Skip to content

Legal

Privacy and Cookie Policy

This policy explains, in plain English, what personal data Além do Sonho Eventos collects when you use this site or talk to us, why we collect it, who it is shared with, how long it is kept and what you can require of us at any time.

Version
1.1
Effective from
Last updated
What changed
Identifies the controller, names two processors and sets the retention periods.

This English text is provided for readers who do not read Portuguese. The official version is the Portuguese one, and it prevails in case of any divergence between the two.

Section 1

Who we are, and who answers for your data

Além do Sonho Eventos is an events venue in Ilha de Guaratiba, in the western part of the city of Rio de Janeiro, Brazil. We are the controller of the personal data handled through this site and our customer service — the Brazilian term is controlador, and it means much what “data controller” means under the GDPR: we decide what is collected and why, and we are the ones you hold to account.

Registered company name
ALÉM DOS SONHOS EVENTOS LTDA
CNPJ (Brazilian company number)
38.597.352/0001-49
Registered office
Caminho do Cafuá, 480 — Ilha de Guaratiba, Rio de Janeiro/RJ, CEP 23020-222 — the same address as the venue
Phone and WhatsApp
(21) 96892-8133
Opening hours
Tuesday to Saturday, 9am to 5pm (BRT, UTC−3)

For anything about privacy, write to the address above with “Privacy” in the subject line. Section 14 sets out the steps and the deadlines we work to.

Section 2

Who this policy covers

This policy applies to you if you:

  • visit any page of this website;
  • fill in the form to book a visit or request a proposal;
  • message us on WhatsApp or through the chat window on this site;
  • email us or call us.

It does not cover what happens inside other services you reach from here — Instagram, YouTube, Google Maps — nor the handling of data by suppliers you hire directly for your event, such as caterers, photographers or florists. Each of those has its own policy; section 17 returns to this.

Section 3

Six words that come up throughout

Brazilian data protection law has a vocabulary of its own. These six words run through the whole policy; reading them once here saves guessing later.

Personal data
Any information that identifies you or makes it possible to reach you. Name and phone number are obvious; the IP address of your visit and a browser identifier count too.
Data subject
The person the data is about. In this document, you.
Controller
Whoever decides what is collected and why. In this document, us.
Processor
A company that handles data on our behalf and on our instructions — our hosting provider, for instance. It may not use your data for purposes of its own.
Legal basis
The reason the law accepts for each use. Consent is one of them, but not the only one — and for much of what happens here it is not the appropriate one. Section 5 gives the basis for every purpose.
Cookie
A small file a website stores in your browser so it can remember something between one page and the next. Section 7 lists the ones we use.

Section 4

The data we collect

4.1 What you give us

The booking form asks for your name and phone number — that is all that is required. If you choose to carry on, it then asks for your email, the type of celebration, your intended date, an approximate guest count and a free-text message. You decide where to stop: a half-completed form is still a valid request to be contacted, and we treat it as one.

4.2 What the conversation produces

We keep the history of WhatsApp and on-site chat conversations, with dates and times. If you send a voice note, it may be transcribed automatically so that it can be read and answered. Photographs, floor plans and documents you send in the conversation stay in it.

4.3 What the site collects on its own

Any website collects some technical trace simply by being online: IP address, browser and device type, pages viewed, where you arrived from, and the campaign parameters in the URL (what follows the “?” when you click an advertisement or one of our links). Audience measurement adds a random browser identifier — a number, not a name. If you click “Accept” in the banner, measurement also records clicks and a replay of your visit (“session replay”: the sequence of screens, scrolling and clicks), so we can see where the site confuses people. Section 7 explains what is stored on your device and how to refuse it.

4.4 What we do not collect

  • Sensitive data. We do not ask about racial or ethnic origin, religion, political opinion, trade union membership, health, sex life, or genetic or biometric data. If you mention something of that kind in conversation of your own accord — a dietary restriction, say — we use it only to answer you and do not record it in any customer field.
  • Payment data. The site charges nothing and has no payment function. No card or bank details pass through it.
  • Children’s data. See section 16.
  • What you type. Even with session replay on, every form field is masked on your own device before anything is sent: name, phone, email and message never appear in a recording. And without your “Accept” there is no recording at all.

