Last updated: [date of approval]
This policy explains how Duke Beach Hotel & SPA handles personal data when you visit dukebeach.com or contact us through it. It applies to this website. Your stay at the hotel, and any booking made through a third-party channel, is covered by the terms you receive at the time of booking.
Who is responsible for your data
The controller of your personal data is [legal entity name], CNPJ [number], operating as Duke Beach Hotel & SPA, Avenida Dr. Francisco Loup, 539, Maresias, São Sebastião – SP, Brazil.
Data protection officer (Encarregado, under Brazil’s LGPD): [name], [email].
For any privacy request, write to [privacy email] or to reservas@dukebeach.com.br.
What this website collects
When you browse. The site does not use cookies, advertising pixels or any technology that identifies or follows you across visits or sites. Fonts and videos are served from our own domain.
Like any website, the servers that deliver it receive technical data with each request: your IP address, the page requested, the date and time, your browser and device type, and the page that sent you here. This data is processed by our hosting provider, Cloudflare, to deliver the site and protect it against abuse, and is not used to identify or profile you.
To understand how the site is used, we use Cloudflare Web Analytics, a cookieless measurement service. A small script from Cloudflare records aggregated data about each page view, such as the page, the referring site, the country, the device type and loading times. It does not set cookies, does not use local storage or fingerprinting, and does not identify individual visitors.
When you contact us. The “Check availability” bar and the contact details on the site open your own email app, phone or WhatsApp. We receive the information you choose to send, such as your name, email address, phone number, travel dates and number of guests, and any message you write.
When you book. Online booking, when available on this site, is provided by our booking engine provider on its own secure pages. The data you enter there is used to process your reservation and is covered by the notice shown on those pages.
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Delivering the website and keeping it secure | Our legitimate interest in operating a safe website (GDPR art. 6(1)(f); LGPD art. 7, IX) |
| Measuring visits in aggregate to improve the site (Cloudflare Web Analytics) | Our legitimate interest in understanding how the site is used, with no cookies and no individual profiles (GDPR art. 6(1)(f); LGPD art. 7, IX) |
| Answering your questions and quotes, and handling your reservation request | Steps you ask us to take before a contract, and performing that contract (GDPR art. 6(1)(b); LGPD art. 7, V) |
| Meeting legal and tax obligations, such as guest registration required by Brazilian law | Legal obligation (GDPR art. 6(1)(c); LGPD art. 7, II) |
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We do not use it for automated decisions that have legal or similarly significant effects on you.
Who processes it for us
- Cloudflare, Inc. — hosting, content delivery, security and cookieless audience measurement (Web Analytics) of this website.
- Our email, phone and messaging providers — to receive and answer your messages.
- Our booking engine and hotel management systems — to handle reservations.
- Public authorities — when Brazilian law requires it.
Each provider processes data on our instructions and for these purposes.
International transfers
Duke Beach Hotel & SPA is in Brazil, and some of our providers, including Cloudflare, operate servers in other countries, including the United States. When personal data from the European Economic Area, the United Kingdom or Brazil is transferred abroad, we rely on the safeguards the law provides, such as the European Commission’s Standard Contractual Clauses and the instruments recognized by Brazil’s data protection authority (ANPD).
How long we keep it
- Technical request data at our hosting provider: for the short period the provider needs to deliver and secure the site.
- Messages and reservation requests: for as long as needed to answer you and handle your stay, and afterwards for the periods required by Brazilian tax and consumer law.
Your rights
Depending on where you live, you can ask us to:
- confirm whether we hold data about you and give you a copy;
- correct data that is wrong or incomplete;
- delete data, or restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent, where we rely on it.
In the European Economic Area and the United Kingdom, these rights come from the GDPR and UK GDPR, and you may also complain to your local data protection authority.
In Brazil, these rights come from the LGPD (Law 13,709/2018), and you may also petition the ANPD.
In US states with privacy laws, such as California, you have the right to know, delete and correct personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those laws define it.
To make a request, write to [privacy email]. We will answer within the time the applicable law sets, and may ask you to confirm your identity before answering.
Children
Duke Beach Hotel & SPA is an adults-only hotel, and this website is not directed at children. We do not knowingly collect data from anyone under 16.
Security
We protect the site with encrypted connections (HTTPS), security headers and access controls at our providers. No system connected to the internet is free of risk, so please do not send payment card details by email or messaging apps.
Changes to this policy
If the way the site handles data changes, for example if we add advertising measurement with a consent banner or online booking, we will update this page and the date at the top before the change takes effect.
See also our Cookie Policy.