Privacy policy

Who handles your data

The party responsible for processing your data is 59.160.991 YURI MAXIMO MARIN, CNPJ 59.160.991/0001-12, located at Caminho Costa da Lagoa, Ponto 15 — Lagoa da Conceição — Florianópolis/SC — CEP 88062-370.

Data protection here is handled by Derick Freitas Santana Bastos, our data protection officer. You can reach them at [email protected].

This contact is published on this page because article 41 §1 of the LGPD requires the identity and contact details of the data protection officer to be disclosed clearly and openly, preferably on the controller's own website.

What we collect

We ask for the minimum needed to issue and honor your booking. Nothing here is collected out of curiosity.

And what we do not collect: date of birth, your device location, and your browsing history on other sites.

• From whoever books: full name, CPF, email and phone. All four are required, because the booking is nominal: they identify who is responsible for it.
• From whoever comes along: only the number of people per age group. We do not ask for a companion's name or ID.
• From your account, if you create one: email and password. The password is stored as a hash, never as readable text — not even for us.
• From accepting the terms: the version you accepted, the date and time, the IP address and the browser used. It is the proof that the agreement was shown before the purchase.
• From bookings made on the site: a network summary, which is a code computed from the IP address (HMAC). It is pseudonymized — the IP cannot be read back from it —, it is used only to stop anyone from holding seats in bulk, and it is deleted within 7 days. The legal basis is legitimate interest (article 7, IX, of the LGPD).

What we use it for, and on what basis

Every use has a purpose and a legal basis. The bases are in article 7 of the LGPD.

There is no email marketing or newsletter on this site today, so that consent is not requested anywhere. If it ever exists, it will be requested separately, and saying no will still not affect your booking.

• Creating the booking, charging you and talking to you about the departure: performance of the contract (art. 7, V).
• Issuing tax documents and keeping what accounting must keep: legal obligation (art. 7, II).
• Protecting your account and preventing payment fraud: legitimate interest (art. 7, IX).
• Marketing and news by email: consent (art. 7, I).

The payment

Today the payment is not made on the site. After you send your details, the booking waits for payment, and you finish it on WhatsApp. There, we agree with you whether it will be Pix, card or cash.

Meanwhile, your seat is held until the day and time shown on the booking page. That window is one day at most, and it can be shorter when the departure is close to closing for bookings. If the payment is not confirmed by then, the seat goes back to the site.

No card data goes through the site or our system. When the money arrives, someone on the team confirms receipt in the admin panel. The system stores the payment method, the amount received, the date and time of the confirmation, the booking code and who on the team confirmed it. Receipts are not stored in the system.

The ready-made WhatsApp message carries the booking code, the tour, the date, the people, the total and your name, phone and email. Your CPF is not in it.

Who we share it with

We do not sell your data. We share it only with those who are needed for the tour to happen:

WhatsApp works differently: it is a channel you start. When you choose to talk to us there, the conversation happens on WhatsApp's platform, under its rules and its privacy policy.

If any of these providers is outside Brazil, the international transfer follows article 33 of the LGPD.

• The email delivery service, to deliver the booking confirmation and the receipt.
• The hosting and the database where the system runs.
• The error monitoring service, so we know when something fails in the system and can fix it. It may receive technical data about the error.

How long we keep it

Booking data stays for as long as the booking is active and, after that, for the period that tax and accounting law requires a sales document to be kept.

The record of your acceptance and the cancellation quote that applied on the day of purchase are kept as proof of what was agreed. This is retention to comply with a legal obligation, which article 16, I, of the LGPD allows.

If you start a booking and the time limit runs out before you send your details, the name, email and phone you typed are deleted 7 days after that time limit ends.

Once the period is over, the data is deleted or anonymized.

Your rights

Article 18 of the LGPD gives you a list of rights over your data. All of them apply here:

To exercise any of them, write to [email protected]. We answer within the period the law sets.

If the answer does not resolve it, you may petition the ANPD, the Brazilian data protection authority.

• Confirm that your data is being processed.
• Access the data we hold about you.
• Correct incomplete, outdated or wrong data.
• Request anonymization, blocking or deletion of data that is unnecessary, excessive or processed outside the law.
• Take your data to another service provider, where portability is possible.
• Delete the data we process based on your consent.
• Know who we have shared your data with.
• Know what happens if you do not consent, and what stops being possible when you say no.
• Withdraw your consent at any time.

Deleting your data

To request deletion, write to [email protected] saying which account or which booking — without that we cannot find you.

Some data we cannot delete on request, and saying so is better than promising what cannot be kept. The following stays:

The rest is deleted or anonymized. When the retention period of what stayed also ends, it goes as well.

• What tax and accounting law requires us to keep about a sale.
• The record that you accepted the terms, in the version you accepted. It is the proof of what was agreed, and it protects both sides.
• The payment and refund history, for as long as it can still be disputed.

How we protect it

The measures in place today:

None of these measures is a promise that nothing can go wrong — no honest party makes that promise. If a relevant security incident happens, we notify you and the ANPD, as the law requires.

• The entire site is served over HTTPS.
• Your account password is stored as a hash, not as text: anyone with access to the database would not read your password.
• The link that opens your booking without signing in is a secret address. The system stores only its hash, and the link has an expiration date.
• The browser runs the site under a content security policy, which limits where scripts and images can come from.

Cookies

This site uses session cookies, marked HttpOnly. They keep you signed in while you browse and protect the forms against misuse. Without them, signing in and completing a booking would not work.

There is one more, and only if you arrived through a referral link from a Viva Nature partner (an address with /v/). It keeps, for 7 days, a random identifier, without your name, email or phone number, that links your visit to the partner who referred you, so the sale counts for them. It is also HttpOnly. The visit record is kept for up to 13 months; after that it is deleted or, if it turned into a sale, kept only as proof of the commission, without the identifier. The legal basis is the legitimate interest of Viva Nature and its partners in knowing which referral led to each sale (LGPD, art. 7, IX).

There is no audience measurement tool, no social network pixel and no cross-site tracking. We do not know where you were before you got here.

That is why you do not see a cookie banner on this page: the session cookies are strictly necessary, and the referral one uses only a random identifier, without your name, email or phone number, and does not follow you across other sites. The day any audience measurement comes in, the banner comes with it, and before it.

Children and teenagers

Whoever makes the booking is the responsible adult. It is their name, CPF and contact details that are recorded.

We do not collect personal data about children. For whoever comes along, only the number of people per age group is recorded: there is no companion name, ID or date of birth anywhere in the system.

If processing children's data ever becomes necessary, it would follow article 14 of the LGPD: always in their best interest and, for children, with specific and prominent consent from at least one parent or legal guardian.

Changes to this policy

When this policy changes, it becomes a new version, with its own effective date. The current version and the date it took effect appear at the top of this page.

A change that materially alters what we do with your data is announced before it takes effect, through the same channels we already use to talk about your booking.

One thing this policy deliberately does not repeat: the cancellation and refund rule. It applies per tour and lives in one place only. A rule written in two places ends up diverging, and diverging about money is what this site exists to avoid.