Privacy Policy
This policy explains in plain language which personal data the Bora Bora Carneiros website processes, why, who we share it with and how you can exercise your rights, in line with Brazil's General Data Protection Law (LGPD, Law no. 13,709/2018). If you are in the European Union, the GDPR rights are equivalent and also respected.
1. What data we process
The site collects as little as possible. We ask for no sign-up. The data you send us comes from the contact form, WhatsApp or email. Analytics and advertising cookies are only enabled if you accept them in the cookie notice.
- Data you choose to send us: through the contact form, WhatsApp or email, we receive your name, email, phone number (if you provide it) and the content of your message.
- Technical access data: like any website, the server hosting this page records your IP address, the date and time of the visit and your browser type, for security and operation.
- Browsing data, only if you accept: Google Analytics (visit analysis) and the Meta Pixel (ad measurement) collect data such as pages visited, clicks, device type, where the visit came from (for example, an ad) and cookie identifiers.
- Storage in your browser: we keep your cookie choice and a temporary marker (no personal data) so the opening animation does not repeat during your visit.
2. Why we use it and on what legal basis
- Answering your questions and requests about the beach club, tours, groups and events: steps prior to a contract and legitimate interest (LGPD, art. 7, V and IX).
- Keeping the site secure and working: legitimate interest (art. 7, IX).
- Measuring visits and ad effectiveness (Google Analytics and Meta Pixel): only with your consent (art. 7, I). You can refuse or change your mind at any time in "Cookie preferences", in the footer, without losing any site feature.
3. Who we share it with
We do not sell your data. It may be processed by:
- WhatsApp (Meta), when you start a conversation. Their privacy policy applies.
- The site's hosting provider, which stores technical access logs.
- The form delivery service (Web3Forms), which delivers the contact form message to Bora Bora by email.
- Social networks (Instagram, Facebook, YouTube, TikTok) and Google Maps, only if you click their links. From the click on, each service's policy applies.
- Google (Google Analytics) and Meta (Pixel), only if you accept analytics and advertising cookies.
- YouTube (Google), only if you click to watch a video.
- Authorities, when legally required.
4. Third-party content and cookies
The site's fonts are hosted by us, so your browser does not contact Google to load them. The site's videos come from YouTube and are only loaded when you click to watch (enhanced privacy mode). From then on, YouTube and Google's policies apply.
We only use analytics and advertising cookies if you accept them in the cookie notice. Until then, none of these tools is loaded. These are the cookies that may be used:
- _ga and _ga_* (Google Analytics, analytics): tell visitors and sessions apart. Last up to 2 years.
- _fbp (Meta, advertising): identifies the browser to measure ads. Lasts up to 90 days.
- _fbc (Meta, advertising): stores a click on a Facebook or Instagram ad. Lasts up to 90 days.
- bb-consent (ours, necessary): stores your cookie choice in this browser.
5. How long we keep it
Support conversations are kept for as long as needed to answer you and meet legal obligations. Technical access logs follow the hosting provider's retention period. Google Analytics data follows the period set in the tool (14 months at most). After that, data is deleted or anonymized.
6. Your rights
You can ask, at any time and free of charge (LGPD, art. 18):
- confirmation that we process your data, and access to it;
- correction of incomplete or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
- portability, and information about who we share it with;
- withdrawal of consent, when consent is the basis for processing.
7. How to contact us
To exercise your rights or ask privacy questions, write to borabora@bbcarneiros.com.br. If you are not satisfied, you may also complain to Brazil's National Data Protection Authority (ANPD) or to your local data protection authority.
8. Children
The site is not aimed at minors and does not collect children's data. The Bora Borinha kids' area operates on site, with parents or guardians present.
9. International transfers
WhatsApp, Google, Meta, the form delivery service and our hosting provider may process data outside Brazil.
10. Changes to this policy
We may update this text to reflect changes to the site or the law. The date at the top shows the latest revision.