Privacy policy

1. Introduction and Objectives

This Privacy Notice contains information regarding the collection, use, storage, and other processing activities related to the personal data of users of our Group’s institutional website (https://beachpark.com.br), owned by Beach Park Hotéis e Turismo, CNPJ: 11.805.397/0001-05, with the aim of demonstrating our commitment to and transparency regarding the protection of privacy and personal data, and to inform all interested parties about the types of data collected, the reasons for collection, and how users can manage or delete their personal information.

By using our services, data subjects understand that we will collect and use their personal information as described in this Notice, in compliance with data protection regulations, including, but not limited to, Federal Law No. 13,709/2018—the General Data Protection Law (LGPD)—and other applicable provisions of Brazilian law.

For the purposes of this Privacy Notice, “personal data” means any data relating to an identified or identifiable natural person, and “users” means any visitor who accesses the website and/or uses its features.

2. Scope and Coverage

This Privacy Notice applies to all data subjects who access the websitehttps://beachpark.com.br to purchase the services offered by the Beach Park Group.

3. Definitions and Abbreviations

• General Personal Data Protection Law (LGPD): Federal Law No. 13,709, published on August 14, 2018, which regulates the processing of personal data—including in digital media—by natural persons or legal entities, whether governed by public or private law, with the aim of protecting the fundamental rights to freedom and privacy and the free development of the personality of natural persons;
• Personal Data:information relating to an identified or identifiable natural person;
• Sensitive Personal Data:personal data regarding racial or ethnic origin, religious beliefs, political opinions, membership in a labor union or an organization of a religious, philosophical, or political nature, data concerning health or sex life, and genetic or biometric data, when linked to a natural person;
• Data Subject:the individual to whom the personal data being processed relates;
• Processing:any operation performed on personal data, such as those involving the collection, creation, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, disposal, evaluation, or control of information, modification, disclosure, transfer, dissemination, or extraction;
• Data Protection Officer (DPO): aperson appointed by the DataController and Data Processor to serve as a point of contact between the DataController, the Data Subjects, and the National Data Protection Agency (ANPD).

4. Personal Data Collected

The user’s personal data is collected when the user fills out the online form available athttps://beachpark.com.br, at the time of purchasing tickets for Aqua Park, Parque Arvorar, and other experiences, as well as when making reservations for accommodations at Beach Park Group resorts or for packages that include airfare and accommodations. Data may also be collected through chat conversations on the website, automatically by tracking the user’s browsing habits, and through cookies.

The personal data collected is as follows:

a) Information you provide to us:information neededto complete a purchase or to receive follow-up contact (email address, full name, CPF, phone number with area code, full address, and date of birth) and payment information (credit card and PIX details).

b) Data we collect automatically:browsing data, that is, data about how the user uses and interacts with our products, which may include the dates on which the user purchased the products and the user’s browsing activities.

5. Purposes of Personal Data Processing

The purpose of processing the collected personal data is:

1. Purchase the services offered by the Beach Park Group;
2. Create a user account to grant access to the shopping and booking sites for the services available on the website;
3. Identify the user who made the payment on e-commerce websites;
4. Updating buyer registration information;
5. Promote discounts and purchase terms to buyers and potential customers via email and text messages sent to cell phones;
6. Promote Beach Park to potential buyers by using cookies in advertising platforms such as Facebook, Instagram, and Google;
7. Answer users' questions;
8. Send communications, notifications, and content via SMS, WhatsApp, and email regarding new releases, events, and promotions at Beach Park Group locations;
9. For other purposes for which specific notices are provided at the time of collection or otherwise, as authorized or required by law.

6. Legal Basis for the Processing of Personal Data

Your data may be processed in the situations described below, in accordance with the law:

1. Compliance with a legal or regulatory obligation;
2. Consent – The purposes for which your data will be used will be specific and clearly stated in your consent form, and you may choose whether or not to consent to the processing of your data as indicated;
3. Legitimate interest in promoting the Beach Park Group’s activities or in conducting corporate audits and investigations supported by law or regulation. Sensitive personal data will not be processed under this legal basis;
4. When necessary for the performance of a contract or for preliminary procedures related to a contract to which the data subject is a party, at the request of the data subject;
5. For the regular exercise of rights in judicial, administrative, or arbitration proceedings, the latter pursuant to Law No. 9,307, of September 23, 1996 (Arbitration Law);
6. For credit protection, including in accordance with the provisions of the relevant legislation. Sensitive personal data will not be processed under this legal basis.

