Last updated: 30 September 2026
This policy explains which personal data Pousada Buriti Atins handles when you visit our website, contact us and stay with us, what we use it for and how you can exercise your rights under Brazil's General Data Protection Law (Law No. 13,709/2018, the LGPD).
Who we are and how to reach us
Pousada Buriti Atins Ltda. (Brazilian company registration CNPJ 63.165.939/0001-26), which runs Buriti Boutique and Buriti Private, located at Rua da Alegria, s/n, Atins, Barreirinhas – MA, 65590-000, Brazil, is the controller of the data described in this policy.
For any privacy matter, email contato@buritiatins.com.br with the subject “Privacy”, or message us on WhatsApp at +55 11 92062-2469.
What data we handle and why
When you browse the website
Pages visited, where the visit came from (for example Google, Instagram or an ad), device and browser type, approximate IP address and cookie identifiers. We use this to measure our audience, understand what works on the site and measure and improve our ads. Legal basis: legitimate interest (art. 7, IX), with the opt-out options described under “Cookies”.
When you check availability
On the Book page, your dates, number of guests and children's ages are sent to our booking system only to calculate availability and rates. We do not ask for your name or contact details at this step.
When you contact us
By WhatsApp, email, Instagram or phone: name, phone number, email, dates, number of guests and whatever you write to us. The form on our home page stores nothing on the website: it simply opens WhatsApp with a ready-made message for you to send. Messages sent from the website include a reference code (for example “Ref. SITE-GOOGLE-HOME-EN”), which only shows the page and the channel the visit came from and does not identify you. We use this data to reply, send quotes, make your booking and keep internal track of our enquiries and sales. Legal basis: steps prior to a contract at your request (art. 7, V), and legitimate interest for internal tracking (art. 7, IX).
When you book
Name, email, phone number, ID document, details of your companions, dates, payment method and any requests you make (for example arrival time or dietary restrictions, used only to look after you). Payment is processed by the payment platform built into our booking engine, in a secure environment; we do not have access to your full card details. Legal basis: performance of the accommodation contract (art. 7, V) and compliance with legal and tax obligations (art. 7, II).
During your stay
We fill in the guest registration form required by Brazilian tourism law (Law No. 11,771/2008), with data such as name, ID document, nationality, date of birth and contact details. Legal basis: compliance with a legal obligation (art. 7, II).
Bookings made through other platforms
If you booked through Booking.com, Expedia or another agency, we receive from that platform the data needed for your stay. The platform's own processing follows its privacy policy.
Cookies and similar technologies
- Google Analytics 4 (Google):
_gaand_ga_*cookies, for visit statistics. Measurement continues on our booking engine's domain (reservas.bitzsoftwares.com.br) so the visit counts as one. - Meta Pixel and Conversions API (Meta Platforms):
_fbpand_fbccookies. Actions on the site, such as viewing a room, searching dates, tapping WhatsApp or moving on to book, are sent to Meta from your browser and from our server, with your IP address and browser type, to measure and improve ads on Facebook and Instagram. The website does not send your name, email or phone number to Meta. - Session storage (sessionStorage): keeps the channel the visit came from and, when present, the ad click identifier. It is all deleted when you close the tab.
- Google Fonts: the site's fonts are served by Google, which receives your IP address.
- Website hosting (Netlify): technical access logs, such as IP address and date, for security and operation.
You can block or delete cookies in your browser settings, install the Google Analytics opt-out add-on and adjust your ad preferences on Meta. None of this stops you from checking rates or booking.
Who we share data with
Only with those who help us provide the service, and only what is needed:
- Bitz Softwares: our property management system and booking engine, which also connects us to online travel agencies;
- the payment platform built into the booking engine;
- Google (Analytics, Fonts and email) and Meta (WhatsApp, Instagram, Facebook and Pixel);
- Netlify, which hosts the website;
- guides, transfer and tour providers, when you ask us to arrange a service;
- public authorities, when required by law.
We do not sell your data.
International transfers
Google, Meta and Netlify may store data on servers outside Brazil, such as in the United States. These transfers follow the safeguards set out in art. 33 of the LGPD, such as those providers' contractual clauses.
How long we keep data
- Conversations and quotes that did not become a booking: up to 2 years after the last contact, so we can pick up where we left off if you come back.
- Booking and stay records: for the period required by tax and tourism law (usually 5 years).
- Google Analytics statistics: 14 months at most. Meta data: for the periods set by Meta.
After these periods, the data is deleted or anonymised.
Your rights
Under the LGPD (art. 18) you can ask us at any time for: confirmation that we process your data and access to it; correction of incomplete or outdated data; anonymisation, blocking or deletion of data that is unnecessary or processed unlawfully; portability; information about who we share it with; and to object to processing based on legitimate interest. Where processing depends on your consent, you can also withdraw it.
Just email contato@buritiatins.com.br. We may ask you to confirm your identity, and we reply within 15 days. You can also lodge a complaint with Brazil's National Data Protection Authority (ANPD).
Security
The website uses a secure connection (HTTPS), access to data is restricted to our team and we use password-protected systems with access control. If a security incident could put you at risk, we will notify you and the ANPD, as the law requires.
Children
Children's data is only processed when they are part of a booking (for example, age for the rate and the guest registration), provided by their parents or guardians and always in the child's best interest (art. 14).
Changes to this policy
We may update this policy when we change how we serve guests or the tools on the website. The date of the last update is always shown at the top of this page.