Privacy Policy

Last updated: September 16, 2026.

This Policy explains how MaresiasTur Receptivo & Ecoturismo LTDA (CNPJ, Brazilian company registration no. 35.417.415/0001-40), headquartered at Av. Francisco Loup, 500, Maresias, São Sebastião (SP), Brazil, as the controller of the data processed on this website, uses the personal data of people who browse the site, contact us or book an activity, in compliance with Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, Law 13,709/2018 – LGPD).

1. What data we collect

• Contact and booking data: name, email, phone/WhatsApp, chosen tour, date, time, number of people, boarding point, payment method, notes and answers to the tour's questions.
• Participant data: full name, document type and number, date of birth, city and state, used for activity insurance and boarding control.
• Health information, when you choose to provide it: conditions our team needs to know about for your safety during the activity, such as restrictions for rappelling or diving.
• Conversations with the site's Concierge: the messages you write to the virtual assistant.
• Browsing data: pages visited, device and interactions, collected by analytics and advertising cookies only if you accept them in the cookie notice.

We do not collect payment card data on this website.

2. How we use it and on what legal basis

• To register, confirm and operate your booking, including check-in at boarding: performance of a contract (art. 7, V).
• To take out activity insurance and comply with legal and regulatory requirements, such as passenger lists and tax records: performance of a contract and compliance with a legal or regulatory obligation (art. 7, II and V).
• To use health information you give us solely to ensure your safety during the activity: protection of life and physical safety (art. 11, II, "e").
• To send information about your booking, weather-related changes and customer support: performance of a contract.
• To answer your questions through the Concierge, using the site's catalog and rules: preliminary procedures related to a contract, at your request (art. 7, V).
• To send news and offers by email to existing customers, with an unsubscribe option in every message: legitimate interest (art. 7, IX).
• To measure the performance of the site and ads: consent (art. 7, I), given in the cookie notice.
• To exercise rights in judicial, administrative or arbitration proceedings: regular exercise of rights (art. 7, VI).

3. Who we share it with

• Guides, boat captains and partner operators who run the activity, only with the data needed for boarding.
• The activities' insurer, with participant data.
• Service providers that keep the site running, such as hosting, email delivery and payment link issuance.
• Google and Meta, for analytics and advertising, only if you accept cookies.
• Anthropic, the company that provides the Concierge technology, which receives the conversation messages to generate the responses.
• Public authorities, when required by law.

We do not sell personal data.

4. International transfer

Some providers, such as Anthropic, Google and Meta, may process data on servers outside Brazil. In these cases, the transfer takes place in the situations permitted by the LGPD (art. 33), with providers that adopt contractual clauses and security measures compatible with the law.

5. How long we keep it

We keep data for as long as necessary to carry out the booking, provide support and comply with legal and tax obligations and our defense in any proceedings. After that, the data is deleted or anonymized. Data used based on your consent is deleted when you revoke it, unless there is another legal basis for keeping it.

6. Your rights

You may, at any time and free of charge, request:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed in breach of the LGPD;
• portability of your data to another provider;
• deletion of data processed based on consent;
• information about who we share your data with;
• information about the possibility of not giving consent and its consequences;
• revocation of consent;
• objection to processing based on legitimate interest, such as sending offers.

To exercise your rights, write to contato@maresiastur.com.br. We may ask for information to confirm your identity. We reply within 15 days. If you are not satisfied, you may also file a complaint with Brazil's National Data Protection Authority (Autoridade Nacional de Proteção de Dados – ANPD).

7. Privacy contact (Data Protection Officer)

Questions, requests and communications about personal data can be sent to our privacy contact: contato@maresiastur.com.br.

8. Cookies

We use cookies and local storage that are essential for the site to work, such as the shopping cart and remembering your cookie choice. Analytics and advertising cookies (Google and Meta) are only activated after you accept them in the notice shown on the site. If you decline, the site keeps working normally. You can change your mind by clearing this site's cookies and data in your browser settings; the notice will appear again.

9. Children and teenagers

Data of underage participants is provided by the parent or legal guardian who makes the booking, who, by providing it, gives specific consent for its use. This data is used solely to carry out the activity safely, for insurance and for boarding control (art. 14).

10. Security

We adopt technical and administrative measures to protect data, such as encrypted connections, access to the admin panel restricted by username and password, team permission controls and backups. If a security incident occurs that may pose a relevant risk or harm, we will notify the affected data subjects and the ANPD, as required by law.

11. Changes

This Policy may be updated. The date of the last update is always shown at the top of this page, and relevant changes will be highlighted on the site.