Last updated: 15 June 2026
This Privacy Policy describes how the Hotel Restaurante platform collects, uses, stores, shares and protects the personal data of its users, in compliance with Law No. 13,709/2018 (the Brazilian General Data Protection Law — LGPD), the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014) and other applicable regulations. By accessing or using our services, you declare that you are aware of and agree to the practices described herein. We recommend that you read this document carefully together with our Terms of Use.
1. Who we are and who controls your data
Hotel Restaurante (https://www.hotelrestaurante.com.br) is a tourism classifieds platform that acts as an intermediary, connecting tourists and visitors with establishments such as hotels, guesthouses, restaurants, bars, parks, events and attractions.
The controller of the personal data, under the terms of Article 5, VI, of the LGPD, is the company Sobieski Produções e Desenvolvimento em TI Ltda., registered under CNPJ No. 43.810.141/0001-82, responsible for the decisions concerning the processing of personal data collected through the platform.
We reiterate that the platform is not a party to the transactions, bookings or appointments entered into between users and establishments, does not sell rooms, meals or its own products, and acts exclusively as a means of bringing parties together and publicising listings.
2. Data we collect
We collect different categories of personal data, depending on your interaction with the platform:
2.1. Registration data
- Full name, username and nickname;
- Email address and telephone number;
- Access password (stored in encrypted form);
- Date of birth and gender, where provided;
- Establishment identification data (company name, CNPJ, legal representative), where applicable.
2.2. Profile data and user-generated content
- Profile photo, biography, preferences and interests;
- Reviews, comments, photos, stories and published messages;
- Social interactions (friendships, matches, chat conversations);
- Menus, rooms, products and other information registered by establishments.
2.3. Usage and browsing data
- Search history, pages visited and establishments viewed;
- Clicks, dwell time and interaction patterns;
- Access records (logs), including date, time and IP address, as required by the Brazilian Civil Rights Framework for the Internet.
2.4. Device data
- Device type, operating system and version;
- Device, browser and language identifiers;
- IP address and connection data.
2.5. Location data
With your authorisation, we collect geolocation data (precise or approximate) to display nearby establishments, suggest relevant results and enable proximity-based features. You can disable location services in your device settings at any time.
2.6. Payment data
Payments for paid plans, listings and other services are processed by MercadoPago. The platform does not store complete credit card data. We receive only the information necessary to confirm and manage the transaction (status, payment identifier and billing data), with the processing of financial data also being governed by MercadoPago's privacy policy.
2.7. Cookies
We use cookies and similar technologies as detailed in Section 5 of this Policy.
3. How and why we use your data (purposes and legal bases)
We process your personal data for the purposes set out below, always based on one of the legal bases provided for in Article 7 of the LGPD:
| Purpose | Legal basis (LGPD) |
|---|---|
| Create and manage your account and profile | Performance of a contract (Art. 7, V) |
| Enable searches, bookings, appointments and contact with establishments | Performance of a contract (Art. 7, V) |
| Operate the social network, match, friends, chat and stories | Performance of a contract and consent (Art. 7, I and V) |
| Process payments for plans and listings via MercadoPago | Performance of a contract (Art. 7, V) |
| Send operational and security communications | Legitimate interest and performance of a contract (Art. 7, IX and V) |
| Send marketing communications, campaigns and news | Consent (Art. 7, I) |
| Operate CRM features for establishments (leads, campaigns, dispatches, reports) | Performance of a contract and legitimate interest (Art. 7, V and IX) |
| Prevent fraud and abuse and ensure platform security | Legitimate interest and compliance with a legal obligation (Art. 7, IX and II) |
| Retain access and connection records | Compliance with a legal obligation (Art. 7, II — Civil Rights Framework) |
| Improve services and generate statistics and metrics | Legitimate interest (Art. 7, IX) |
Where processing is based on consent, you may withdraw it at any time, without prejudice to the lawfulness of the processing carried out prior to the withdrawal.
