Privacy policy
This policy explains how Bandeira Park collects, uses and protects your personal data, in compliance with the LGPD (Brazilian General Data Protection Law — Lei Geral de Proteção de Dados, Law No. 13.709/2018). It applies to the bandeirapark.com.br website and the bandeirapark.online booking application.
Last updated: October 6, 2026.
Legal basis
Bandeira Park processes personal data in accordance with the LGPD (Law No. 13.709/2018). We process data on the basis of contract performance (your booking), compliance with legal obligations and legitimate interest (service improvement, audience and campaign measurement, and fraud prevention).
Data collected
Most personal data is collected by the booking application (bandeirapark.online) at the moment you book; this policy covers both addresses.
- Identification: name, e-mail and phone number.
- Vehicle: license plate, model and type.
- Payment: processed by Mercado Pago — card data is not stored by Bandeira Park.
- Browsing: IP address, device and pages visited.
- Corporate contact: company, CNPJ, contact name, e-mail, phone number, estimated monthly volume, locations of interest and message, when sent through the form on the Business page.
Purposes
We use your data to: process and manage bookings; communicate confirmations, changes and operational notices; answer corporate proposal requests; process payments; operate Clube Bandeira (counting stays and redeeming the free 6th stay); produce site usage analytics; and comply with legal and regulatory obligations.
Technologies we use
Google Tag Manager and Google Analytics 4 load on every page, with the analytics and marketing tags; the cookie policy explains how to block them in your browser. Payment is processed by Mercado Pago in the booking application. The site has no database and no login area: the details sent through the business form go by e-mail to our call center (atendimento@bandeirapark.com.br), sent through Resend, and are not kept on the site. Embedded third-party features, such as Google Maps and YouTube videos, may set their own cookies when loaded.
Sharing
We do not sell or rent your personal data. Sharing is limited to the sub-processors required for our operation: Mercado Pago (payment processing), Google (analytics tools and infrastructure), Resend (sending the e-mails from the business form) and Vercel (website hosting). Data may also be shared to comply with a legal obligation or an order from a competent authority.
Your rights (LGPD)
The LGPD guarantees you, as the data subject, the rights to confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and withdrawal of consent.
To exercise them, send your request to atendimento@bandeirapark.com.br. Requests are answered within the statutory deadline.
Data Protection Officer (DPO)
The contact channel for Bandeira Park's personal data protection officer is atendimento@bandeirapark.com.br.
See also
Frequently asked questions about privacy
What data does Bandeira Park collect when I book?
Identification data (name, e-mail and phone) and vehicle data (license plate, model and type). Payment is processed by Mercado Pago — card details are not stored by Bandeira Park.
Is my data shared with third parties?
It is not sold or rented. Sharing is limited to the sub-processors needed to run the operation (such as the payment processor), as described in this policy.
How do I request deletion of my data (LGPD)?
Send your request to atendimento@bandeirapark.com.br. The LGPD (Law No. 13.709/2018) guarantees the rights of access, correction and deletion, and requests are answered within the legal deadline.
Questions about your data?
Write to atendimento@bandeirapark.com.br — we reply within the statutory deadline set by the LGPD.