Privacy and LGPD

Privacy and Cookie Policy

Last updated: October 25, 2026

This policy explains, in plain terms, which personal data 645 Turismo handles on this website (645turismo.com.br), why, for how long, and what your rights are under Brazil’s General Data Protection Law (Law 13,709/2018, the LGPD).

1. Who is responsible

Controller: 645 TURISMO CONSULTORIA E SERVICOS LTDA, CNPJ 48.925.512/0001-95 (645 Turismo).

Data protection officer (art. 41 of the LGPD) and contact for data subject requests: contato@645turismo.com.br.

The Provider Area (sistema.645turismo.com.br), where guides and service providers register, has its own policy: sistema.645turismo.com.br/privacidade (in Portuguese).

2. What data we handle, why, and the legal basis

• Contact through the site form: name, WhatsApp/phone, email, type of service and message. We use it to answer your quote or information request. Legal basis: your consent (art. 7, I) and preliminary steps at your request (art. 7, V). The form is sent through the Web3Forms service, which delivers the message to our email.
• Contact through WhatsApp: when you click the WhatsApp buttons you leave the site and talk directly with 645; we receive your number and what you write. The conversation is also governed by WhatsApp’s policies.
• Usage statistics (Google Analytics 4): pages visited, time on site, device and browser type, approximate country/city and cookie identifiers. Only with your consent (art. 7, I), to understand which content is useful and improve the site. Google’s advertising signals are turned off.
• Language by location: if you accept, we look up your IP address on the ipapi.co service only to find your country and suggest English or Spanish. We do not store the IP; only the language choice, in your browser. Legal basis: consent (art. 7, I).
• Fonts (Google Fonts) and server logs: to display the site, your browser requests fonts from Google (which receives your IP) and the hosting server logs IP, date and pages accessed for security. Legal basis: legitimate interest (art. 7, IX) in keeping the site running and secure.
• Post-trip satisfaction survey: scores, comments and, if you wish, a way to contact you. We use it to improve tours and to reply to people who asked for a response. Legal basis: legitimate interest (art. 7, IX). The results panel is restricted to our team.
• Trips and passengers: data provided at purchase (name, ID document, date of birth, phone and notes) is used to prepare boarding lists and run the trip, and is shared only with the assigned guides and team. Legal basis: performance of a contract (art. 7, V) and legal obligations (art. 7, II).

We do not sell your data, we do not build advertising profiles and we do not make automated decisions about you.

3. Cookies and local storage

Cookies are small files stored by your browser. We also use the browser’s local storage. Without your consent, only essential items run. You choose in the notice shown on your first visit, and you can change it at any time under “Cookie preferences” in the footer of any page. Your choice lasts 12 months.

If you reject statistics, Google Analytics is not loaded and its cookies are deleted. You can also block or delete cookies in your browser settings.

4. Who we share data with, and international transfers

We share data only with those who need it to provide the service: our team, assigned guides and providers (for trips), financial institutions (payments), authorities when required by law, and technology vendors acting on our behalf:

• Locaweb (Brazil): hosting of the site and the system.
• Web3Forms (USA): delivers the contact form messages.
• Google (USA): Google Analytics (if you consent) and Google Fonts.
• ipapi.co (USA): finds the country from the IP (if you consent).

Some of these vendors are outside Brazil, which counts as an international data transfer (art. 33 of the LGPD). It takes place on the basis of your consent (art. 33, VIII) or, for the form, to carry out the service you requested, and the vendors apply their own contractual safeguards.

5. How long we keep data

• Contact messages: for as long as needed to assist you and up to 12 months after the last contact, unless it becomes a contract (then the periods below apply).
• Passenger data: deleted or anonymized 180 days after the end of the trip; sales and tax records are kept for the legal periods (generally 5 years).
• Google Analytics statistics: according to the account settings, up to 14 months.
• Satisfaction survey: while useful to improve the service, preferably in aggregate form.
• Cookie and language choices: in your browser, until they expire or you clear them.

6. Your rights (art. 18 of the LGPD)

You may, at any time: confirm whether we handle your data; access a copy; correct incomplete or outdated data; request anonymization, blocking or deletion of unnecessary data or data handled unlawfully; request portability; know who we share data with; withdraw consent (under “Cookie preferences” or by email); and object to processing based on legitimate interest.

To exercise any right, write to contato@645turismo.com.br. We reply within 15 days. If you believe your rights were not respected, you may complain to Brazil’s National Data Protection Authority (ANPD): gov.br/anpd.

7. How we protect your data

We use encrypted connections (HTTPS), login-restricted and need-to-know access, logging of access to sensitive data, limited retention and vendors that apply security measures. If an incident occurs that may cause relevant risk or harm, we will notify you and the ANPD as required by law.

8. Children and teenagers

This site is not directed at people under 18 and does not knowingly collect their data. Bookings and contacts should be made by parents or guardians. If we identify data from a child provided without a guardian’s authorization, we will delete it.

9. Changes to this policy

We may update this text to reflect changes to the site or the law. Relevant changes will be highlighted on this page, with the date of the last update at the top. If a change requires new consent, the cookie notice will be shown again.

Cookie preferences