Legal
Privacy and Cookie Policy
This policy explains, in plain English, what personal data Além do Sonho Eventos collects when you use this site or talk to us, why we collect it, who it is shared with, how long it is kept and what you can require of us at any time.
- Version
- 1.1
- Effective from
- Last updated
- What changed
- Identifies the controller, names two processors and sets the retention periods.
This English text is provided for readers who do not read Portuguese. The official version is the Portuguese one, and it prevails in case of any divergence between the two.
Contents
What is on this page
- 1Who we are, and who answers for your data
- 2Who this policy covers
- 3Six words that come up throughout
- 4The data we collect
- 5What we use it for, and on what legal basis
- 6The AI assistant on WhatsApp
- 7Cookies and similar technologies
- 8Who we share data with
- 9International transfers of your data
- 10How long we keep things
- 11How we protect your data
- 12If there is a security incident
- 13Your rights
- 14How to exercise your rights
- 15The data protection officer
- 16Children and teenagers
- 17Links to third-party sites
- 18Changes to this policy
- 19Governing law and jurisdiction
In a hurry? The three sections that answer most questions are 6, on the AI assistant, 9, on data leaving Brazil, and 13, on what you can require of us.
Section 1
Who we are, and who answers for your data
Além do Sonho Eventos is an events venue in Ilha de Guaratiba, in the western part of the city of Rio de Janeiro, Brazil. We are the controller of the personal data handled through this site and our customer service — the Brazilian term is controlador, and it means much what “data controller” means under the GDPR: we decide what is collected and why, and we are the ones you hold to account.
- Registered company name
- ALÉM DOS SONHOS EVENTOS LTDA
- CNPJ (Brazilian company number)
- 38.597.352/0001-49
- Registered office
- Caminho do Cafuá, 480 — Ilha de Guaratiba, Rio de Janeiro/RJ, CEP 23020-222 — the same address as the venue
- Phone and WhatsApp
- (21) 96892-8133
- Opening hours
- Tuesday to Saturday, 9am to 5pm (BRT, UTC−3)
For anything about privacy, write to the address above with “Privacy” in the subject line. Section 14 sets out the steps and the deadlines we work to.
Section 2
Who this policy covers
This policy applies to you if you:
- visit any page of this website;
- fill in the form to book a visit or request a proposal;
- message us on WhatsApp or through the chat window on this site;
- email us or call us.
It does not cover what happens inside other services you reach from here — Instagram, YouTube, Google Maps — nor the handling of data by suppliers you hire directly for your event, such as caterers, photographers or florists. Each of those has its own policy; section 17 returns to this.
Section 3
Six words that come up throughout
Brazilian data protection law has a vocabulary of its own. These six words run through the whole policy; reading them once here saves guessing later.
- Personal data
- Any information that identifies you or makes it possible to reach you. Name and phone number are obvious; the IP address of your visit and a browser identifier count too.
- Data subject
- The person the data is about. In this document, you.
- Controller
- Whoever decides what is collected and why. In this document, us.
- Processor
- A company that handles data on our behalf and on our instructions — our hosting provider, for instance. It may not use your data for purposes of its own.
- Legal basis
- The reason the law accepts for each use. Consent is one of them, but not the only one — and for much of what happens here it is not the appropriate one. Section 5 gives the basis for every purpose.
- Cookie
- A small file a website stores in your browser so it can remember something between one page and the next. Section 7 lists the ones we use.
Section 4
The data we collect
4.1 What you give us
The booking form asks for your name and phone number — that is all that is required. If you choose to carry on, it then asks for your email, the type of celebration, your intended date, an approximate guest count and a free-text message. You decide where to stop: a half-completed form is still a valid request to be contacted, and we treat it as one.
4.2 What the conversation produces
We keep the history of WhatsApp and on-site chat conversations, with dates and times. If you send a voice note, it may be transcribed automatically so that it can be read and answered. Photographs, floor plans and documents you send in the conversation stay in it.
4.3 What the site collects on its own
Any website collects some technical trace simply by being online: IP address, browser and device type, pages viewed, where you arrived from, and the campaign parameters in the URL (what follows the “?” when you click an advertisement or one of our links). Audience measurement adds a random browser identifier — a number, not a name. If you click “Accept” in the banner, measurement also records clicks and a replay of your visit (“session replay”: the sequence of screens, scrolling and clicks), so we can see where the site confuses people. Section 7 explains what is stored on your device and how to refuse it.
