Privacy Policy — Balneário Caratininga

1. Introduction

Caratininga Restaurante LTDA, operating as Balneário Caratininga ("we", "our", or "us"), registered under CNPJ 48.282.853/0001-90, with its principal place of business at Av. Enfermeiro José Evangelista de Vasconcelos, 2500, Nené Plácido, Tianguá - CE, 62327-485, is committed to protecting your privacy and personal data.

This Privacy Policy describes how we collect, use, store, and share your personal information in compliance with Brazil's General Data Protection Law (Lei Geral de Proteção de Dados — LGPD, Law No. 13.709/2018) and other applicable regulations.

2. Data We Collect

Identification data: full name, CPF/CNPJ
Contact data: email address, phone number
Visitor data: number of visitors per group, ages of minors in the group (for appropriate admission and safety), and vehicle license plate for parking
Event booking data: event type, date, expected number of guests, dietary requirements, and special arrangements
Minor data: name, age, and responsible adult identification for children accessing water park facilities (safety and liability purposes)
Health declaration data: self-declared medical conditions relevant to water park safety (epilepsy, heart conditions, etc.) as noted on admission waivers
Restaurant data: table reservations, group size, and dietary restrictions or allergies
Payment data: billing information processed through secure payment systems
Fiscal data: information required for NFC-e and tax compliance
Navigation data: IP address, browser type, cookies, access logs

3. How We Use Your Data

Processing park admissions, day passes, and group reservations
Managing restaurant reservations and accommodating dietary needs
Ensuring water park safety by identifying minors and their responsible adults
Organizing events, birthday parties, and group celebrations
Contacting emergency services or responsible adults in case of incident
Processing payments and issuing receipts (NFC-e)
Sending event promotions, seasonal offers, and park updates (with consent)
Complying with ANVISA food safety regulations, Corpo de Bombeiros safety standards, and consumer protection obligations

4. Legal Basis for Processing

Consent provided by the data subject
Performance of a contract or preliminary procedures related to a contract
Protection of the physical safety of the data subject or third parties (water park safety)
Compliance with legal or regulatory obligations
Legitimate interests of the controller, provided fundamental rights are preserved

Health declaration data collected on admission waivers is used exclusively for water park safety purposes. This information helps our lifeguard and safety teams identify visitors who may require additional attention near water facilities. Health declarations are classified as sensitive data under the LGPD and are collected with explicit consent. This data is accessible only to park safety personnel and is never used for marketing or shared with unauthorized parties.

5. Data Sharing

Emergency medical services (SAMU) in case of water park or dining incidents
ANVISA for food safety compliance when required
Corpo de Bombeiros for water park safety inspections and incident reporting
Food suppliers for specific dietary accommodation (allergen information only, no personal data)
Payment processors for secure transaction handling
Tax authorities as required by fiscal regulations
Government authorities when required by law

We do not sell, rent, or trade your personal data to third parties for marketing purposes. Photographs or videos taken at the park by our staff for promotional purposes require your explicit consent before publication. All data sharing is conducted in compliance with the LGPD.

6. Data Retention

Personal data will be retained only for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. Admission records and safety waivers are retained for the applicable liability period under consumer protection law. Event booking records are retained for the duration of the booking plus the applicable warranty period. Restaurant reservation data is retained only for the reservation period and then deleted. Health declaration data is retained only for the duration of the park visit and then securely destroyed. Transaction and fiscal data are retained as required by tax regulations. Upon expiration, data will be securely deleted or anonymized.

7. Your Rights

Under the LGPD, you have the following rights:

Confirmation of the existence of data processing
Access to your personal data
Correction of incomplete, inaccurate, or outdated data
Anonymization, blocking, or deletion of unnecessary or excessive data
Portability of data to another service provider
Deletion of data processed with your consent
Information about entities with which your data has been shared
Information about the possibility of denying consent and its consequences
Revocation of consent

To exercise any of these rights, please contact us using the information in Section 10.

8. Cookies

Our website may use cookies and similar technologies to enhance your browsing experience. You may configure your browser to refuse cookies; however, some features may not function properly without them.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Health declaration data and minor identification records receive enhanced access restrictions and are accessible only to safety personnel. Despite our efforts, no method of electronic transmission or storage is completely secure.

10. Contact Information

Balneário Caratininga
Caratininga Restaurante LTDA
CNPJ: 48.282.853/0001-90
Av. Enf. José E. de Vasconcelos, 2500
Nené Plácido, Tianguá - CE, 62327-485
Brazil

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Any changes will be posted on this page with a revised "Last updated" date.