Privacy Policy

1. Who is responsible for your data

Iguassu ONE — a travel company registered in Brazil under CNPJ 67.277.484/0001-91, based in Foz do Iguaçu, Paraná, Brazil. We are the data controller: we decide what is collected and why.

Our tours are operated in Brazil and Argentina, and our team answers from Foz do Iguaçu. Because we are a Brazilian company processing data in Brazil, this policy is written under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018). We extend the same set of rights described in section 8 to every visitor, wherever you live, including travellers based in the European Union.

Questions, requests or complaints about your data: contato@iguassuone.com

2. What we collect

Information you give us

When you send the contact form or write to us on WhatsApp, we receive your name, email address, phone number and whatever you tell us about your trip — typically travel dates, number of travellers, ages of children, hotel and your questions. You choose what to write; only name, email, phone and a message are required.

Information collected automatically

Our server records the page you submitted from and your browser identification (user agent) with each enquiry, so we know which page generated the question and can reproduce display problems.

Your IP address is used only to limit abusive submissions (a few per address, per hour) and is never stored in our database. It exists in memory for that check and disappears.

Measurement cookies — only if you accept

The site works completely without them. Analytics and advertising scripts (Google Analytics and the Meta pixel) are not loaded and set no cookies until you press “Accept analytics” on the banner. If you decline, we remember the refusal so you are not asked again on every page — that is the only thing stored, in your own browser.

3. Why we use it, and under what legal basis

We do not sell your data, do not rent lists, and do not send marketing newsletters. If we ever start sending anything promotional, it will be opt-in and separate from this.

4. Who else touches your data

We use a small number of service providers, and only what the job requires reaches each one:

• Supabase — the database where your enquiry is stored.
• Vercel — hosting and delivery of this website.
• Resend — sends the internal notification email to our team when you submit the form. Its servers for this domain are located in Brazil (São Paulo).
• Meta (WhatsApp) — if you choose to talk to us on WhatsApp, that conversation happens inside Meta’s platform and is subject to their terms as well.
• Google Analytics and Meta pixel — measurement, loaded only after you accept.
• Attraction operators and park systems — when a ticket must be issued in your name, the data strictly needed for that ticket is passed to the operator.

Some of these providers store data on servers outside Brazil. When that happens, we rely on providers that offer contractual data-protection terms, and we share the minimum necessary.

5. How long we keep it

• Enquiries that do not become a trip: up to 24 months, then deleted. Travel plans repeat, and people often come back a year later referring to the earlier conversation.
• Confirmed trips: the tax and accounting records are kept for 5 years, as Brazilian law requires.
• Anything you ask us to delete: removed as described in section 8, except where the law obliges us to keep it.

6. Security

Access to the enquiry database is restricted to our team through credentials that are never published in the site’s code. The connection to this site is encrypted (HTTPS). No system is perfect, and we will not pretend otherwise — if a breach ever affects your data, we will tell you and the Brazilian authority (ANPD), as the law requires.

7. Children

This site is not directed at children, and we do not knowingly collect data directly from them. Children travel with us all the time — when you tell us a child’s age so we can price a ticket correctly, that information is provided by you, the responsible adult, and used only for the trip.

8. Your rights

You can exercise any of these at any time, free of charge, by writing to contato@iguassuone.com:

• Know whether we hold data about you, and get a copy of it.
• Correct anything incomplete or wrong.
• Delete your data — including everything we hold from an enquiry that did not become a trip.
• Withdraw consent for measurement, at any time, without affecting anything you already booked.
• Object to processing based on legitimate interest.
• Receive your data in a portable, machine-readable format.
• Know with whom we shared your data.

We answer within 15 days. We may need to confirm your identity first — that is to protect you, not to delay you. You also have the right to complain to the Brazilian data protection authority, the ANPD.

To withdraw analytics consent immediately, clear this site’s data in your browser: the banner will appear again and nothing is loaded until you decide.

9. Changes to this policy

If we change how we handle data, we update this page and the date at the top. The version you are reading is the one in force.