4.4 What we do not collect
- Sensitive data. We do not ask about racial or ethnic origin, religion, political opinion, trade union membership, health, sex life, or genetic or biometric data. If you mention something of that kind in conversation of your own accord — a dietary restriction, say — we use it only to answer you and do not record it in any customer field.
- Payment data. The site charges nothing and has no payment function. No card or bank details pass through it.
- Children’s data. See section 16.
- What you type. Even with session replay on, every form field is masked on your own device before anything is sent: name, phone, email and message never appear in a recording. And without your “Accept” there is no recording at all.
Section 5
What we use it for, and on what legal basis
The LGPD requires a lawful reason for every use, and the reason changes with the use. Here is the whole table, with nothing hidden in a footnote.
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Answering you and booking your visit | Name, phone, email, type of celebration, date, guest count, message | Art. 7, V — steps preliminary to a contract, taken at your request. This is not consent: you approached us. |
| Running the WhatsApp and chat conversation | Conversation history, phone number, transcripts of voice notes | Art. 7, V, together with the transparency duty of art. 6, VI |
| Preparing your proposal and holding your date | Everything above, plus whatever is agreed during the visit | Art. 7, V, and, once signed, performance of the contract |
| Keeping the site up and blocking bots and spam | IP address, browser data, access logs, anti-bot challenge | Art. 7, IX — legitimate interest in security. Without it the form becomes a spam inbox and customer service stops. |
| Measuring site audience without cookies | Pages viewed, interactions with the site (opening the chat, playing a video, sending the form — never what is typed), source of the visit, device type — in aggregate | Art. 7, IX — legitimate interest. Until you decide in the banner, measurement runs without storing anything on your device and without building a profile. |
| Measuring with cookies, and linking a visit to an enquiry | Browser identifier kept between visits, clicks, and a replay of your visit (with typed fields masked) | Art. 7, I — consent, given in the banner and withdrawable at any time (section 7) |
| Meeting legal obligations and defending legal claims | Access logs, contracts, tax records | Art. 7, II and VI, and art. 15 of the Brazilian Internet Act |
We do not treat silence as marketing consent. Asking for a proposal does not put you on a mailing list. If we ever offer one, it will be a separate, explicit request with an unsubscribe link in every message.
Where we rely on legitimate interest, you may object. That is an express right under art. 18, §2 of the LGPD. Write to contato@sitioalemdosonho.com.br saying what you object to; we assess it and reply, rather than merely filing it.
Section 6
The AI assistant on WhatsApp
When you message us on WhatsApp, the first reply comes from Fernanda, a virtual assistant — an artificial intelligence program, not a person. She works as assistant to our consultant Thatiane, and she is there to understand your event, answer questions and book your visit.
We say so here for the same reason she says so in the conversation: you are entitled to know who you are talking to. That follows from the duty to inform in Brazil’s Consumer Protection Code (art. 6, III) and from the transparency principle of the LGPD (art. 6, VI).
How it works underneath
- The content of the conversation is sent to a language model operated by Anthropic PBC, in the United States, which drafts the reply. That is why section 9 exists.
- Under Anthropic’s commercial terms that content is not used to train models and is deleted from its systems within 30 days. The history that is kept is ours, on our own server, for the periods in section 10.
- Voice notes may be transcribed to text automatically, so the conversation can be read and answered.
- The assistant does not sign contracts, does not quote figures and makes no decision about you. She gathers information and passes the conversation on. No decision with legal effect is taken automatically.
How to reach a human
At any point, write in the conversation that you want to speak to a person — “I’d like to talk to a human”, “put me through to the consultant”, anything of the sort. The conversation is handed to our team. You can also message us on WhatsApp at (21) 96892-8133 or write to contato@sitioalemdosonho.com.br, and never deal with the assistant at all.
If you would rather the history of your conversation were deleted, just ask — section 14 explains how.
Section 7
Cookies and similar technologies
This site uses few cookies, and none for advertising. There is no social network pixel, no remarketing, and no sale of data to anyone.
