Legal document
Privacy policy
Under the LGPD: who controls your data, what is collected and on which legal basis, who receives it abroad, and how to use your rights.
The short version
This site collects what an enquiry needs and nothing else. It sets no cookies, runs no advertising trackers, and sells or rents no personal data. This page is the information the Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018) entitles you to (art. 9).
Who controls your data
The controller is TODO_LEGAL_NAME, CNPJ TODO_CNPJ, at TODO_ADDRESS. The data protection officer (encarregado, LGPD art. 41) is TODO_DPO, reachable at TODO_EMAIL; the encarregado receives your requests and complaints and answers them.
What we collect, why, and on which legal basis
| Data | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|
| Name, e-mail, phone number | Answering your enquiry and preparing a quote | Steps before a contract, at your request (item V) |
| Destination, service, date, time, number of people, budget, your message | Planning and quoting the session | Steps before a contract, at your request (item V) |
| The same data, once you book | Running the session, permits, delivery | Performance of the contract (item V) |
| Billing details, including CPF or CNPJ, if a tax invoice is issued | Invoicing and tax records | Legal obligation (item II) |
| Booking records | Answering a claim or a complaint | Exercise of rights in proceedings (item VI) |
| Your photographs in our portfolio | Showing our work | Your consent (item I), asked separately |
We do not ask for sensitive personal data (LGPD art. 5, II), such as health, religious belief or sex life, and ask you not to put it in a message. A maternity session or a religious ceremony may reveal such a fact by its nature; that fact is used only to plan the session. TODO_SENSITIVE_DATA.
If you give us data about other people — a partner, guests, children — you confirm you may share it with us for these purposes.
We send no newsletters or advertising and build no profiles.
Who receives it, and where
| Recipient | What for | Where |
|---|---|---|
| Telegram | Delivers each enquiry to our team as an alert | Servers outside Brazil, under Telegram's own privacy policy |
| Cloudflare | Hosting and content delivery for this site | Servers worldwide, including the United States |
| WhatsApp (Meta) | Only if you choose to write to us there | Servers outside Brazil, under WhatsApp's own terms |
The photographer assigned to your session receives what is needed to work it: your name, phone number, date, time and location. TODO_PHOTOGRAPHER_ROLE.
Sending your enquiry to Telegram and hosting the site on Cloudflare are international transfers. They are made because they are needed for the steps before the contract you asked for (LGPD art. 33, IX, with art. 7, V). TODO_TRANSFER_CLAUSE.
Data also goes to an authority or venue issuing a permit for your session where the session needs it, and to a public authority where the law requires it. It is not shared for any other purpose.
Cookies and analytics
This site sets no cookies and stores nothing on your device. Cloudflare Web Analytics counts page views without cookies and without identifying you. That is why there is no cookie banner.
Your rights
Under article 18 of the LGPD you may ask us, at any time and free of charge (art. 18, §5):
- To confirm whether we process your data, and to access it.
- To correct incomplete, inaccurate or out-of-date data.
- To anonymise, block or delete data that is unnecessary, excessive or processed unlawfully.
- To port your data to another provider.
- To delete data processed on the basis of your consent.
- To know with whom we have shared your data.
- To know that you may refuse consent, and what refusing means.
- To withdraw your consent (art. 8, §5).
Send the request to TODO_EMAIL. A simple confirmation or access request is answered immediately, and a full statement of the data — origin, criteria and purpose — within 15 days of your request (art. 19). Some data must be kept even after a deletion request, such as invoices tax law requires us to keep (art. 16, I).
If you are not satisfied, you may petition the Agência Nacional de Proteção de Dados (ANPD) (gov.br/anpd) or a consumer protection body (art. 18, §§1 and 8).
How long we keep it
| Record | Kept for |
|---|---|
| Enquiry that did not become a booking | 24 months, then deleted |
| Booking and contract | 5 years, the period for a consumer claim under article 27 of the Código de Defesa do Consumidor |
| Invoices and tax records | For as long as tax law requires |
| Delivered photographs in the online gallery | 12 months from delivery |
Security
Data in transit is encrypted, and access is limited to the people who need it to do the work (LGPD art. 46). A security incident that may cause you relevant risk or harm is reported to you and to the ANPD (art. 48).
Children and adolescents
Bookings are made by adults. A session involving minors — a family session, a 15th-birthday party — is booked by a parent or legal guardian, who gives the data. Data about a child is processed in the child's best interest and with the specific consent of at least one parent or guardian (LGPD art. 14), and whether any photograph may be shown publicly is decided separately.
Changes to this policy
Changes are published on this page with a new review date, and anyone with an open booking is told by e-mail (LGPD art. 8, §6).
Last reviewed: TODO_LEGAL_REVIEW.