Privacy Policy
Last updated: [PUBLICATION DATE].
Who handles your data. The controller is SMART HOTEIS RESERVA LTDA, registered in Brazil under company number (CNPJ) 68.105.585/0001-48, with offices at Rua José Lins do Rego, 9, Ilhabela, São Paulo, CEP 11640-434, Brazil.
What we collect. Only what you type into the contact form: your name, the name of your hotel or inn, your WhatsApp number, the number of suites and the message you write. We do not ask for your email address and this form sets no cookies, not even when site measurement is switched on, which is covered in the Measurement and cookies section below. We also record, inside the email that reaches us, how many milliseconds the form took to fill in. That number does not block and does not reject any submission: it is a technical record, and we use it to assess automated abuse.
About your IP address. Our code does not read, use or store your IP address. It does not go into the email we receive, and this site has no database. As happens with any request on the internet, your IP address is processed by the infrastructure that delivers the site, Vercel, because without it the page could not reach you. On that infrastructure we have configured a rule that counts how many form submissions come from the same address within one minute and refuses those above the limit, to curb automated submissions. That counting is done by the infrastructure, on the legitimate interest basis of article 7, item IX, of Law 13.709/2018. We do not store your address, we build no profile from it and we make no commercial use of it.
Measurement and cookies. This site can run in two states, and you can tell which one you are in without taking our word for it: if no cookie notice has appeared to you, measurement is switched off. In that state the site loads no measurement tool, sets no cookies at all and makes no request to any third-party server. When measurement is switched on, a notice appears and you choose. Before you accept, no measurement or advertising cookie is created and none of your data is used for advertising: the site's consent signals all start denied. Loading the measurement tool makes your browser fetch a file from Google's servers, and that alone gives them the technical data of any internet connection, such as your IP address and your browser. The contact form sets no cookies in either state.
Why we use it. To get back to you, walk you through the platform and send pricing, which is what you asked for. Nothing else. The data from the form is not used for advertising and is not sold.
On what legal basis we handle the form. Preliminary steps at the data subject's request prior to entering into a contract, under article 7, item V, of Brazilian Law 13.709/2018 (LGPD). That is why we do not ask for consent for the form: the processing exists because you requested contact, and refusing it would mean refusing the very contact you asked for.
On what legal basis we run measurement and advertising. Here the basis is a different one, and the difference matters: it is your consent, under article 7, item I, of the same law. Measurement and advertising are not necessary to answer your contact request, so they do not rest on the form basis and depend on you saying yes. Accepting or refusing cookies changes nothing in how we handle your form request, and refusing blocks no part of this site.
Consent: how it is recorded, and how you withdraw it. Your consent covers only the purposes the notice describes, because a blanket authorisation is void under article 8, paragraph 4, of Law 13.709/2018. When you answer the notice, your choice is recorded in your own browser, with the date and the version of the notice that was live, and that record is what stops the notice from returning on every visit. We keep no consent database and we do not tie that choice to your name. On our side we keep the text of every version of the notice and the date it went live, so that it is always possible to know what was shown at any given moment. You may change your mind at any time, free of charge and without giving reasons, at [CONSENT CONTROL TO BE NAMED BY THE ELITE-ANALYTICS-ENGINEER]. Withdrawal applies from then on and does not undo what was measured before it.
Who else has access. We do not share the form data with third parties for their own purposes. Besides us, the data is handled only by service providers acting on our behalf and under our instructions, as processors: Vercel, which hosts the site and runs the program that receives the form; the transactional email service that delivers the message, currently Resend, operated by Plus Five Five, Inc.; and the email hosting services that store the mailboxes where the message is received and kept. If you have accepted measurement cookies, Google and Meta join that list, receiving browsing data for measurement and advertising. While measurement is switched off, or while you have not accepted, no data of yours reaches those two companies through measurement cookies.
International transfer. Emails are dispatched from the São Paulo region, but the account data held by the sending provider, including message metadata, logs and API records, is stored in the United States. There is therefore an international transfer. It is permitted under article 33, item IX, of Brazilian Law 13.709/2018, read together with article 7, item V, because it is necessary to answer the contact you requested. Processing by the provider is additionally covered by a data processing addendum with standard contractual clauses, in force since the service was contracted. Measurement follows a different path and rests on a different basis: Google and Meta process data outside Brazil, and that transfer rests on your specific consent under article 33, item VIII, of the same law, which requires prior information about the international nature of the operation. That is why the cookie notice states, before you choose, that the data leaves the country. Item IX, which supports the transfer for the form, does not reach measurement, because it is limited to the situations in items II, V and VI of article 7.
How long we keep it. The form message is kept for 24 months from our last contact, and at the end of that period it is deleted from the mailboxes where it is held. Measurement cookies, where they exist and after you have accepted, have their own lifetime, stated in the cookie notice before you choose.
Your rights. You may request confirmation that we process your data, access to it, correction, anonymisation, portability and deletion, along with the other rights in article 18 of Law 13.709/2018. Write to contato@smarthoteis.com. We answer within 15 days. You may also complain to the Brazilian data protection authority (ANPD).
Changes to this policy. If the purpose, the retention period or the parties involved change, this page is updated before the change takes effect.