Until you decide in the banner, audience measurement runs in memory: it counts the visit and forgets you when the page closes. Nothing is written to your device and no profile is built. A measurement cookie exists only if you click “Accept” — and only from then on are clicks and a replay of your visit recorded.
| Category | What is stored, and by whom | What for | Duration | Can it be switched off? |
|---|---|---|---|---|
| Strictly necessary | Your own cookie choice, written by this site to the browser’s localStorage (not a cookie) under the name ads:consentimento | Remembering that you have decided, so we do not ask on every page | Until you clear it | No — without it there is no way to honour your choice. It disappears when you clear this site’s data. |
| Strictly necessary | Technical cookies from Cloudflare, which delivers the site and runs the anti-bot challenge (Turnstile) on the form | Telling people from bots, blocking attacks, delivering pages | Short — from session-only to a few hours | No. Switched off, the form stops submitting and the site is left open to abuse. |
| Analytics | A random browser identifier written by PostHog (servers in United States) as a cookie and in localStorage | Counting distinct visitors, seeing which pages help people decide to visit, and reviewing clicks and navigation (replay with typed fields masked) | Up to 12 months | Yes. It exists only after you click “Accept”, and disappears when you refuse or withdraw. |
| Functional | A record of your chat thread, written by the site chat when — and only when — you open the chat window | Keeping the conversation open from one page to the next | While the conversation is active | Yes, by not opening the chat. Before your click, the chat downloads nothing at all. |
Changing or withdrawing your choice
Withdrawing has to be as easy as accepting. The button below erases the stored decision and brings the banner straight back, so you can choose again.
The button appears when JavaScript is enabled. Without JavaScript, audience measurement never loads in the first place — there is nothing to withdraw.
Blocking cookies in your browser
Every browser lets you block or delete cookies in its privacy settings, and lets you browse in a private window. Blocking everything is your right; do note that the strictly necessary cookies above are what make the form work, and without them submission may fail.
Section 8
Who we share data with
We do not sell data. We do not trade data. The companies below handle data on our behalf, under contract, and only for what is written here.
| Who | What for | What they receive | Where |
|---|---|---|---|
| Cloudflare | Site delivery, attack protection, anti-bot challenge on the form | IP address, browser data, form content in transit | Global network, with processing in the United States |
| PostHog | Audience measurement for the site | Pages viewed, source of the visit, browser identifier. No name, phone or email. | United States |
| Meta Platforms | Delivery of WhatsApp messages | Phone number and the content of the messages exchanged | United States |
| Anthropic PBC | The AI model that drafts the assistant’s replies | The conversation content sent to generate a reply | United States |
| Hetzner | Hosting the server that holds customer service and the contact base | The full enquiry record and the conversation history | United States (Ashburn, Virginia) |
| Kommo | Customer service CRM: routing the enquiry to a consultant and tracking follow-up | Name, phone, email and the event details you provide | United States |
| Groq | Transcription: converting voice notes sent in conversation into text | The audio file of the message | United States |
| Accountants and lawyers | Tax obligations and defence of legal claims, where they arise | Only what the particular matter requires | Brazil |
We may also disclose data to a public authority where the law or a court order requires it. In that event we check that the request is legitimate before responding and, where doing so would not breach the order, we tell you.
You are entitled to ask for the list of entities with which your data specifically has been shared (art. 18, VII). Write to contato@sitioalemdosonho.com.br.
Section 9
International transfers of your data
Some of your data leaves Brazil. The server holding your enquiry record and your conversation history is in the United States, in Ashburn, Virginia. Brazilian law regulates that transfer, and it requires us to say so plainly rather than bury it in a footnote — which is what this section does.
What goes where, and why
| Recipient | Country | What is transferred, and why | Legal mechanism |
|---|---|---|---|
| Hetzner (processor) | United States | The full enquiry record and conversation history, stored continuously so that customer service can function | Standard contractual clauses — art. 33, II, “b” |
| Meta Platforms (processor) | United States | Phone number and message content, for as long as delivering each WhatsApp message requires | Standard contractual clauses — art. 33, II, “b” |
| Anthropic PBC (processor) | United States | Conversation content, sent with each message to generate the reply and deleted from its systems within 30 days | Standard contractual clauses — art. 33, II, “b” |
| Cloudflare (processor) | United States and global network | IP address and technical data, to deliver pages and block bots | Standard contractual clauses — art. 33, II, “b” |
| PostHog (processor) | United States | Site audience data, with no name, phone or email | Standard contractual clauses — art. 33, II, “b”. The United States has no ANPD adequacy decision. |
What that means in practice
- The United States has no adequacy decision from the ANPD, Brazil’s data protection authority. Every transfer there therefore rests on the standard contractual clauses approved by ANPD Resolution No. 19/2024, adopted in full and without alteration in our contracts with those suppliers.
