Privacy Policy

Politics of Privacy and Personal Data Protection

Hotel Tarobá and companies of the Tarobá Group

INITIAL PROVISIONS

Art. 1º This policy establishes the guidelines and standards for conducting activities involving the processing and guaranteeing the privacy and protection of Personal Data, that is, data from natural persons (“Holders”, “You” or “Clients”) with whom the Tarobá Group has a relationship to carry out its business/commercial activities.

• 1 ºAll activities related to the Tarobá Group's business, whether online or in physical establishments, that deal with Personal Data are guided by this policy, which aims to protect the fundamental rights of freedom and privacy and the free development of personality of the natural person.

• 2 ºThe companies that make up the Tarobá Group can be found on the following website: https://www.grupotaroba.com.br/

• 3ºThis Privacy and Data Protection Policy will also apply to Customers who, although they have not contracted directly, take advantage of any of the Tarobá Group's services.

CHAPTER I

Processing of Personal Data

Art. 2º The processing of data collected by Grupo Tarobá, with reference to the General Data Protection Law and other relevant regulations, will be governed by the provisions of this Policy.

Art. 3º According to the General Data Protection Law, the principles of processing personal data are:

1. I. Suitability of the activity;
2. II. Need for data collection;

III. Transparency in data processing;

1. IV. Free access for consultation by data subjects;
2. V. Data quality, guaranteeing data subjects clarity in processing;
3. VI. Safety in collection, treatment and storage;

VII. Incident prevention, avoiding violations of the General Data Protection Law;

VIII. Responsibility and accountability, by the Controller and Operator, regarding the processing of data;

1. IX. Non-discrimination in the use of data; It is
2. X. Purpose, justifying the processing of data.

CHAPTER II

Legal Definitions

Art. 4º For the purposes of this Policy, it is considered:

1. I. Personal data: information related to a natural, identified or identifiable person;
2. II.Sensitive data: personal data on racial or ethnic origin, religious conviction, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data, when linked to a person Natural;

III. Controller: natural or legal person, governed by public or private law, who is responsible for decisions regarding the processing of personal data;

1. IV. Operator: natural or legal person, governed by public or private law, who processes personal data on behalf of the Controller;
2. V. Person in charge: natural or legal person, under public or private law, responsible for acting as a communication channel with the National Data Protection Authority –

• Único. In the case of item V, the Controllers may act as Supervisors.

Art. 5º Within the perspective of the General Data Protection Law, Tarobá Group companies appear as Controllers and Persons in Charge of personal data, while their agents and service providers appear as Operators.

CHAPTER III

Collection and Use of Personal Data

Art. 6º Grupo Tarobá may collect, use and process Customers' personal data for the purposes described in this Privacy Policy. The types of personal data that will be processed by Grupo Tarobá may include:

1. Registration information:When registering, contacting or demonstrating interest in the services provided by Tarobá Group companies, the Customer will initially provide some registration data, such as full name, identification document number and/or passport number in the case of international travel, contact telephone number, email address, date of birth, gender, address, among other identification data necessary for the provision of services;
2. Additional information:To proceed with the contracting of some services, Grupo Tarobá may request additional data for subsequent formalization of the contract. Such data includes: scanning of identification document with signature (for example, ID or CNH), nationality, profession, position, among other data. As a rule, this data will only be collected from the Customer who is the owner of the registration and responsible for concluding the contract;

III. Payment processing and banking information: The Tarobá Group may work together with third-party online payment management companies to process purchases and the acquisition of products and services made by the Customer. In these cases, it is important that the Customer is aware that such companies may collect and store their information and data, including bank details and credit card details;

