Privacy Policy

🇺🇸 PRIVACY AND PERSONAL DATA PROTECTION POLICY Éden do Cerrado Spa Terapêutico Ltda. values the privacy and protection of the personal data of its customers, guests, visitors, and users. This Privacy Policy is intended to clearly and transparently explain how Éden do Cerrado collects, uses, stores, and, when applicable, shares personal data, in accordance with Brazilian Law No. 13,709/2018 — the Brazilian General Data Protection Law (LGPD) and other applicable laws and regulations. 1. Personal Data We Process When browsing the website, making reservations, purchasing services, or contacting Éden do Cerrado, personal data may be processed, including name, CPF or other identification document, telephone number, WhatsApp number, email address, information related to reservations and the purchase of services, data required for payments and the issuance of tax documents, as well as technical information related to the use of the website, such as IP address, device information, and access logs, where applicable. Éden do Cerrado seeks to collect and use only the data necessary to fulfill the purposes described in this Policy or otherwise permitted by applicable law. 2. Purposes of Processing Personal data may be used to make and manage reservations, provide contracted services, confirm payments, communicate with customers and guests, provide customer support, issue tax documents, comply with legal and regulatory obligations, maintain operational security, prevent fraud, and regularly exercise rights in administrative, judicial, or extrajudicial proceedings. Where applicable, data may also be used to send institutional communications and information about Éden do Cerrado’s services, experiences, and news, in accordance with the applicable legal bases and the rights provided by law. 3. Payments Payment-related information may be processed by Éden do Cerrado and by specialized companies responsible for processing transactions. When payment is made through payment platforms or payment processors, the processing of data will also be subject to the respective privacy policies and terms of use of those providers. Éden do Cerrado does not intend to store complete credit or debit card information when the transaction is processed directly by a payment platform or payment processor. 4. Data Sharing Personal data may be shared, when necessary and within the limits established by applicable law, with suppliers and service providers that assist Éden do Cerrado in carrying out its activities, including reservation platforms, payment providers, management systems, technology services, accounting services, and other providers necessary for the provision of services. Data may also be shared when required by law or regulation, pursuant to an order or determination from a competent authority, or when necessary for the regular exercise of legal rights. Éden do Cerrado does not sell or commercially trade its customers’ personal data. 5. Data Storage and Security Éden do Cerrado adopts appropriate technical and administrative measures to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, disclosure, or improper processing. Personal data will be stored for as long as necessary to fulfill the purposes for which it was collected, comply with legal and regulatory obligations, perform contracts, and preserve the rights of Éden do Cerrado and data subjects. After the processing period ends, data may be deleted or anonymized, except where applicable law permits or requires its retention. 6. Data Subject Rights Under the LGPD, data subjects may request, subject to the conditions and limitations established by applicable law: • confirmation of the existence of processing of their personal data; • access to the personal data being processed; • correction of incomplete, inaccurate, or outdated data; • anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of applicable law; • information regarding the sharing of their data; • deletion of data processed on the basis of consent, where applicable; • withdrawal of consent, when consent is the applicable legal basis; • data portability, in accordance with applicable regulations; • objection to processing, where applicable; • review of decisions made solely on the basis of automated processing, in the cases provided by law. The exercise of these rights is subject to legal circumstances that permit the retention or processing of data, including compliance with legal obligations, the regular exercise of legal rights, and other situations provided for by applicable law. 7. How to Exercise Your Rights To request information, exercise rights provided under the LGPD, or ask questions regarding the processing of personal data, data subjects may contact Éden do Cerrado Spa Terapêutico Ltda. by email at reservas@edendocerrado.com.br, through the “Contact Us” page, or through the other customer service channels available on the website. Requests will be reviewed in accordance with applicable law. 8. Cookies and Similar Technologies The Éden do Cerrado website may use cookies and similar technologies to ensure the proper functioning of the website, improve the browsing experience, understand how the website is used, and, where applicable, perform analytics and communications according to user preferences and applicable law. Where necessary, users may manage their cookie preferences through the mechanisms made available on the website. 9. Sign in with Google and Google User Data Signing in with Google is optional. If you choose to sign in with your Google account, Éden do Cerrado receives from Google, with your authorization, only the following Google user data: • your name; • your email address and confirmation that Google has verified it; • your Google account identifier. We request only the basic identification permissions (openid, email, and profile). We do not receive your Google password, and we do not access Gmail, contacts, calendar, files, or any other data in your Google account. Your profile photo is not used or stored. Use: this data is used solely to authenticate your access, create your customer account or, when you request it, link Google sign-in to the account you already have, identify you in the customer area and in your reservations, allow our team to provide support, and send communications related to your account and your reservations. We do not use data received from Google for advertising, profiling, selling data, or training artificial intelligence models. Signing in with Google does not enable marketing communications, which require separate consent. Sharing: we do not sell, rent, or trade data received from Google. It is processed only by the providers that operate the website, such as hosting and email delivery, and, when you make a reservation, by the payment provider, to the extent necessary to provide the service. Outside these cases, it is shared only when required by law or by an order from a competent authority. Protection: communication with the website is encrypted (HTTPS). Sign-in follows the OAuth 2.0/OpenID Connect standard, and tokens issued by Google are not stored after sign-in is complete. The data is kept in a private database with no public access and an encrypted connection, with encrypted backups and access restricted to authorized personnel. Retention and deletion: we keep this data for as long as your account exists. You may request deletion of your account or unlinking of Google sign-in by email at reservas@edendocerrado.com.br. We will handle your request in accordance with the LGPD, retaining only what is required by law or necessary for the regular exercise of rights, such as records of reservations, payments, and tax documents. You may also remove Éden do Cerrado’s access to your Google account at any time at https://myaccount.google.com/connections. This revokes the authorization granted; a new sign-in with Google will ask for your authorization again. Removing access does not delete data already registered; to do so, submit the request described above. Éden do Cerrado’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy 10. Updates to This Policy This Privacy Policy may be updated periodically to reflect changes in the services provided, data-processing practices, applicable laws, or guidance issued by competent authorities. The current version will always be available on the Éden do Cerrado website. Éden do Cerrado Spa Terapêutico Ltda.