Privacy Policy

This Privacy Policy describes how Trilhabela Turismo collects, uses, shares and protects the personal data of visitors to our website and of people who contact us to book guided ecotourism experiences in Ilhabela/SP, Brazil. Please read it carefully to understand our practices.

1. Introduction and Data Controller

Trilhabela Turismo is the controller of the personal data collected through this website and our service channels. We are committed to your privacy and act in accordance with Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and other applicable regulations.

By using our website, contacting us via WhatsApp or submitting the booking form, you acknowledge that you have read and understood this Policy.

2. Definitions

• Personal data: any information relating to an identified or identifiable natural person (e.g., name, phone number, email).
• Data subject: the natural person to whom the processed personal data relate.
• Processing: any operation carried out with personal data, such as collection, use, access, storage, sharing and deletion.
• Controller: the party that makes decisions about the processing of the data (in this case, Trilhabela Turismo).
• LGPD: Law 13.709/2018, which governs the processing of personal data in Brazil.

3. Data We Collect

a) Data you provide

When you fill in the contact form, request a booking or talk to us, we may collect: name, phone/WhatsApp number, email, number of participants, desired tour date, message or preferences, as well as the data needed to complete the booking and payment.

b) Data collected automatically

As you browse the site, we may collect navigation data such as IP address, device and browser type, pages viewed, and information gathered through cookies and analytics tools.

4. How We Collect Data

• Through the contact and booking form available on the website.
• In conversations via WhatsApp, email or phone.
• Through cookies and analytics tools while you browse.

5. Purposes and Legal Bases

We process your personal data for the following purposes, each with its legal basis under the LGPD:

• Responding to enquiries and completing bookings: performance of a contract or of preliminary procedures at the data subject's request (art. 7, V).
• Communication and customer support: performance of a contract and, where applicable, legitimate interest (art. 7, IX).
• Compliance with legal and regulatory obligations: compliance with a legal obligation (art. 7, II).
• Marketing, measurement and analytics: the data subject's consent (art. 7, I).
• Security, fraud prevention and safeguarding our rights: legitimate interest (art. 7, IX).

6. Data Sharing

We do not sell your personal data. We may share it only with providers necessary to deliver the service, such as:

• InfinitePay: payment processor, when paid services are booked.
• WhatsApp / Meta, for messaging communication.
• Google (Analytics / Tag Manager), for metrics and analysis of site usage.

We may also share data when required by law or by a competent authority. We never sell or rent personal data.

7. Cookies

We use cookies to run the website, remember preferences and measure usage. You can manage your preferences and find more details in our Cookie Policy.

8. Storage, Security and Retention

We apply reasonable technical and organizational measures to protect your data against unauthorized access, loss, alteration or improper disclosure. We retain personal data only for as long as necessary to fulfil the purposes described and any applicable legal obligations; after that period, we delete or anonymize it.

9. International Transfer

Some of our providers (such as Google and Meta) may process data on servers located outside Brazil. In such cases, we adopt appropriate safeguards so that the transfer complies with the LGPD and provides an adequate level of protection.

10. Data Subject Rights

Under art. 18 of the LGPD, you have the right to:

• confirmation that processing exists;
• access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• portability of your data to another provider;
• information about the entities with which we share your data;
• withdrawal of consent;
• objection to processing carried out without consent.

11. How to Exercise Your Rights

To exercise any of these rights, contact us via the email or WhatsApp listed at the end of this Policy. We may request additional information to confirm your identity before fulfilling the request.

12. Minors

Our services are not directed to minors without an accompanying guardian. Minors take part in the tours under the responsibility of their parents or legal guardians, who are responsible for consenting to the processing of the minor's data where necessary.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available on this website, with the date of the last update shown at the top.

14. Contact and Data Officer

For questions about this Policy, about how your data is processed, or to exercise your rights, use the channels below. The same channel handles data subject requests and any communications with Brazil's National Data Protection Authority (ANPD).