Skip to content
Turismo (demonstração)

Privacy policy

Sample policy for demonstration purposes. The final text is approved by the Municipality (Terms of Reference 18.8), with support from its legal advisers and data protection officer.

1. Who we are

This tourism portal is run by the Municipal Tourism Department (the data controller). This policy explains what personal data we process, why, for how long and what your rights are under the Brazilian General Data Protection Law (Law 13,709/2018, LGPD).

2. What data we process

  • Browsing without an account: no login is needed. We count visits per page and per day anonymously, without cookies and without storing your IP address.
  • Search: we store search terms, without identifying who searched, to improve our content.
  • Submit your event: the name, email and phone number of the person submitting, the event details and the date this policy was accepted. To prevent abuse, we keep only an irreversible code (hash) of the IP address for a limited time.
  • Analytics cookies: used only if you allow them in the cookie notice.

3. Why we use it and on what legal basis

  • Publishing public-interest tourist information: implementation of public policies (LGPD art. 7 III and art. 23).
  • Reviewing and publishing events submitted by the public and contacting the organiser: implementation of public policies and the organiser's consent.
  • Usage statistics with cookies: consent (art. 7 I), which you can withdraw at any time.
  • Portal security and fraud prevention: legitimate interest and legal obligation (Brazilian Internet Civil Framework, Law 12,965/2014).

4. Who we share it with

We do not sell or transfer personal data. Data may be processed by companies hired to host and maintain the portal, acting on the Municipality's behalf under the same rules. Details of approved events (event name, venue, dates and the organiser contact provided for publication) are public on the portal.

5. How long we keep it

  • Event submitter data: while the event is on the portal and for up to 2 years afterwards, for accountability.
  • Admin access logs: at least 6 months, as required by the Internet Civil Framework.
  • Anonymous statistics: indefinitely, as they identify no one.

6. Cookies

We use necessary cookies (to remember your language, accessibility settings and cookie choice) and, only with your permission, analytics cookies. You can change your choice at any time in the footer or delete cookies in your browser.

7. Your rights

You may request confirmation of processing, access, correction, anonymisation, portability, deletion of data processed with consent, information about sharing and withdrawal of consent (LGPD art. 18). You may also complain to the National Data Protection Authority (ANPD).

8. Security

We use secure connections (HTTPS), role-based access control, logging of every operation and backups. No system is completely immune to incidents; if an incident poses a relevant risk, we will notify the data subjects and the ANPD.

9. Data protection officer

Contact our data protection officer at the email address shown on this page.

10. Changes

This policy may be updated. The version in force is always the one published on this page. Last updated: 30 October 2026.