Who is responsible
The controller of your personal data is Vela Brasil (MEI, CNPJ 69.792.116/0001-07), Rio de Janeiro, RJ, Brazil. For any question about your data or to use your rights, write to [email protected]. This address is our channel for data subjects under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) and for requests under the EU General Data Protection Regulation (GDPR).
What data we process
When you visit the site
- Analytics. We use Google Analytics 4 (property G-F727S42ZR0) with enhanced measurement. It records pages viewed, scrolling, clicks on outbound links and contact buttons, searches on the site, the type of device and browser, an approximate location (country, city) and the source of the visit. Google Analytics 4 uses cookies and a random identifier; it does not store full IP addresses.
- Delivery and security. The site is served by Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes technical data such as the IP address, browser and time of the request.
- Search. The site search works inside your browser. Your search terms are not sent to us, apart from the search event that Google Analytics records.
We do not set cookies of our own other than the Google Analytics cookies. There are no forms on the site that store data.
When you write to us
When you contact us on WhatsApp, Telegram or by email, we receive what you send: your name, contact details, and the details of the trip, such as dates, number of travelers, cities, services, flights and hotel. If you tell us about mobility needs, diets or health conditions so that a service can be adapted, we use that information only for that purpose and only with your consent. Please do not send passport copies or payment details in a first message.
We keep requests and bookings in our email and in a customer database (CRM).
Why we process it and on what legal basis
| Purpose | LGPD | GDPR |
|---|---|---|
| Replying to your request and preparing a proposal | Preliminary steps to a contract at your request (art. 7, V) | Art. 6(1)(b) |
| Organizing a confirmed booking and passing the necessary details to providers | Performance of a contract (art. 7, V) | Art. 6(1)(b) |
| Health or mobility information to adapt a service | Your specific consent (art. 11, I) | Your explicit consent (art. 9(2)(a)) |
| Accounting, tax and consumer law obligations | Legal obligation (art. 7, II) | Art. 6(1)(c) |
| Handling claims and disputes | Exercise of rights (art. 7, VI) | Legitimate interest (art. 6(1)(f)) |
| Site security and delivery | Legitimate interest (art. 7, IX) | Legitimate interest (art. 6(1)(f)) |
| Visit statistics (Google Analytics) | Legitimate interest (art. 7, IX), or consent where required | Your consent (art. 6(1)(a)) |
You can withdraw consent at any time, without affecting what was done before.
Who receives your data
- Local providers (guides, drivers, transport companies, boat operators, venues, hotels) receive only what they need to deliver the service, and only after you confirm a booking. This is explained on How we work.
- Technical services: Cloudflare, Inc. (hosting and delivery), Google LLC and Google Ireland Limited (analytics), WhatsApp (Meta), Telegram and our email and CRM providers, which process data on our behalf or as independent services you choose to use.
- Authorities, when Brazilian law requires it.
We do not sell personal data and do not use it for automated decisions.
International transfers
We work from Brazil, so data you send from abroad is transferred to Brazil. Some of our technical services are based in the United States or other countries. We transfer data under the mechanisms of LGPD art. 33, such as standard contractual clauses offered by these services, or because the transfer is necessary for the contract you asked for. For visitors in the European Union, transfers to Brazil and the United States rely on the safeguards offered by these services or, for your trip, on GDPR art. 49(1)(b).
How long we keep data
- Requests that do not lead to a booking: up to 12 months after the last message.
- Bookings and related messages: up to 5 years after the trip, to meet tax and consumer law obligations in Brazil.
- Google Analytics data: according to the retention setting of our account, no more than 14 months.
Your rights
Under the LGPD you can ask us to confirm whether we process your data, give you access, correct it, anonymize, block or delete unnecessary data, provide it in a portable format, tell you with whom we shared it, and review your consent. Under the GDPR you also have the right to object and to restrict processing. Write to [email protected]; we reply within 15 days.
You can also complain to the Brazilian data protection authority (ANPD, www.gov.br/anpd) or to the data protection authority of your country in the EU.
Cookies and how to refuse analytics
You can block or delete cookies in your browser settings, or install the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). The site works without them.
Children
Our services are booked by adults. We process data about children only when a parent or guardian includes it in a request, for example ages for a family trip.
Changes to this policy
We update this policy when our services or the law change. The date of the last update is shown at the top of this page.
See also the Legal notice.