Section 5

The LGPD requires a lawful reason for every use, and the reason changes with the use. Here is the whole table, with nothing hidden in a footnote.

Each purpose, the data involved, and the article of the LGPD that permits it.
PurposeDataLegal basis (LGPD)
Answering you and booking your visitName, phone, email, type of celebration, date, guest count, messageArt. 7, V — steps preliminary to a contract, taken at your request. This is not consent: you approached us.
Running the WhatsApp and chat conversationConversation history, phone number, transcripts of voice notesArt. 7, V, together with the transparency duty of art. 6, VI
Preparing your proposal and holding your dateEverything above, plus whatever is agreed during the visitArt. 7, V, and, once signed, performance of the contract
Keeping the site up and blocking bots and spamIP address, browser data, access logs, anti-bot challengeArt. 7, IX — legitimate interest in security. Without it the form becomes a spam inbox and customer service stops.
Measuring site audience without cookiesPages viewed, interactions with the site (opening the chat, playing a video, sending the form — never what is typed), source of the visit, device type — in aggregateArt. 7, IX — legitimate interest. Until you decide in the banner, measurement runs without storing anything on your device and without building a profile.
Measuring with cookies, and linking a visit to an enquiryBrowser identifier kept between visits, clicks, and a replay of your visit (with typed fields masked)Art. 7, I — consent, given in the banner and withdrawable at any time (section 7)
Meeting legal obligations and defending legal claimsAccess logs, contracts, tax recordsArt. 7, II and VI, and art. 15 of the Brazilian Internet Act

We do not treat silence as marketing consent. Asking for a proposal does not put you on a mailing list. If we ever offer one, it will be a separate, explicit request with an unsubscribe link in every message.

Where we rely on legitimate interest, you may object. That is an express right under art. 18, §2 of the LGPD. Write to contato@sitioalemdosonho.com.br saying what you object to; we assess it and reply, rather than merely filing it.

Section 6

The AI assistant on WhatsApp

When you message us on WhatsApp, the first reply comes from Fernanda, a virtual assistant — an artificial intelligence program, not a person. She works as assistant to our consultant Thatiane, and she is there to understand your event, answer questions and book your visit.

We say so here for the same reason she says so in the conversation: you are entitled to know who you are talking to. That follows from the duty to inform in Brazil’s Consumer Protection Code (art. 6, III) and from the transparency principle of the LGPD (art. 6, VI).

How it works underneath

  • The content of the conversation is sent to a language model operated by Anthropic PBC, in the United States, which drafts the reply. That is why section 9 exists.
  • Under Anthropic’s commercial terms that content is not used to train models and is deleted from its systems within 30 days. The history that is kept is ours, on our own server, for the periods in section 10.
  • Voice notes may be transcribed to text automatically, so the conversation can be read and answered.
  • The assistant does not sign contracts, does not quote figures and makes no decision about you. She gathers information and passes the conversation on. No decision with legal effect is taken automatically.

How to reach a human

At any point, write in the conversation that you want to speak to a person — “I’d like to talk to a human”, “put me through to the consultant”, anything of the sort. The conversation is handed to our team. You can also message us on WhatsApp at (21) 96892-8133 or write to contato@sitioalemdosonho.com.br, and never deal with the assistant at all.

If you would rather the history of your conversation were deleted, just ask — section 14 explains how.

Section 7

Cookies and similar technologies

This site uses few cookies, and none for advertising. There is no social network pixel, no remarketing, and no sale of data to anyone.

Until you decide in the banner, audience measurement runs in memory: it counts the visit and forgets you when the page closes. Nothing is written to your device and no profile is built. A measurement cookie exists only if you click “Accept” — and only from then on are clicks and a replay of your visit recorded.