7. Storage Time

We store your data on our servers located in Brazil, as well as in a cloud computing environment, and we retain your information:

1. In general, the data will be retained for as long as the contractual relationship between the data subject and the resorts managed by the Beach Park Group remains in effect;
2. For the period required by law;
3. Until the processing of personal data has ended.

We will therefore process your data, for example, during the applicable limitation periods or for as long as necessary to comply with a legal or regulatory obligation. The processing of personal data will cease in the following cases:

1. When the purpose for which the personal data was collected has been achieved, and/or the collected personal data is no longer necessary or relevant to the achievement of that purpose;
2. When the data processing period ends;
3. When the Data Subject requests the deletion of their data, subject to the rights of third parties;
4. When there is a legal ruling to that effect.

Upon termination of the processing of personal data, except as provided for by applicable law or this Notice, the personal data will be deleted using secure disposal methods, and this Notice will no longer apply to the user.

8. Security of Stored Personal Data

We undertake to apply technical and administrative measures to protect personal data from unauthorized access and from situations of destruction, loss, alteration, communication or dissemination of such data.

Among the measures we have adopted, we highlight the following:

1. Only authorized individuals have access to your personal data.
2. Access to your personal data is granted only after you have signed a confidentiality agreement.
3. Your personal data is stored in a secure and reliable environment.

The personal data stored is treated confidentially, within legal limits. Personal information may be disclosed in the event of a legal obligation.

In the event of security incidents that could pose a significant risk or cause significant harm to any user, we will notify those affected and the National Data Protection Agency of the incident, in accordance with the provisions of the General Personal Data Protection Law.

9. Data Sharing

We do not sell, rent, or use users’ personal data as a bargaining chip in commercial transactions. We may share this data with other sectors and other companies within the Beach Park Group, including those that may be established in the future or result from any corporate transactions.

We may also share your personal data when we believe, in good faith, that we are required to: (i) comply with any law, regulation, or court order; (ii) respond to requests for information from regulatory agencies, law enforcement, and other public authorities, including in cases related to security threats; (iii) enforce and/or protect our rights and property, including to investigate fraud and help prevent security threats or other criminal or malicious activities; (iv) comply with other circumstances provided for in applicable law.

10. Third-Party Services and Applications

This Privacy Notice does not apply to third-party websites that may be accessed through links provided for your convenience and information. When you access these links, you will be directed to sites outside of ours, where your information may be processed by third parties. We do not control, endorse, or make any representations regarding these websites or their privacy practices, which may differ from ours. We recommend that you review the Privacy Notice of each website with which you interact before authorizing the collection or use of your personal data.

11. Data on Children and Adolescents

We do not intentionally collect information from children and adolescents, as defined by Brazilian law. Users under the age of 18 (eighteen) should not post or provide personal information to our website without the consent of their parents or legal guardians.

We recommend that users monitor their children's online activities and consider using available parental control tools, which help provide a safe online environment for children and teenagers.

12. International Transfer of Personal Data

The company may transfer some of your personal data to service providers located abroad, including cloud service providers. Such transfers will only occur when the destination country offers a level of personal data protection adequate to that provided for in the LGPD or when contractual and technical safeguards are in place to ensure the protection of the data. Whenever such a transfer is made, the Beach Park Group will take appropriate measures to ensure that personal data is processed securely and in compliance with applicable law, using, when necessary, specific contractual clauses and other mechanisms recognized by the National Data Protection Agency (ANPD).

13. Rights of the Data Subject

Data subjects have certain rights regarding their personal data and may exercise these rights by contacting us via email atdpo@beachpark.com.br. These rights are as follows:

• Confirmation of the processing of personal data;
• Access to personal data, in accordance with applicable law;
• Correction of incomplete, inaccurate, or outdated data;
• Data portability;
• Deletion of data when such data is processed based on the Data Subject’s consent, or when the data is unnecessary, excessive, or processed in violation of applicable law;
• Request for information regarding data sharing. Please note that this Privacy Notice describes Beach Park’s personal data sharing practices. For more information on how we share your data, please contact us;
• Withdrawal of consent, where applicable.

For security reasons, we can only process your request if we are certain of your identity. Therefore, we may ask for additional data or information to confirm the identity and authenticity of the Account Holder.

Our Data Protection Officer is:

Identification: Andressa Farias;
Contact:dpo@beachpark.com.br.

14. Changes to the Privacy Notice

We reserve the right to modify this Privacy Notice. Therefore, we recommend that users review it frequently.

The changes and clarifications will take effect immediately upon publication. The most up-to-date version of this Notice will be available on the website, and users should check it frequently to review the new terms.

By using any service or providing personal information after any changes have been made, the user indicates their agreement to the new terms.