Privacy policy
This policy explains how Bandeira Park collects, uses and protects your personal data, in compliance with the LGPD (Brazilian General Data Protection Law — Lei Geral de Proteção de Dados, Law No. 13.709/2018). It applies to the bandeirapark.com.br website and the bandeirapark.online booking application.
Last updated: July 6, 2026.
Legal basis
Bandeira Park processes personal data in accordance with the LGPD (Law No. 13.709/2018). We process data on the basis of contract performance (your booking), compliance with legal obligations, legitimate interest (service improvement and fraud prevention) and your consent (analytics and marketing cookies).
Data collected
Most personal data is collected by the booking application (bandeirapark.online) at the moment you book; this policy covers both addresses.
- Identification: name, e-mail and phone number.
- Vehicle: license plate, model and type.
- Payment: processed by Mercado Pago — card data is not stored by Bandeira Park.
- Browsing: IP address, device and pages visited.
Purposes
We use your data to: process and manage bookings; communicate confirmations, changes and operational notices; process payments; operate Clube Bandeira (counting stays and redeeming the free 6th stay); produce site usage analytics; and comply with legal and regulatory obligations.
Technologies we use
Google Tag Manager and Google Analytics 4 are loaded only after your consent in the cookie banner — without acceptance, no analytics or marketing tag runs. Payment is processed by Mercado Pago in the booking application. We use local storage (localStorage) to keep your consent preference. Embedded third-party features, such as Google Maps and YouTube videos, may set their own cookies when loaded.
Sharing
We do not sell or rent your personal data. Sharing is limited to the sub-processors required for our operation: Mercado Pago (payment processing) and Google (analytics tools and infrastructure, subject to consent). Data may also be shared to comply with a legal obligation or an order from a competent authority.
Your rights (LGPD)
The LGPD guarantees you, as the data subject, the rights to confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and withdrawal of consent.
To exercise them, send your request to [email protected]. Requests are answered within the statutory deadline.
Data Protection Officer (DPO)
The contact channel for Bandeira Park's personal data protection officer is [email protected].
See also
Frequently asked questions about privacy
What data does Bandeira Park collect when I book?
Identification data (name, e-mail and phone) and vehicle data (license plate, model and type). Payment is processed by Mercado Pago — card details are not stored by Bandeira Park.
Is my data shared with third parties?
It is not sold or rented. Sharing is limited to the sub-processors needed to run the operation (such as the payment processor), as described in this policy.
How do I request deletion of my data (LGPD)?
Send your request to [email protected]. The LGPD (Law No. 13.709/2018) guarantees the rights of access, correction and deletion, and requests are answered within the legal deadline.
Questions about your data?
Write to [email protected] — we reply within the statutory deadline set by the LGPD.