Each category of cookie or local storage, who writes it, what for, for how long, and whether it can be switched off.
CategoryWhat is stored, and by whomWhat forDurationCan it be switched off?
Strictly necessaryYour own cookie choice, written by this site to the browser’s localStorage (not a cookie) under the name ads:consentimentoRemembering that you have decided, so we do not ask on every pageUntil you clear itNo — without it there is no way to honour your choice. It disappears when you clear this site’s data.
Strictly necessaryTechnical cookies from Cloudflare, which delivers the site and runs the anti-bot challenge (Turnstile) on the formTelling people from bots, blocking attacks, delivering pagesShort — from session-only to a few hoursNo. Switched off, the form stops submitting and the site is left open to abuse.
AnalyticsA random browser identifier written by PostHog (servers in United States) as a cookie and in localStorageCounting distinct visitors, seeing which pages help people decide to visit, and reviewing clicks and navigation (replay with typed fields masked)Up to 12 monthsYes. It exists only after you click “Accept”, and disappears when you refuse or withdraw.
FunctionalA record of your chat thread, written by the site chat when — and only when — you open the chat windowKeeping the conversation open from one page to the nextWhile the conversation is activeYes, by not opening the chat. Before your click, the chat downloads nothing at all.

Changing or withdrawing your choice

Withdrawing has to be as easy as accepting. The button below erases the stored decision and brings the banner straight back, so you can choose again.

The button appears when JavaScript is enabled. Without JavaScript, audience measurement never loads in the first place — there is nothing to withdraw.

Blocking cookies in your browser

Every browser lets you block or delete cookies in its privacy settings, and lets you browse in a private window. Blocking everything is your right; do note that the strictly necessary cookies above are what make the form work, and without them submission may fail.

Section 8

Who we share data with

We do not sell data. We do not trade data. The companies below handle data on our behalf, under contract, and only for what is written here.

Each supplier, its role, the data it receives and the country where it handles it.
WhoWhat forWhat they receiveWhere
CloudflareSite delivery, attack protection, anti-bot challenge on the formIP address, browser data, form content in transitGlobal network, with processing in the United States
PostHogAudience measurement for the sitePages viewed, source of the visit, browser identifier. No name, phone or email.United States
Meta PlatformsDelivery of WhatsApp messagesPhone number and the content of the messages exchangedUnited States
Anthropic PBCThe AI model that drafts the assistant’s repliesThe conversation content sent to generate a replyUnited States
HetznerHosting the server that holds customer service and the contact baseThe full enquiry record and the conversation historyUnited States (Ashburn, Virginia)
KommoCustomer service CRM: routing the enquiry to a consultant and tracking follow-upName, phone, email and the event details you provideUnited States
GroqTranscription: converting voice notes sent in conversation into textThe audio file of the messageUnited States
Accountants and lawyersTax obligations and defence of legal claims, where they ariseOnly what the particular matter requiresBrazil

We may also disclose data to a public authority where the law or a court order requires it. In that event we check that the request is legitimate before responding and, where doing so would not breach the order, we tell you.

You are entitled to ask for the list of entities with which your data specifically has been shared (art. 18, VII). Write to contato@sitioalemdosonho.com.br.

Section 9

International transfers of your data

Some of your data leaves Brazil. The server holding your enquiry record and your conversation history is in the United States, in Ashburn, Virginia. Brazilian law regulates that transfer, and it requires us to say so plainly rather than bury it in a footnote — which is what this section does.

What goes where, and why

Each international transfer: recipient, country, data transferred, purpose and legal mechanism.
RecipientCountryWhat is transferred, and whyLegal mechanism
Hetzner (processor)United StatesThe full enquiry record and conversation history, stored continuously so that customer service can functionStandard contractual clauses — art. 33, II, “b”
Meta Platforms (processor)United StatesPhone number and message content, for as long as delivering each WhatsApp message requiresStandard contractual clauses — art. 33, II, “b”
Anthropic PBC (processor)United StatesConversation content, sent with each message to generate the reply and deleted from its systems within 30 daysStandard contractual clauses — art. 33, II, “b”
Cloudflare (processor)United States and global networkIP address and technical data, to deliver pages and block botsStandard contractual clauses — art. 33, II, “b”
PostHog (processor)United StatesSite audience data, with no name, phone or emailStandard contractual clauses — art. 33, II, “b”. The United States has no ANPD adequacy decision.

