writing down before it becomes a question. [CONFIRM whether the listing exists, whether it is a paid contract, and what notice period applies]
Photos of your home and your architect’s drawings
A joinery estimate starts with you sending a photo of your room, the measurement of your wall and, often, your architect’s detailing. Those three stay restricted to whoever estimates and builds, and they do not go into a messaging group, a shared cloud folder or a sales presentation.
The architect’s file is a third party’s work. It exists to estimate and build your piece; it is not reused on another client and it is not republished. [CONFIRM the retention and disposal policy for design files]
A photo of the finished piece is a separate consent
In joinery the portfolio is the credibility, which makes the temptation to photograph everything strong. Photographing the installed piece inside a client’s home requires specific written permission — separate from the purchase contract, revocable, and stating where the photograph may appear. An internal technical record is one thing; posting on Instagram is another.
Measuring and installing: somebody comes into your home
The booking holds the address, the date and time, and who is coming. If installation is subcontracted, the partner team is a processor and needs a contract with a data-protection clause. [CONFIRM whether installation is in-house or subcontracted, and who it is]
Cookies
In this proposal everything non-essential is off by default, rejecting is as easy as accepting, and nothing is pre-ticked. No analytics or advertising tool is installed in this mockup. [CONFIRM the script list when the site goes live]
Retention
Estimates that did not become an order [CONFIRM]. Contracts, drawings and invoices follow the applicable tax and civil periods [CONFIRM with the accountant]. Worth remembering that the statutory 90-day warranty (CDC art. 26, II) means keeping the record of the piece for at least that long, and that a longer contractual warranty exists only in writing (art. 50).
Estimates, warranty and timber origin
A prior written estimate is a consumer right under CDC art. 40; it itemises labour, materials and dates, and it binds for 10 days from receipt unless otherwise agreed. Nothing outside it can be charged without authorisation.
The statutory warranty is 90 days and splits into three: the piece, the installation and the hardware — the last being the manufacturer’s, with its own conditions. [CONFIRM the terms]
Timber origin. Native Brazilian timber requires legal-origin documentation — the DOF, under IBAMA, plus state controls. That is why no species is named anywhere on this site. [CONFIRM species, supplier, documentation and any FSC certification — never invent one]