Privacy and Cookie Policy
Last updated: 27 October 2026
HEYKO – SERVIÇOS DE HOSPEDAGEM E TURISMO LTDA., registered under CNPJ no. 08.337.944/0001-60, which operates Pousada do Ouro (“Pousada do Ouro”, “we”), respects the privacy of guests, prospective guests, website visitors and everyone else who deals with us.
This Policy explains which personal data we process on the website, in reservations, in customer service and during your stay, for what purposes and with what rights, in accordance with Law no. 13,709/2018, Brazil’s General Data Protection Law (LGPD). We apply the principles of purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination and accountability.
1. Who the controller is and how to contact us
HEYKO – Serviços de Hospedagem e Turismo Ltda. is the controller of the personal data processed for the purposes described in this Policy.
Rua Dr. Pereira, 298, Centro Histórico, Paraty – RJ, CEP 23970-000, Brazil
Data Protection Officer (DPO): Raquel Jannotti
Privacy email: lgpd@pousadaouro.com.br
2. What data we process and why
| Situation | Data | Purpose | Legal basis (LGPD) |
|---|---|---|---|
| Reservation | Name, email, phone, dates, number of guests, preferences and payment details | Receive, confirm and manage the reservation | Performance of a contract (art. 7, V) |
| Check-in and stay | Name, ID document, CPF or passport, nationality, date of birth, address, contact details, vehicle registration (if using the car park) | Guest registration in the National Guest Registration Form (FNRH) and provision of services. The data may be submitted through the pre-check-in form we send before arrival | Legal obligation (art. 7, II) and performance of a contract |
| Children and adolescents | Name, age and ID document, provided by parents or guardians | Composition of the reservation and checks required by the Brazilian Statute of Children and Adolescents | Legal obligation, in the best interest of the child (art. 14) |
| Payments and invoicing | Personal and tax details, amounts, payment method | Billing, issuing tax documents and accounting | Performance of a contract and legal obligation |
| Customer service via WhatsApp, email or phone | Name, phone, email and content of the conversation | Answer questions, requests and enquiries | Pre-contractual steps and legitimate interest (art. 7, IX) |
| Browsing the website | IP address, browser, device, pages visited and date and time of access | Operation and security of the website; access logs required by Brazil’s Internet Civil Framework (Marco Civil da Internet) | Legal obligation and legitimate interest |
| Cookie-free statistics | Pages visited, country, browser type and referring site, in aggregate form, without cookies and without identifying the visitor | Count visits and understand how the website is used | Legitimate interest (art. 7, IX) |
| Website usage statistics | Google Analytics identifiers, pages visited, source of the visit | Understand how the website is used and improve it | Consent (art. 7, I), given in the cookie notice |
| Reviews shown on the website | First name, initial of the surname and excerpt of a public review | Show guests’ experiences | Legitimate interest, with the right to object |
| Security cameras | Images of people in common areas | Safety of guests, staff and property | Legitimate interest and regular exercise of rights |
We do not process sensitive personal data, except when guests themselves share it so we can meet a specific need (for example, a dietary or mobility requirement). In that case, we use the information only for that purpose.
3. Security cameras
For the safety of guests, staff and visitors, the pousada has security cameras in common areas. There are never cameras in guest rooms, bathrooms, the spa or the saunas. The images are accessed only by authorised people and are kept only for as long as each device’s memory allows, as it records over the oldest images, unless they need to be preserved to investigate an incident or to comply with a request from the authorities.
4. Payments
For reservations made on the website, card details are entered directly in the secure environment of the online booking page and processed by the respective payment provider; Pousada do Ouro does not store full card numbers. We never ask for passwords or card security codes by email, phone or WhatsApp.