4. Data sharing
We do not sell your personal data. Sharing occurs only in the following circumstances:
- Establishments: when you make a booking, appointment, review or contact, the necessary data (such as your name and contact information) is shared with the establishment in order to enable the service. The establishment acts as an independent controller of the data it receives.
- Payment processors: we share transaction data with MercadoPago to process payments.
- Service providers: hosting, cloud infrastructure, email delivery, analytics and support companies, which process the data on our behalf and under our instructions, in their capacity as processors.
- Public and judicial authorities: where there is a legal request, court order or for the regular exercise of rights.
- Corporate operations: in the event of a merger, acquisition or reorganisation, subject to compliance with this Policy.
5. Cookies and similar technologies
We use cookies to ensure the platform functions, remember preferences, maintain authenticated sessions, measure audience and personalise content and advertising. We use the following categories:
- Essential cookies: necessary for basic functioning and security (cannot be disabled);
- Performance and analytics cookies: help us understand how the platform is used;
- Functionality cookies: store language and personalisation preferences;
- Advertising cookies: assist in displaying relevant advertising.
You can manage or block cookies in your browser settings. Disabling certain cookies may affect your experience and the functioning of some features.
6. Rights of the data subject
Under the terms of Article 18 of the LGPD, you, as the data subject, have the right to:
- Confirm the existence of processing of your data;
- Access your personal data;
- Correct incomplete, inaccurate or outdated data;
- Anonymise, block or delete data that is unnecessary, excessive or processed in breach of the law;
- Request the portability of your data to another service provider;
- Delete data processed on the basis of consent, except in cases of legal retention;
- Obtain information about the entities with which we share your data;
- Be informed about the possibility of not providing consent and the consequences thereof;
- Withdraw your consent at any time;
- Object to processing carried out on the basis of other legal grounds, in the event of non-compliance with the LGPD.
To exercise your rights, please contact our Data Protection Officer at
7. Information security
We adopt appropriate technical and administrative measures to protect your data against unauthorised access, loss, alteration, destruction or any form of improper or unlawful processing. The measures adopted include password encryption, access control, monitoring, log keeping and the use of secure connections (HTTPS). Despite our efforts, no system is entirely immune to failures; in the event of a security incident that may cause significant risk or harm to data subjects, we will notify those affected and the National Data Protection Authority (ANPD), as required by the LGPD.
8. Data retention and deletion
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to the applicable legal and regulatory time limits. Application access records are retained for a minimum period of 6 (six) months, in accordance with Article 15 of the Brazilian Civil Rights Framework for the Internet. After the account is closed or the purposes have been fulfilled, the data will be deleted or anonymised, except for the retention necessary for compliance with a legal obligation, the regular exercise of rights in proceedings or in the other circumstances provided for in Article 16 of the LGPD.
9. International data transfers
Some of our service and infrastructure providers may be located in, or may process data outside, Brazil. In such cases, we adopt the safeguards provided for in Chapter V of the LGPD to ensure an adequate level of protection, including specific contractual clauses and verification that the recipient country or international organisation offers a level of protection compatible with Brazilian legislation.
10. Minors
The platform is not intended for persons under the age of 18. We do not knowingly collect data from minors without the specific and prominent consent of at least one parent or legal guardian, in accordance with Article 14 of the LGPD. Should we identify the registration of a minor without proper authorisation, we will take steps to delete the account and the corresponding data.
11. Data Protection Officer (DPO)
In compliance with Article 41 of the LGPD, we appoint as Data Protection Officer (DPO) Mr Jorge, who may be contacted at
12. Changes to this Policy
This Privacy Policy may be updated periodically to reflect legal, technical or operational changes. The current version will always be available on this page, indicating the date of the last update. Significant changes will be communicated through the appropriate channels. Continued use of the platform after the changes are published constitutes acceptance of the updated version.
13. Governing law and jurisdiction
This Policy is governed by the laws of the Federative Republic of Brazil. The courts of the Judicial District of São Paulo/SP are elected to settle any disputes arising from this Policy, with waiver of any other, however privileged, except for specific legal jurisdiction that guarantees the consumer the courts of their domicile.