- Those clauses bind the recipient to handle your data to the LGPD standard even where local law is laxer, and they keep your rights enforceable here, against us. You never have to pursue a foreign company.
- Audience measurement runs in United States, which has no adequacy decision from the ANPD. That transfer rests on the standard contractual clauses described above — art. 33, II, “b”. What goes there is page views, referrer and a random browser identifier: never a name, phone number or email address.
- Each transfer lasts as long as the retention periods in section 10. Once a period ends, the data is deleted there too.
- To exercise any right connected with these transfers, the channel is the same as for everything else in this policy: contato@sitioalemdosonho.com.br.
Section 10
How long we keep things
Data kept forever “just in case” is data exposed for no reason. Every category below has a period and a destination at the end of it.
| Data | Period | Why | Afterwards |
|---|---|---|---|
| Enquiry that did not become an event | 24 months after the last contact | A wedding date is settled one to two years ahead; deleting too early means asking you everything again | Deletion |
| Conversation history | 24 months after the last message | Evidence of what was agreed during the enquiry | Deletion |
| Records of clients who booked | 5 years after the event | Performance of the contract and, after it, the limitation period for bringing or defending a claim | Deletion or anonymisation |
| Website access logs | At least 6 months | Required by art. 15 of the Brazilian Internet Act | Deletion |
| Audience data | 12 months | Comparing seasons and understanding what works on the site | Deletion, or aggregation with no identifier |
| Tax and accounting records | 5 years | Legal and tax obligation | Deletion |
| Record of your consent | While it stands, and then for the limitation period | The law puts the burden of proving consent on us (art. 8, §2) | Deletion |
Each period runs from the point named in its own row: the last contact, the last message or the date of the event. If your enquiry becomes an event, it and the conversation move to the period for clients who booked.
Once a period ends, data is deleted or anonymised — anonymised meaning it no longer allows anyone to get back to you and becomes mere statistics. We may keep something longer where a legal obligation or a pending proceeding requires it, and only for as long as that lasts.
You do not have to wait for a period to run out: you can ask for deletion at any time, through section 14.
Section 11
How we protect your data
On the technical side:
- all site traffic is encrypted (HTTPS), with no exception for any page;
- the site sits behind a protection layer against attack, and the form carries an anti-bot check verified on the server — not only in the browser;
- access to the contact base is individual, password-protected and limited to the people who answer enquiries;
- we take periodic backups, stored separately;
- we separate identifying data from the data we analyse: internal reports run on records with no name and no phone number.
On the human side:
- whoever answers you sees only what answering requires;
- a supplier receives data only under contract, for a written purpose;
- the virtual assistant does not quote figures or terms — that is a human conversation.
No system is completely secure, and a policy that promised otherwise would be lying. What we promise is the standard of care required by art. 6, VII of the LGPD, and an honest warning if something goes wrong — which is the next section.
Section 12
If there is a security incident
A security incident means any unauthorised access to, or loss, alteration or leak of, personal data. If one occurs that could bring you relevant risk or harm:
- we notify the ANPD within three working days of learning that personal data was affected, as ANPD Resolution No. 15/2024 requires;
- we notify you within the same period, saying what happened, which data was affected, what we have already done and what you can do;
- we log the incident, fix the cause and review what allowed it to happen.
If you suspect a problem — an odd message in our name, a request for data that does not look like ours — write to contato@sitioalemdosonho.com.br. We check and reply.
Section 13
Your rights
The LGPD gives you nine rights over your data, and they all apply here — wherever you live, because the law follows the processing done in Brazil, not your passport. You need not justify a request, and you never pay for one.
- Know whether we hold data about you
- Confirmation that processing does (or does not) exist — art. 18, I.
- See the data
- Access to what we hold about you — art. 18, II.
- Correct it
- Incomplete, out-of-date or wrong data — art. 18, III.
- Delete, block or anonymise
- Anything unnecessary, excessive or handled outside the law — art. 18, IV.
- Take it with you
- Portability to another supplier, in a usable format — art. 18, V.
- Erase what was handled on consent
- Art. 18, VI, subject to the mandatory retention grounds in art. 16.
- Know who we shared it with
- The list of public and private entities that received your data — art. 18, VII.
