Vivências Operator

PRIVACY POLICY

Last updated: 10/14/2026

1. Who we are

This Privacy Policy explains how Vivências Operadora de Turismo LTDA, registered under CNPJ No. 26.451.408/0001-73, headquartered at Rua José Versolato, 111 – Sala 3411, São Bernardo do Campo/SP, collects, uses, shares, and protects the personal data of its clients, passengers, and visitors, in accordance with the General Data Protection Law (Law No. 13.709/2018 – LGPD).
Vivências is the controller of the personal data processed under this Policy.

Data Protection Officer: Gustavo Serrano
Contact: vivencias@vivenciasoperadora.com.br

2. Scope

This Policy applies to the personal data processed by Vivências through its website, WhatsApp, phone, email, social media, in-person service, group tracking app (“Guide App”), and during the execution of trips.

3. What data we collect

a) Identification and contact data: full name, CPF, RG or CIN, passport, date of birth, address, email, and phone;
b) Travel data: destination, dates, type of accommodation, travel or room companions, boarding location, emergency contacts, and information necessary for issuing tickets, vouchers, and insurance;
c) Payment data: payment method, installment plans, and receipts. Complete credit card data is processed directly by payment processors and intermediaries and is not stored by Vivências;
d) Health data (sensitive data): dietary restrictions, allergies, health conditions, or reduced mobility informed by the passenger, used exclusively for the proper provision of services and for their safety;
e) Geolocation: when authorized by the passenger in the Guide App, under the terms of the travel contract;
f) Identification photograph: taken at boarding or check-in, exclusively for passenger identification by the guide and the team;
g) Travel images: photos and videos recorded during trips, used for publicity as per authorization in the travel contract;
h) Navigation data: IP address, date and time of access, pages visited, type of device and browser, collected through cookies and similar technologies;
i) Communications: messages exchanged with Vivências via WhatsApp, email, or other channels.

4. Why we use the data and what legal basis

  • • To make reservations, issue documents, and execute the contracted trip (transportation, accommodation, tours, insurance): legal basis of contract execution;
  • • To issue invoices and comply with legal and regulatory obligations: legal basis of legal obligation compliance;
  • • To meet health, food, and mobility needs informed: legal basis of life and physical safety protection and consent of the data subject;
  • • To ensure passenger safety during the trip, including through geolocation and identification photo: legal basis of consent (geolocation) and contract execution and life protection (identification photo);
  • • To provide service and respond to requests: legal basis of contract execution and legitimate interest;
  • • To prevent fraud and ensure the security of the website and payments: legal basis of legitimate interest;
  • • To defend rights in judicial or administrative processes: legal basis of regular exercise of rights;
  • • To send offers, news, and promotional content: legal basis of consent, which can be revoked at any time;
  • • To publish travel images on social media and the website: legal basis of consent, as per authorization in the travel contract;
  • • To measure the performance of the website and advertising campaigns: legal basis of consent, through acceptance of cookies.

5. With whom we share the data

Vivências does not sell personal data. Data is shared only when necessary, with:
a) Travel suppliers: airlines, bus companies, shipping companies, hotels, reception services, guides, tourist attractions, and insurance companies, for the execution of contracted services;
b) Management and service tools: reservation system (Excapy), customer relationship system (Nezzon), and WhatsApp Business, used to organize reservations and serve clients;
c) Analysis and advertising tools: Meta (Facebook and Instagram Pixel), Google Analytics, and Google Ads, to measure website access and campaign performance, upon acceptance of cookies;
d) Payment methods: card administrators, banks, and payment intermediaries;
e) Travel agencies and partner promoters, when the sale is made through them;
f) Public authorities, when required by law or court order, and emergency services, when necessary to protect the life or physical integrity of the passenger.
These partners must process the data only for the stated purposes and adopt appropriate security measures.

6. International data transfer

On trips abroad, some personal data need to be sent to suppliers located in other countries, such as hotels, reception services, and airlines. Some of the tools used by Vivências may also store data on servers outside Brazil. These transfers occur for contract execution and comply with the conditions set forth in the LGPD.

7. Cookies

Cookies are small files stored in your browser. The website uses:
Essential cookies: necessary for the website's functioning, such as login and purchase process. They cannot be disabled;
Analysis cookies: such as Google Analytics, which show how the website is used;
Advertising cookies: such as Meta Pixel and Google Ads, which measure campaigns and display relevant ads.
Analysis and advertising cookies are only activated with your consent, through the notice displayed when accessing the website. You can change your preferences at any time in this notice or in your browser settings.

8. Marketing communications

The sending of offers and news via email, WhatsApp, or other means depends on your consent. You can unsubscribe at any time, using the unsubscribe link in emails, replying “UNSUBSCRIBE” on WhatsApp, or by emailing vivencias@vivenciasoperadora.com.br. Operational messages related to your trips will continue to be sent.

9. How long we keep the data

  • Contract, reservation, and payment data: for up to 5 (five) years after the end of the trip, to comply with legal and tax obligations and to defend against any processes;
  • Geolocation and identification photo: up to 5 (five) days after the end of the trip, except for data related to recorded occurrences, kept for the time necessary for their investigation;
  • Health data: until the end of the trip, except when related to recorded occurrences;
  • Website access records: for 6 (six) months, according to the Internet Civil Framework (Law No. 12.965/2014);
  • Marketing data: until consent is revoked;
  • Travel images: while the image use authorization is in effect.
    After these periods, the data is deleted or anonymized.

10. Data security

Vivências adopts technical and administrative measures to protect personal data against unauthorized access, loss, or alteration, including encryption (SSL certificate) on the website, access control to systems, and restricting data to those who need it to perform their functions.
Vivências never requests passwords, complete credit card data, or security codes via email, WhatsApp, or phone. If you receive any suspicious contact in our name, do not respond and inform us by email at vivencias@vivenciasoperadora.com.br or by phone at (11) 2381-2408.

11. Your rights

Under Article 18 of the LGPD, you can, at any time:
a) confirm whether Vivências processes your data;
b) access your data;
c) correct incomplete, inaccurate, or outdated data;
d) request the anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance with the law;
e) request the portability of your data;
f) request the deletion of data processed based on your consent;
g) know with whom your data has been shared;
h) be informed about the possibility of not providing consent and its consequences;
i) revoke consent.
To exercise these rights, send your request to vivencias@vivenciasoperadora.com.br. We will respond within 15 (fifteen) days. Some data may be retained even after the deletion request when necessary to comply with legal obligations or to defend rights.
You can also file a complaint with the National Data Protection Authority (ANPD).

12. Data of children and adolescents

Data of passengers under 18 years old is processed in their best interest and only with the consent or authorization of at least one of the parents or legal guardians, signatory of the travel contract, and exclusively for the execution of the trip and the safety of the minor.

13. Changes to this Policy

This Policy may be updated periodically, and the date of the last update will always be informed at the beginning of the document. Relevant changes will be communicated on the website and, to registered clients, via email.

14. Applicable law and jurisdiction

This Policy is governed by Brazilian legislation. The Forum of the District of São Bernardo do Campo/SP is elected to resolve any disputes, reserving the consumer's right to choose the forum of their domicile, under the terms of Article 101, item I, of the Consumer Protection Code.