1. Information about other people:If the Customer contracts a package that also includes an escort, they must provide the necessary information and data so that Grupo Tarobá can also provide the services to the companion. In this case, the Customer must inform the other person that they will be sharing personal data with Grupo Tarobá, this treatment being subject to this Privacy Policy;
2. Supporting documentation in case ofand refund or review of fine:In the event of the occurrence of an event that prevents the Customer from benefiting from a service already contracted, it may be necessary for the Customer to share information and documents proving such an occurrence, which may reveal their own or third party's sensitive data. Such documents may include, but are not limited to, a health certificate, death certificate, birth certificate, among others, depending on the specific case. Any sensitive data will only be used to exercise rights under the contract signed between the companies of the Tarobá Group and the Customer, and such data will not be processed for other purposes;
3. Games, advertising and promotions: It will also be possible to collect personal information when the Holder participates in games, quizzes and other marketing actions promoted by Tarobá Group companies on our websites and/or third party websites;

VII. Customer service: If the Customer needs to contact the Customer Service department or the Data Protection area of ​​Grupo Tarobá, through chat, telephone calls and/or emails, new personal data necessary for the resolution may be requested and collected. of demand.

VIII. IP addresses, cookies and identifiers: When you visit our websites, we may automatically collect certain information from your computer or mobile device, such as session data, IP address, web browser software, referring website, dates and times of your interactions. Customer with the Tarobá Group Platform and geolocation. It will also be possible to collect information about your online activity, such as the content viewed, the pages visited and the searches or reservations that the Customer makes or has made.

Art. 7º Grupo Tarobá uses the personal data collected to:

1. Manage reservations/purchases, carry out transactions that have been initiated and process invoices or other tax documents related to the reservation/purchase.
2. Maintain the reservation history in the Tarobá Group databases;

III. Offer products and services, including through emails;

1. Manage requests and complaints, providing responses to questions and comments;
2. Compliance with legal obligations, cooperation with public bodies or for the exercise of any right provided for by law;
3. Send confirmations and updates about the trip/booking/purchase, as well as any other relevant information about the city of Foz do Iguaçu-PR and the tourist attractions of the triple border. This information may be sent via email, newsletter, SMS or WhatsApp, or another form of contact that the Customer has informed. These messages may contain information about the services of Tarobá Group companies, as well as contact details of service providers that could help the Customer's experience at the destination;

VII. Get in touch for the purpose of providing services to the Customer, carrying out opinion research, statistics or analyzes on consumption habits or preferences;

VIII. Notify the Customer by email about special offers;

1. IX. Use debit or credit card information (such as cardholder name, card number and expiration date) only for the purpose of completing reservations/purchases. It is possible for the Customer to choose the option to store certain card and invoice data, which will appear automatically when entering the Tarobá Group companies' website;
2. X. Use the Customer's personal data to: (i) process and fulfill the payment flow, (ii) guarantee the prevention of fraud and irregularities, the security of the holder, as well as protect and safeguard the security and integrity of the data.

CHAPTER IV

Of Consent

Art. 8º Taking into account the guidelines of the General Data Protection Law, to collect, process, share and delete personal data, it is necessary to obtain the consent of the data subject, except in the case of legitimate interest, as per art. 10, of the General Data Protection Law, when the activity, in itself, justifies the collection of information.

• OnlyConsent is the free, informed and unequivocal expression by which the Customer authorizes the Tarobá Group to process their data. Once consent has been given, the Customer will be aware of the provisions of this Privacy and Data Protection Policy, in addition to knowing their rights and how to exercise them.

CHAPTER V

Holders' Rights

Art. 9º The Tarobá Group assures its users/clients of their rights provided for in article 18 of the General Data Protection Law. In this way, the Customer can, free of charge and at any time:

1. Confirm the existence of data processing, in a simplified manner or in a clear and complete format;
2. Access your data, being able to request it in a legible copy in printed form or electronically, secure and suitable;

III. Correct your data, when requesting its editing, correction or updating;

1. Limit your data when unnecessary, excessive or treated in non-compliance with legislation through anonymization, blocking or deletion;
2. V. Delete your data processed with your consent, except in cases provided for by law;
3. V Revoke your consent, deauthorizing the processing of your data;

VII. Find out about the possibility of not providing your consent and the consequences of refusal.

• 1 ºThe Customer may unsubscribe from emails at any time. There is, in all emails that Grupo Tarobá sends, a link to unsubscribe available in the last lines. By clicking on this link, the Customer will be automatically removed from the list.