- Know what happens if you say no
- Information about the option not to consent and about the consequences — art. 18, VIII.
- Withdraw consent
- At any time, free of charge, with the same effort that giving it cost — art. 18, IX, and art. 8, §5.
- Object to processing based on legitimate interest
- Wherever the legal basis is legitimate interest, you may object — art. 18, §2.
- Complain to the ANPD
- You may petition the Brazilian data protection authority directly. You do not have to come to us first — though we would appreciate the chance to fix it.
Section 14
How to exercise your rights
Write to contato@sitioalemdosonho.com.br with “Privacy” in the subject line and say what you want. Plain language is enough: “what data do you hold about me?”, “please delete my data”, “please correct my email address”. Portuguese and English are both fine.
What helps us resolve it quickly
- The phone number or email you used when you contacted us — that is how we find your record.
- Which of the rights in section 13 you are exercising.
- Roughly when the contact happened, if you remember. Not required; it just helps.
How we confirm it is you
Before handing over or deleting anything, we need to be sure the request is yours — protecting your data includes not giving it to someone impersonating you. Usually it is enough that the request comes from the email address or phone number on your record. Where it does not, we may ask for one further confirmation, always the simplest one that settles the matter.
Deadlines
- Immediately, in simplified form, confirmation of whether processing exists.
- Within 15 days, the full statement, including the origin of the data and the criteria and purpose of the processing (art. 19, II).
- Correction and deletion requests are handled as fast as we can, and you are told once it is done.
All of this is free. If in some case we cannot comply — for example where the law obliges us to keep a tax record — we explain the reason and the legal basis, in writing.
Section 15
The data protection officer
The encarregado, Brazil’s equivalent of a data protection officer, is the person who sits between you, the company and the ANPD. The LGPD requires the identity and contact details of that person to be published clearly, preferably on the controller’s website — art. 41, §1.
- Encarregado
- Data protection lead, Além do Sonho Eventos
- (21) 96892-8133
Write with “Privacy” in the subject line: it reaches whoever answers for this, and section 14 sets out how quickly we reply.
Section 16
Children and teenagers
This site and our customer service are meant for people over 18: whoever books an events venue is an adult. We do not intentionally collect data from children or teenagers, and we do not ask anyone’s age.
At a children’s party or a fifteenth-birthday celebration the event belongs to the child, but the record belongs to whoever books it. If you tell us the name or age of the guest of honour so that we can prepare the proposal, we use it for that alone, in their best interest, and for the periods in section 10.
If a parent or guardian realises that a child has sent us data, write to contato@sitioalemdosonho.com.br: we delete it as soon as we confirm it.
Section 17
Links to third-party sites
This site takes you to places that are not ours: our Instagram profile, a video on YouTube, a Google map, WhatsApp. The moment you click, you enter a service with its own policy, collecting data on its own account and under its own rules.
We are careful about what we embed — the YouTube video loads only when you press play, and the chat downloads only when you open it. But after the click the destination service is the one answering, and its policy is worth reading.
Section 18
Changes to this policy
This policy changes when our operation changes: a new tool, a new supplier, a new purpose. When that happens:
- we publish the new version here, with an updated number and effective date;
- a summary of what changed sits at the top of the page, beside the date;
- if the change introduces a new purpose that depends on consent, the banner reappears so that you can decide again. Consent given for one purpose does not carry over to another.
Version history
| Version | Effective from | What changed |
|---|---|---|
| 1.1 | Identifies the controller (company name, CNPJ and registered office), names the CRM and the voice-note transcription service, sets the four retention periods that were open and publishes the data protection contact. | |
| 1.0 | First version. Documents cookieless audience measurement before consent, the virtual assistant on WhatsApp, and the international transfer to the United States. |
Section 19
Governing law and jurisdiction
This policy is governed by Brazilian law — in particular Lei nº 13.709/2018 (the LGPD), Lei nº 12.965/2014 (the Brazilian Internet Act) and the Consumer Protection Code, together with the resolutions of the ANPD. That is so wherever you happen to live: the venue, the company and the processing are in Brazil.
The courts of Rio de Janeiro are the agreed forum for any dispute arising from this policy, without prejudice to a consumer’s right to sue where they live.
Questions about any of this? Write to contato@sitioalemdosonho.com.br. If you would rather come and see the place, start at the visit page.
Written by Thatiane Pacobahyba, of the Além do Sonho Eventos team.Updated on .