5. Who we share data with
We share data only to the extent necessary for each purpose, with:
- SiteMinder, the website’s online booking system, which processes the data entered during the reservation;
- the pousada’s hotel management system and booking channels (such as agencies and online platforms, when the reservation is made through them);
- payment institutions and providers;
- Google (Google Workspace / Google Forms), used to receive the pre-check-in form sent before arrival;
- Google (Google Analytics), only if the visitor accepts statistics cookies;
- WhatsApp, when the visitor chooses to contact us through that app;
- Cloudflare, the website’s hosting provider, which also produces cookie-free visit statistics;
- accountants and professional advisers;
- public authorities, where required by law or by order of a competent authority, including submission of the FNRH to the Ministry of Tourism.
We do not sell personal data.
6. International transfers
Some providers, such as Google, Cloudflare, SiteMinder and WhatsApp, may store or process data on servers outside Brazil, including in the United States. In such cases, the transfer follows the mechanisms set out in art. 33 of the LGPD and in the regulations of the ANPD, Brazil’s data protection authority, such as standard contractual clauses.
7. Cookies and similar technologies
Cookies are small files stored in your browser. The Pousada do Ouro website uses:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| pdo-cookies | Necessary (local storage) | Remember your choice in the cookie notice | Until you clear your browser data |
| _ga, _ga_* | Statistics (Google Analytics) | Count visits and understand how the website is used | Up to 2 years |
Statistics cookies are only activated if you click “Accept”. If you choose “Essential only”, the website works normally. You can change your choice at any time under “Cookie preferences” in the footer.
When you click “Book now”, you are taken to SiteMinder’s online booking page, which uses its own cookies, described in SiteMinder’s privacy policy. The WhatsApp button is a simple link: no data is sent to WhatsApp before you click it.
8. Guest reviews
The website shows excerpts of reviews that guests have published of their own accord on public platforms (Booking.com, Google and Tripadvisor), identified only by first name, initial of the surname and the platform of origin. If you wrote a review and would prefer it not to appear on the website, write to lgpd@pousadaouro.com.br and it will be removed.
9. How long we keep data
- Website access logs: 6 months, as required by the Marco Civil da Internet (Law no. 12,965/2014);
- Reservation, stay, tax and accounting records: for the period required by tax law and for the defence of rights, generally 5 years;
- Customer service conversations: for as long as needed for the service and the relationship with the guest;
- Security camera images: for as long as each device’s memory allows, as it records over the oldest images, unless they need to be preserved;
- Data processed on the basis of consent: until consent is withdrawn.
After these periods, data is deleted or anonymised.
10. Security
We take technical and administrative measures proportionate to the risks, such as secure connections (HTTPS), access control to systems, careful selection of providers and staff training. No digital environment is entirely risk-free; if a security incident occurs that could cause significant risk or harm, we will notify the affected data subjects and the ANPD, as required by law.
11. Your rights
You may at any time request:
- confirmation that we process your data and access to it;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
- portability, in accordance with ANPD regulations;
- deletion of data processed on the basis of consent, except where the law requires it to be kept;
- information about who we share your data with;
- information about the possibility of not giving consent and the consequences of refusing;
- withdrawal of consent;
- objection to processing based on legitimate interest.
Send your request to lgpd@pousadaouro.com.br. For your protection, we may ask for information to confirm your identity. We respond within the legal deadline; full confirmation and access are provided within 15 days. You may also file a complaint with Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd.
12. Third-party links and services
The website links to third-party services such as the online booking page, WhatsApp, Google Maps and review platforms. These services have their own privacy policies, which we recommend you read.
13. Updates
This Policy may be updated to reflect changes in the law or in how the website works. The date of the last update is shown at the top of the page. Significant changes will be highlighted on the website.
14. Contact
HEYKO – Serviços de Hospedagem e Turismo Ltda. · CNPJ 08.337.944/0001-60
Pousada do Ouro · Rua Dr. Pereira, 298, Centro Histórico, Paraty – RJ, CEP 23970-000
Data Protection Officer (DPO): Raquel Jannotti · Privacy email: lgpd@pousadaouro.com.br