What that means in practice

  • The United States has no adequacy decision from the ANPD, Brazil’s data protection authority. Every transfer there therefore rests on the standard contractual clauses approved by ANPD Resolution No. 19/2024, adopted in full and without alteration in our contracts with those suppliers.
  • Those clauses bind the recipient to handle your data to the LGPD standard even where local law is laxer, and they keep your rights enforceable here, against us. You never have to pursue a foreign company.
  • Audience measurement runs in United States, which has no adequacy decision from the ANPD. That transfer rests on the standard contractual clauses described above — art. 33, II, “b”. What goes there is page views, referrer and a random browser identifier: never a name, phone number or email address.
  • Each transfer lasts as long as the retention periods in section 10. Once a period ends, the data is deleted there too.
  • To exercise any right connected with these transfers, the channel is the same as for everything else in this policy: contato@sitioalemdosonho.com.br.

Section 10

How long we keep things

Data kept forever “just in case” is data exposed for no reason. Every category below has a period and a destination at the end of it.

Each category of data, how long it is kept, why, and what happens afterwards.
DataPeriodWhyAfterwards
Enquiry that did not become an event24 months after the last contactA wedding date is settled one to two years ahead; deleting too early means asking you everything againDeletion
Conversation history24 months after the last messageEvidence of what was agreed during the enquiryDeletion
Records of clients who booked5 years after the eventPerformance of the contract and, after it, the limitation period for bringing or defending a claimDeletion or anonymisation
Website access logsAt least 6 monthsRequired by art. 15 of the Brazilian Internet ActDeletion
Audience data12 monthsComparing seasons and understanding what works on the siteDeletion, or aggregation with no identifier
Tax and accounting records5 yearsLegal and tax obligationDeletion
Record of your consentWhile it stands, and then for the limitation periodThe law puts the burden of proving consent on us (art. 8, §2)Deletion

Each period runs from the point named in its own row: the last contact, the last message or the date of the event. If your enquiry becomes an event, it and the conversation move to the period for clients who booked.

Once a period ends, data is deleted or anonymised — anonymised meaning it no longer allows anyone to get back to you and becomes mere statistics. We may keep something longer where a legal obligation or a pending proceeding requires it, and only for as long as that lasts.

You do not have to wait for a period to run out: you can ask for deletion at any time, through section 14.

Section 11

How we protect your data

On the technical side:

  • all site traffic is encrypted (HTTPS), with no exception for any page;
  • the site sits behind a protection layer against attack, and the form carries an anti-bot check verified on the server — not only in the browser;
  • access to the contact base is individual, password-protected and limited to the people who answer enquiries;
  • we take periodic backups, stored separately;
  • we separate identifying data from the data we analyse: internal reports run on records with no name and no phone number.

On the human side:

  • whoever answers you sees only what answering requires;
  • a supplier receives data only under contract, for a written purpose;
  • the virtual assistant does not quote figures or terms — that is a human conversation.

No system is completely secure, and a policy that promised otherwise would be lying. What we promise is the standard of care required by art. 6, VII of the LGPD, and an honest warning if something goes wrong — which is the next section.

Section 12

If there is a security incident

A security incident means any unauthorised access to, or loss, alteration or leak of, personal data. If one occurs that could bring you relevant risk or harm:

  • we notify the ANPD within three working days of learning that personal data was affected, as ANPD Resolution No. 15/2024 requires;
  • we notify you within the same period, saying what happened, which data was affected, what we have already done and what you can do;
  • we log the incident, fix the cause and review what allowed it to happen.

If you suspect a problem — an odd message in our name, a request for data that does not look like ours — write to contato@sitioalemdosonho.com.br. We check and reply.

Section 13

Your rights

The LGPD gives you nine rights over your data, and they all apply here — wherever you live, because the law follows the processing done in Brazil, not your passport. You need not justify a request, and you never pay for one.

Know whether we hold data about you
Confirmation that processing does (or does not) exist — art. 18, I.
See the data
Access to what we hold about you — art. 18, II.
Correct it
Incomplete, out-of-date or wrong data — art. 18, III.
Delete, block or anonymise
Anything unnecessary, excessive or handled outside the law — art. 18, IV.
Take it with you
Portability to another supplier, in a usable format — art. 18, V.
Erase what was handled on consent
Art. 18, VI, subject to the mandatory retention grounds in art. 16.
Know who we shared it with
The list of public and private entities that received your data — art. 18, VII.
Know what happens if you say no
Information about the option not to consent and about the consequences — art. 18, VIII.
Withdraw consent
At any time, free of charge, with the same effort that giving it cost — art. 18, IX, and art. 8, §5.
Object to processing based on legitimate interest
Wherever the legal basis is legitimate interest, you may object — art. 18, §2.
Complain to the ANPD
You may petition the Brazilian data protection authority directly. You do not have to come to us first — though we would appreciate the chance to fix it.

