1. Who we are
This policy explains how Orixás Residence handles personal data of people who visit this website, place Market orders, contact us or stay with us, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018, the LGPD).
The data controller is Orixás Serviços de Hospedagem Ltda, CNPJ (Brazilian company number) 35.848.816/0001-54, which operates Orixás Residence at Praia do Encanto, s/n, 5ª Praia, Morro de São Paulo, Cairu/BA, Brazil, ZIP 45420-000.
2. What data we collect and why
- Market orders: the lead guest's name, WhatsApp number, house, delivery date and time, items ordered and notes. We use it to pick, prepare and deliver the order and to add the amount to the house account. Legal basis: performance of a contract and pre-contractual steps (Art. 7, V).
- Contact by WhatsApp, phone or e-mail: name, number or e-mail address and the content of the conversation. We use it to answer questions, share availability, handle bookings and assist during the stay. Legal basis: pre-contractual steps and performance of a contract (Art. 7, V) and legitimate interest (Art. 7, IX).
- Bookings: made on the Stays booking engine, a third-party website. We receive the booking data (such as name, contact details, dates, number of guests and payment method, depending on the platform) to organize your stay, bill you and meet legal obligations, including guest registration. Legal basis: performance of a contract (Art. 7, V) and legal obligation (Art. 7, II).
- Browsing data: the website server may log IP address, date, time and pages visited, for security and operation. This website does not use analytics cookies, advertising cookies or tracking pixels. Fonts are loaded from Google Fonts, so Google receives the visitor's IP address. Legal basis: legitimate interest (Art. 7, IX).
3. Sensitive data
The "Notes" field in orders is free text. If you enter health information there, such as allergies or dietary restrictions, we will use it only to prepare your order, based on your consent (Art. 11, I). You can withdraw consent at any time by asking us to delete that data. Please avoid entering data that is not needed for your order.
4. Who we share data with
We do not sell personal data. We share only what is necessary with:
- the Orixás Residence and Vila dos Orixás Boutique Hotel teams that handle your order or stay (stock, bar, front desk and concierge);
- companies that provide services to us, such as Google (e-mail, spreadsheets and automations), Supabase (database of our internal system), Meta (WhatsApp) and Stays (bookings);
- public authorities, when required by law.
5. International transfers
Some of these providers store data outside Brazil, especially in the United States. In those cases we rely on the contractual and security safeguards these providers offer, in accordance with Art. 33 of the LGPD.
6. How long we keep data
- Market orders (name, WhatsApp and items): 12 months after delivery.
- Bookings and billing: for the period required by law, generally up to 5 years.
- Contact messages that did not become a booking: 12 months.
After these periods we delete or anonymize the data, unless the law requires us to keep it longer.
7. Your rights
Under Art. 18 of the LGPD, you may ask at any time for:
- confirmation that we process your data and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
- data portability;
- information about whom we share your data with;
- withdrawal of consent and deletion of data processed on that basis;
- review of, and objection to, processing carried out without consent, where applicable.
To exercise these rights, write to diretoria@hotelviladosorixas.com. We will reply within the legal deadline: immediately, in a simplified format, or within 15 days with a complete statement. We may ask for information to confirm your identity.
8. Children and teenagers
This website is not aimed at minors. Data of children and teenagers is processed only when provided by a parent or guardian for the stay, and always in the minor's best interest (Art. 14).
9. Security
We adopt technical and organizational measures to protect data, such as an encrypted connection (HTTPS), access to the internal system through individual logins and permissions by department, and a record of actions taken on orders. No system is completely immune to incidents. If an incident could cause a relevant risk, we will notify the data subjects and the ANPD, as the law requires.
10. Third-party links and services
This website links to third-party services such as Stays, WhatsApp, YouTube, Google Maps and Instagram. When you use them, you are subject to their own privacy policies, which we do not control.
11. Changes to this policy
We may update this policy. The update date appears at the top of the page. If we start using analytics or advertising cookies, we will update this policy and ask for your consent where the law requires.
12. Contact and data protection officer
Data protection officer: diretoria@hotelviladosorixas.com.
Reservations: (75) 99803-3755 (phone and WhatsApp). Concierge, during your stay: (75) 99854-8839 (WhatsApp). E-mail: residence@hotelviladosorixas.com.
You may also file a complaint with the Brazilian data protection authority (ANPD): www.gov.br/anpd.