We look after your data with the same rigour we bring to your silence.

01Who processes your data

The controller of the personal data processed on this site is [A PREENCHER: razão social], the Brazilian company that answers for the GOA Hospitality Group brand.

• Registered name: [A PREENCHER: razão social]
• Company register (CNPJ): [A PREENCHER: CNPJ]
• Registered office: [A PREENCHER: endereço completo da sede]
• Privacy channel: [A PREENCHER: e-mail do Encarregado (DPO)]

Each hotel in the group may be operated by its own company. When the processing arises from your stay rather than from your visit to this site, the controller is the property that receives you, and its policy applies alongside this one.

02Data we process

We collect the minimum required and nothing beyond it. There are two paths: what you hand us deliberately, and what the server records so that the site can run safely.

Data you give us

• Contact form: name, email, telephone (optional), subject and the content of your message.
• Blog newsletter: your email address and the record of consent — date, time and origin.
• Pre check-in, where the property offers it through this site: identification details, dates of stay, expected time of arrival and any preferences you wish to send ahead.
• Unprompted messages by email, telephone or message: whatever you choose to tell us.

Data recorded automatically

• Access logs: IP address, date and time of the request, page requested, response code and browser identification.
• Your cookie consent preference, kept in your browser and repeated in a first-party cookie so that the server knows it.
• A session identifier, created only when you submit a form, to protect that submission against fraud.
• The browsing language, inferred from the page address — never from your device.

We do not ask for sensitive personal data in open fields on this site. If, at pre check-in, you volunteer a dietary restriction or an accessibility need, we process it solely to make your welcome possible, on the basis of your specific consent and for the duration of the stay.

03Why we process it, and on what legal basis

The LGPD requires every act of processing to have a declared purpose and a legal basis under Article 7. These are ours, one by one.

• Answering the contact form — preliminary steps towards a contract, at the request of the data subject (Art. 7, V), when the subject is a stay; legitimate interest (Art. 7, IX) for institutional matters.
• Sending the Blog newsletter — consent (Art. 7, I), freely given, informed and revocable at any time.
• Processing pre check-in and preparing your arrival — performance of a contract (Art. 7, V) and, for the preferences you volunteer, consent (Art. 7, I).
• Keeping access logs — compliance with a legal obligation (Art. 7, II), under Article 15 of the Brazilian Internet Civil Framework.
• Protecting the site, preventing fraud and containing form abuse — legitimate interest (Art. 7, IX).
• Measuring audience with analytics tools, should we ever adopt them — consent (Art. 7, I), asked for in the banner before any collection.

We take no automated decisions that affect your interests, we build no behavioural profiles, and we sell personal data to no one, under any circumstance.

04Who we share it with

We share data when sharing is necessary to deliver what you asked for, or when the law compels us. Every processor acting on our behalf does so under contract and under our instructions.

• The property of the group involved in your request or in your stay.
• Hosting and infrastructure providers that keep this site online.
• Providers of transactional email and newsletter delivery.
• Booking engines and hotel management systems, when you begin a reservation.
• Public authorities, upon a lawful request or a court order that grounds it.

There is no sharing with advertisers, data brokers or behavioural advertising networks.

05International transfers

Some of our infrastructure and email providers operate servers outside Brazil. Where this entails an international transfer of your data, it rests on the grounds of Article 33 of the LGPD — as a rule, specific contractual clauses that secure, at the destination, a level of protection compatible with the Brazilian one.

For data subjects in the European Economic Area or the United Kingdom, the same reasoning applies under Chapter V of the GDPR, with the European Commission standard contractual clauses where the destination country has no adequacy decision.

06How long we keep it

No data is kept indefinitely as a precaution. Every category has a period, and every period has a reason.

• Contact form messages: [A PREENCHER: prazo de retenção dos registros de contato], counted from the close of the enquiry.
• Newsletter: for as long as consent remains active. On unsubscribe the address leaves the sending list and we keep only the record of the withdrawal, as evidence of compliance.
• Pre check-in: for the period of the stay and, thereafter, for the term imposed on the property by hotel and tax legislation.
• Site access logs: six months, under Article 15 of the Brazilian Internet Civil Framework, extendable only by court order.

Once the period expires, data is deleted or irreversibly anonymised — unless retention is required by a legal obligation, by the regular exercise of rights, or by another ground of Article 16 of the LGPD.

07How we protect it

Security here is not a marketing promise. It is a set of verifiable measures.

• Traffic encrypted over HTTPS across the whole site.
• Session cookie marked HttpOnly and SameSite, and Secure over an encrypted connection.
• Forms protected against forged submission by a session token, against robots and against bulk sending.
• Access to data restricted to those who need it to do their work, under a duty of confidentiality.

No system is immune. Should a security incident occur with relevant risk to your rights, we will notify you and the Brazilian data protection authority within a reasonable term, as set out in Article 48 of the LGPD.

08Your rights

Article 18 of the LGPD grants you rights that do not depend on our goodwill. At any moment, you may demand:

• Confirmation that processing of your data exists.
• Access to the data we hold about you.
• Correction of incomplete, inaccurate or outdated data.
• Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed outside the law.
• Portability of your data to another provider, upon express request.
• Deletion of data processed on the basis of your consent.
• Information about the parties with whom we have shared your data.
• Information about the option not to consent and about the consequences of refusal.
• Withdrawal of consent, at any time, through a free and straightforward procedure.

To exercise any of them, write to [A PREENCHER: e-mail do Encarregado (DPO)]. We reply within 15 days, as required by Article 19 of the LGPD. We may ask for further information only to confirm your identity — never to obstruct the request.

If our answer does not satisfy you, you may petition the Brazilian National Data Protection Authority (ANPD). Data subjects in the European Economic Area may complain to the supervisory authority of their country of residence.

09Data protection officer

The LGPD requires a named channel between the controller, data subjects and the authority. Ours is this one:

• Data protection officer (DPO): [A PREENCHER: nome do Encarregado (DPO)]
• Email: [A PREENCHER: e-mail do Encarregado (DPO)]

Requests sent through other channels are forwarded to the officer, but the reply period only starts once they reach them. Please use the address above.

10Visitors from the European Economic Area and the United Kingdom

This site is published in three languages and receives European visitors. Where the GDPR applies to the processing, you hold, in addition to the rights above:

• The right to object to processing grounded on legitimate interest and the right to restriction of processing (Articles 18 and 21 of the GDPR).
• The right to receive your data in a structured, commonly used format (Article 20 of the GDPR).
• The right to lodge a complaint with the supervisory authority of your country, without prejudice to any other remedy.

The GDPR legal bases correspond to those declared above: consent (Art. 6.1.a), performance of a contract (Art. 6.1.b), legal obligation (Art. 6.1.c) and legitimate interest (Art. 6.1.f).

11Changes to this policy

This policy changes when our processing changes — never in silence. The update date at the top is the reference, and we keep earlier versions available to whoever asks for them.

If a change narrows your rights or widens the purpose of processing grounded on consent, we will ask for your consent again before applying it.