Section 14

How to exercise your rights

Write to contato@sitioalemdosonho.com.br with “Privacy” in the subject line and say what you want. Plain language is enough: “what data do you hold about me?”, “please delete my data”, “please correct my email address”. Portuguese and English are both fine.

What helps us resolve it quickly

  • The phone number or email you used when you contacted us — that is how we find your record.
  • Which of the rights in section 13 you are exercising.
  • Roughly when the contact happened, if you remember. Not required; it just helps.

How we confirm it is you

Before handing over or deleting anything, we need to be sure the request is yours — protecting your data includes not giving it to someone impersonating you. Usually it is enough that the request comes from the email address or phone number on your record. Where it does not, we may ask for one further confirmation, always the simplest one that settles the matter.

Deadlines

  • Immediately, in simplified form, confirmation of whether processing exists.
  • Within 15 days, the full statement, including the origin of the data and the criteria and purpose of the processing (art. 19, II).
  • Correction and deletion requests are handled as fast as we can, and you are told once it is done.

All of this is free. If in some case we cannot comply — for example where the law obliges us to keep a tax record — we explain the reason and the legal basis, in writing.

Section 15

The data protection officer

The encarregado, Brazil’s equivalent of a data protection officer, is the person who sits between you, the company and the ANPD. The LGPD requires the identity and contact details of that person to be published clearly, preferably on the controller’s website — art. 41, §1.

Encarregado
Data protection lead, Além do Sonho Eventos

Write with “Privacy” in the subject line: it reaches whoever answers for this, and section 14 sets out how quickly we reply.

Section 16

Children and teenagers

This site and our customer service are meant for people over 18: whoever books an events venue is an adult. We do not intentionally collect data from children or teenagers, and we do not ask anyone’s age.

At a children’s party or a fifteenth-birthday celebration the event belongs to the child, but the record belongs to whoever books it. If you tell us the name or age of the guest of honour so that we can prepare the proposal, we use it for that alone, in their best interest, and for the periods in section 10.

If a parent or guardian realises that a child has sent us data, write to contato@sitioalemdosonho.com.br: we delete it as soon as we confirm it.

Section 17

This site takes you to places that are not ours: our Instagram profile, a video on YouTube, a Google map, WhatsApp. The moment you click, you enter a service with its own policy, collecting data on its own account and under its own rules.

We are careful about what we embed — the YouTube video loads only when you press play, and the chat downloads only when you open it. But after the click the destination service is the one answering, and its policy is worth reading.

Section 18

Changes to this policy

This policy changes when our operation changes: a new tool, a new supplier, a new purpose. When that happens:

  • we publish the new version here, with an updated number and effective date;
  • a summary of what changed sits at the top of the page, beside the date;
  • if the change introduces a new purpose that depends on consent, the banner reappears so that you can decide again. Consent given for one purpose does not carry over to another.

Version history

Each version of this policy, the date it took effect and what changed.
VersionEffective fromWhat changed
1.1Identifies the controller (company name, CNPJ and registered office), names the CRM and the voice-note transcription service, sets the four retention periods that were open and publishes the data protection contact.
1.0First version. Documents cookieless audience measurement before consent, the virtual assistant on WhatsApp, and the international transfer to the United States.

Section 19

Governing law and jurisdiction

This policy is governed by Brazilian law — in particular Lei nº 13.709/2018 (the LGPD), Lei nº 12.965/2014 (the Brazilian Internet Act) and the Consumer Protection Code, together with the resolutions of the ANPD. That is so wherever you happen to live: the venue, the company and the processing are in Brazil.

The courts of Rio de Janeiro are the agreed forum for any dispute arising from this policy, without prejudice to a consumer’s right to sue where they live.

Questions about any of this? Write to contato@sitioalemdosonho.com.br. If you would rather come and see the place, start at the visit page.

Written by Thatiane Pacobahyba, of the Além do Sonho Eventos team.Updated on .