Experiences Operator

PRIVACY POLICY

Last updated: 14/10/2026

1. Who we are

This Privacy Policy explains how Vivências Operadora de Turismo LTDA, registered under CNPJ no. 26.451.408/0001-73, located at Rua José Versolato, 111 – Sala 3411, São Bernardo do Campo/SP, collects, uses, shares, and protects the personal data of its clients, passengers, and visitors, in accordance with the General Data Protection Law (Law No. 13.709/2018 – LGPD).
Vivências is the controller of the personal data processed under this Policy.

Data Protection Officer: Gustavo Serrano
Contact: vivencias@vivenciasoperadora.com.br

2. Scope

This Policy applies to the personal data processed by Vivências through its website, WhatsApp, phone, email, social media, in-person service, group tracking application (“Guide App”), and during the execution of trips.

3. What data we collect

a) Identification and contact data: full name, CPF, RG or CIN, passport, date of birth, address, email, and phone;
b) Travel data: destination, dates, type of accommodation, travel companions or roommates, boarding location, emergency contacts, and information necessary for issuing tickets, vouchers, and insurance;
c) Payment data: payment method, installment plan, and receipts. Complete credit card data is processed directly by payment administrators and intermediaries and is not stored by Vivências;
d) Health data (sensitive data): dietary restrictions, allergies, health conditions, or reduced mobility reported by the passenger, used exclusively for the proper provision of services and for their safety;
e) Geolocation: when authorized by the passenger in the Guide App, under the terms of the travel contract;
f) Identification photograph: taken at boarding or check-in, exclusively for the identification of the passenger by the guide and the team;
g) Travel images: photos and videos recorded during trips, used for publicity as per the authorization provided in the travel contract;
h) Navigation data: IP address, date and time of access, pages visited, type of device and browser, collected through cookies and similar technologies;
i) Communications: messages exchanged with Vivências via WhatsApp, email, or other channels.

4. Why we use the data and on what legal basis

  • • To make reservations, issue documents, and execute the contracted trip (transportation, accommodation, tours, insurance): legal basis of contract execution;
  • • To issue invoices and comply with legal and regulatory obligations: legal basis of compliance with legal obligation;
  • • To meet health, food, and mobility needs reported: legal basis of protection of life and physical safety and consent of the data subject;
  • • To ensure the safety of passengers during the trip, including through geolocation and identification photo: legal basis of consent (geolocation) and contract execution and protection of life (identification photo);
  • • To provide service and respond to requests: legal basis of contract execution and legitimate interest;
  • • To prevent fraud and ensure the security of the website and payments: legal basis of legitimate interest;
  • • To defend rights in judicial or administrative proceedings: legal basis of regular exercise of rights;
  • • To send offers, news, and promotional content: legal basis of consent, which can be revoked at any time;
  • • To publish travel images on social media and the website: legal basis of consent, as per authorization in the travel contract;
  • • To measure the performance of the website and advertising campaigns: legal basis of consent, through the acceptance of cookies.

5. Who we share the data with

Vivências does not sell personal data. Data is shared only when necessary, with:
a) Travel suppliers: airlines, bus companies, shipping companies, hotels, reception services, guides, tourist attractions, and insurers, for the execution of contracted services;
b) Management and service tools: reservation system (Excapy), customer relationship system (Nezzon), and WhatsApp Business, used to organize reservations and serve clients;
c) Analysis and advertising tools: Meta (Facebook and Instagram Pixel), Google Analytics, and Google Ads, to measure website access and campaign performance, with cookie acceptance;
d) Payment methods: card administrators, banks, and payment intermediaries;
e) Travel agencies and partner promoters, when the sale is made through them;
f) Public authorities, when required by law or court order, and emergency services, when necessary to protect the life or physical integrity of the passenger.
These partners must process the data only for the stated purposes and adopt appropriate security measures.

6. International data transfer

On trips abroad, some personal data need to be sent to suppliers located in other countries, such as hotels, reception services, and airlines. Some of the tools used by Vivências may also store data on servers outside Brazil. These transfers occur for the execution of the contract and comply with the conditions set forth in the LGPD.

7. Cookies

Cookies are small files stored in your browser. The website uses:
Essential cookies: necessary for the functioning of the website, such as login and purchase process. They cannot be disabled;
Analysis cookies: such as Google Analytics, which show how the website is used;
Advertising cookies: such as Meta Pixel and Google Ads, which measure campaigns and display relevant ads.
Analysis and advertising cookies are only activated with your consent, through the notice displayed when accessing the website. You can change your preferences at any time in this notice or in your browser settings.

8. Marketing communications

The sending of offers and news via email, WhatsApp, or other means depends on your consent. You can stop receiving them at any time, via the unsubscribe link in emails, responding “UNSUBSCRIBE” on WhatsApp, or by email at vivencias@vivenciasoperadora.com.br. Operational messages related to your trips will continue to be sent.

9. How long we keep the data

  • Contract, reservation, and payment data: for up to 5 (five) years after the end of the trip, to comply with legal and tax obligations and to defend against potential lawsuits;
  • Geolocation and identification photo: up to 5 (five) days after the end of the trip, except for data related to recorded incidents, kept for the time necessary for their investigation;
  • Health data: until the end of the trip, except when related to recorded incidents;
  • Website access logs: for 6 (six) months, according to the Internet Civil Framework (Law No. 12.965/2014);
  • Marketing data: until consent is revoked;
  • Travel images: while the image use authorization is in effect.
    Once these periods are over, the data is deleted or anonymized.

10. Data security

Vivências adopts technical and administrative measures to protect personal data against unauthorized access, loss, or alteration, including encryption (SSL certificate) on the website, access control to systems, and restricting data to those who need it to perform their functions.
Vivências never requests passwords, complete credit card data, or security codes via email, WhatsApp, or phone. If you receive any suspicious contact in our name, do not respond and inform us by email at vivencias@vivenciasoperadora.com.br or by phone at (11) 2381-2408.

11. Your rights

Under Article 18 of the LGPD, you can, at any time:
a) confirm whether Vivências processes your data;
b) access your data;
c) correct incomplete, inaccurate, or outdated data;
d) request the anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance with the law;
e) request the portability of your data;
f) request the deletion of data processed based on your consent;
g) know with whom your data has been shared;
h) be informed about the possibility of not providing consent and its consequences;
i) revoke consent.
To exercise these rights, send your request to vivencias@vivenciasoperadora.com.br. We will respond within 15 (fifteen) days. Some data may be retained even after the deletion request when necessary to comply with legal obligations or to defend rights.
You may also file a complaint with the National Data Protection Authority (ANPD).

12. Data of children and adolescents

Data of passengers under 18 years old is processed in their best interest and only with the consent or authorization of at least one parent or legal guardian, who is a signatory to the travel contract, and exclusively for the execution of the trip and the safety of the minor.

13. Changes to this Policy

This Policy may be updated periodically, and the date of the last update will always be informed at the beginning of the document. Relevant changes will be communicated on the website and, to registered clients, via email.

14. Applicable law and jurisdiction

This Policy is governed by Brazilian legislation. The Forum of the District of São Bernardo do Campo/SP is elected to resolve any disputes, reserving the consumer's right to choose the forum of their domicile, under the terms of Article 101, item I, of the Consumer Protection Code.