1. Data controller
Orla Nativa, based in Armação dos Búzios – RJ, Brazil.
Data subject contact (data protection officer): financeiro@orlanativa.com.
2. What data we collect
We collect only what is needed:
- Identification: full name and CPF number (Brazilian citizens) or passport number (foreign visitors).
- Contact: email and phone/WhatsApp, including when you request a quote or send a message through the website.
- Booking: tour, date, number of adults and children, town and name of your hotel or guesthouse, and any notes you write.
- Cart: the items you chose and, if you type it at checkout, your email, even if you do not finish the booking.
- Visit source: the name of the ad campaign you came from, when the link carries it.
- Payment: payment method, status and, for cards, only the brand and last four digits. The full card number is sent straight to Pagar.me and never passes through our servers.
- Browsing: IP address, device type and pages visited, logged by our providers for security and to keep the website running; and, only with your consent, browsing data for the Meta Pixel and the Google Ads tag.
Please avoid writing health information in the notes unless it is needed for your safety on the tour (for example, diving restrictions). If you do, we will use it only for that purpose.
3. Why we use it and on what legal basis
- To make and manage your booking, issue the voucher with the time, send the meeting point and pass the necessary details to the tour operator — performance of a contract (LGPD art. 7, V).
- To process payments and refunds and prevent fraud — performance of a contract and legitimate interest (art. 7, V and IX).
- To keep tax, accounting and consumer records — legal obligation and exercise of rights (art. 7, II and VI).
- To assist you on WhatsApp and by email — performance of a contract and legitimate interest.
- To keep your cart and remind you of a booking you did not finish — legitimate interest (art. 7, IX). You can ask not to receive this reminder.
- To know which campaign each booking came from, so we can measure our ads — legitimate interest (art. 7, IX).
- To measure and improve our ads on Facebook, Instagram and Google (Meta Pixel, Conversions API and Google Ads tag), including telling these platforms when a booking is paid, with the amount, the ad click code and, for Meta, your email and phone number scrambled (hashed) — consent (art. 7, I), which you can refuse or withdraw at any time.
6. How long we keep it
Booking data is kept for 5 (five) years after the tour, in line with tax obligations and consumer rights. Data used on the basis of consent is kept until you withdraw it. After that, the data is deleted or anonymised.
7. Your rights
Under the LGPD (art. 18), you may request at any time:
- confirmation that we process your data and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of unnecessary data or data processed unlawfully;
- data portability;
- information about who we share your data with;
- deletion of data processed on the basis of consent and withdrawal of consent.
To exercise your rights, write to financeiro@orlanativa.com. We will reply within 15 (fifteen) days. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).
8. Security
The website uses an encrypted connection (HTTPS). Bookings are kept in private storage, accessible only through a password-protected admin area, and card details are tokenised in your browser and processed only by Pagar.me.
9. Children and teenagers
Data about children and teenagers is provided by the adult responsible for the booking, only as far as needed for the tour (for example, the number of children), in their best interest (LGPD art. 14).
10. Changes to this policy
We may update this policy to reflect changes to the website or the law. The date of the last update is shown at the top of the page.