Skip to content
Agência Victor Hugo — Viagens & Passeios

Privacy Policy

Last updated: October 29, 2026

We use your data only to make your booking happen, to comply with the law and, if you allow it, to measure our ads. We do not sell personal data. This policy follows the Brazilian General Data Protection Law (LGPD – Law 13,709/2018).

VICTOR HUGO ALVES DE VASCONCELOS FREIRES (MEI) · CNPJ 69.664.651/0001-82

1. Data controller

VICTOR HUGO ALVES DE VASCONCELOS FREIRES (MEI), CNPJ 69.664.651/0001-82, trading as Agência Victor Hugo, based in Armação dos Búzios – RJ, Brazil.

Data subject contact (data protection officer): victorhugo@orlanativa.com.br or WhatsApp +55 21 99050-2377.

2. What data we collect

We collect only what is needed:

  • Identification: full name and CPF number (Brazilian citizens) or passport number (foreign visitors).
  • Contact: email and phone/WhatsApp.
  • Booking: tour, date, number of adults and children, town and name of your hotel or guesthouse, and any notes you write.
  • Payment: payment method, status and, for cards, only the brand and last four digits. The full card number is sent straight to Pagar.me and never passes through our servers.
  • Browsing: IP address, device type and pages visited, logged by our providers for security and to keep the website running; and, only with your consent, browsing data for the Meta Pixel.

Please avoid writing health information in the notes unless it is needed for your safety on the tour (for example, diving restrictions). If you do, we will use it only for that purpose.

3. Why we use it and on what legal basis

  • To make and manage your booking, issue the voucher, arrange the time and meeting point and pass the necessary details to the tour operator — performance of a contract (LGPD art. 7, V).
  • To process payments and refunds and prevent fraud — performance of a contract and legitimate interest (art. 7, V and IX).
  • To keep tax, accounting and consumer records — legal obligation and exercise of rights (art. 7, II and VI).
  • To assist you on WhatsApp and by email — performance of a contract and legitimate interest.
  • To measure and improve our ads on Facebook and Instagram (Meta Pixel) — consent (art. 7, I), which you can refuse or withdraw at any time.

4. Who we share it with

We share data only when necessary:

  • Tour operators (boats, vehicles, guides): name, number of people, accommodation and contact, to run the tour.
  • Pagar.me (Stone): processing Pix and card payments.
  • Vercel: website hosting and secure storage of bookings.
  • Meta (WhatsApp, Facebook and Instagram): customer service on WhatsApp and, with your consent, ad measurement.
  • Public authorities, when required by law or court order.

Some of these providers may process data outside Brazil. In those cases, the international transfer follows the safeguards set out in LGPD article 33. We do not sell or rent personal data.

5. Cookies and the Meta Pixel

The website uses local storage only to remember your cookie choice. The Meta Pixel, which measures the results of our ads, is loaded only if you click “Accept” on the cookie notice.

You can change your choice at any time with the button at the end of this page.

6. How long we keep it

Booking data is kept for 5 (five) years after the tour, in line with tax obligations and consumer rights. Data used on the basis of consent is kept until you withdraw it. After that, the data is deleted or anonymised.

7. Your rights

Under the LGPD (art. 18), you may request at any time:

  • confirmation that we process your data and access to it;
  • correction of incomplete, inaccurate or outdated data;
  • anonymisation, blocking or deletion of unnecessary data or data processed unlawfully;
  • data portability;
  • information about who we share your data with;
  • deletion of data processed on the basis of consent and withdrawal of consent.

To exercise your rights, write to victorhugo@orlanativa.com.br. We will reply within 15 (fifteen) days. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

8. Security

The website uses an encrypted connection (HTTPS). Bookings are kept in private storage, accessible only through a password-protected admin area, and card details are tokenised in your browser and processed only by Pagar.me.

9. Children and teenagers

Data about children and teenagers is provided by the adult responsible for the booking, only as far as needed for the tour (for example, the number of children), in their best interest (LGPD art. 14).

10. Changes to this policy

We may update this policy to reflect changes to the website or the law. The date of the last update is shown at the top of the page.