• 2 ºIt is important to mention that filling out any form again will result in your email being reinserted into the list. Therefore, the cancellation request must be made again if it is in your interest.

CHAPTER VI

From Sharing Data

Art. 10º Grupo Tarobá may share users' relevant personal data with service providers to manage their reservations and/or purchase requests.

• 1 ºBy accepting the terms of this Privacy and Data Protection Policy, the Customer acknowledges and agrees that Grupo Tarobá, as data controller, in accordance with applicable legislation, shares with financial institutions, their personal and transactional data, including their registration data and data on your reservations and/or purchase requests so that, together, they can provide greater security and prevent fraud and carry out credit risk analyzes and improve the service and products and services provided, always with strict observance of the legal principles and purposes.

• 2 ºAlso in compliance with the precepts mentioned above, due to its status as data controller, which is also done with the help of an internal system used for registration and management, the Tarobá Group will be able to provide access to the data collected by its employees, with the aim of providing an organized and satisfactory service.

• 3 ºGrupo Tarobá may also share personal data with commercial partners, with whom they may offer products or services jointly or individually. These service providers and commercial partners are subject to strict confidentiality contracts that prohibit the unauthorized use or disclosure of personal data to which they have access, as well as making it impossible for them to use your personal data in violation of the General Data Protection Law.

• 4 ºThere are also other hypotheses in which personal data may be shared, which are:

1. Legal determination, request, requisition or court order, with competent judicial, administrative or governmental authorities;
2. Case of corporate transactions, such as mergers, acquisitions and incorporations, automatically;

III. Protection of the rights of Tarobá Group companies in any type of conflict, safeguarding the fulfillment of established responsibilities, in the administrative and/or judicial spheres.

CHAPTER VII

Da Data Security

Art 11º To keep the personal information collected secure, Grupo Tarobá uses physical, electronic and managerial tools aimed at protecting privacy.

• 1 ºThe Tarobáse Group is committed to adopting the best postures to avoid security incidents. However, it is necessary to highlight that no virtual page and/or system is entirely safe and risk-free. It is possible that, despite all security protocols, problems that are solely the fault of third parties may occur, such as cyber attacks from hackers, or also as a result of the negligence or recklessness of the user/customer.

• 2 ºIn the event of security incidents that could generate significant risk or damage for any of our users/clients, the Tarobá Group will communicate to those affected and the National Data Protection Authority about what happened, in accordance with the provisions of the General Protection Law of Data.

Art. 11º The Tarobá Group is not responsible for:

1. Any consequences arising from the negligence, recklessness or incompetence of users in relation to their individual data.
2. Malicious actions by third parties, such as hacking attacks, hackers, unless culpable or deliberate conduct by the Tarobá Group is proven;

III. Inaccuracy of the information entered by the user/client in the records necessary to use the services of Tarobá Group companies. Any consequences arising from false information or information entered in bad faith are the sole responsibility of the user/client.

CHAPTER VIII

Da Validity

Art. 12º The personal data collected is essential for the adequate performance of the services provided by the companies that make up the Tarobá Group. Therefore, they will be stored for a period of 5 (five) years, counting from their respective collection.

FINAL DISPOSITIONS

Art 13º This Policy comes into force from … … 2022, and may be modified at any time, changes to which must be communicated to those entitled, as a way of ensuring adequate compliance with the General Data Protection Law.

Art 14º Grupo Tarobá is available to clarify any questions regarding the Privacy and Data Protection Policy at the following contacts:

Phone: + 55 45 2102 7770

Email: [email protected]

Address: Rua Tarobá, 1048, Centro, Foz do Iguaçu-PR, Brazil.