Privacy Policy

• Personal Data: information relating to an identified or identifiable natural person.
• Sensitive Personal Data: data concerning racial or ethnic origin, religious belief, political opinion, trade union membership, health or sex life data, genetic or biometric data.
• Data Subject: the natural person to whom the personal data refers.
• Controller: the party responsible for decisions regarding the processing of personal data.
• Processor: the party that processes data on behalf of the controller.
• Data Protection Officer (DPO): the person appointed by the controller to act as a communication channel with data subjects and the ANPD.
• Processing: any operation carried out with personal data.

3.1. As CONTROLLER, when:

• collecting data from visitors to our corporate website;
• managing commercial leads;
• hiring and managing employees and suppliers;
• operating a direct relationship with end users (B2C, when applicable — e.g., a travel planning application).

3.2. As PROCESSOR, when processing personal data of guests and end users on behalf of its hotel clients (controllers), in accordance with contractual instructions and the applicable Data Processing Agreement (DPA).

4.1. Data provided directly by You:

• Full name;
• Corporate and/or personal email;
• Phone number;
• Company/hotel and job title;
• Content of messages sent via forms, chats, or emails.

4.2. Data collected automatically:

• IP address and approximate geolocation data;
• Browser type and version, operating system, device;
• Pages visited, time spent, clicks, scroll;
• Cookie, pixel, and similar technology identifiers;
• Access and activity logs.

4.3. Data processed in the Platform's operation (B2B – as Processor). When NeoTrip operates for hotel clients, it may process guest data, including:

• Name, email, phone, language;
• Conversation history with AI agents (website/WhatsApp);
• Stated preferences (room type, dates, number of guests);
• Transactional data related to pre-bookings and reservations;
• Data strictly necessary for processing, without collecting credit card information directly by NeoTrip, except when expressly contracted and with the adoption of PCI-DSS standards through an accredited payment gateway.

• Cloud infrastructure providers (e.g., AWS, Google Cloud), located in Brazil or abroad;
• Language model providers (Anthropic – Claude, Google – Gemini, OpenAI – ChatGPT), solely for processing conversational interactions, under contracts that prohibit the use of data for the providers' own training, wherever technically feasible;
• WhatsApp Business BSP partners (e.g., 360dialog, Meta), to enable WhatsApp integration;
• Hotel clients, in the case of end guest data, in accordance with the contracted purpose;
• Service providers (legal, accounting, anti-fraud, email marketing), under contractual confidentiality and security obligations;
• Public authorities, upon a duly grounded legal request;
• Acquirers or successors, in the event of corporate restructuring, merger, acquisition, or asset sale, while maintaining the original processing purpose.

7.2. Such transfers comply with Art. 33 of the LGPD, through:

• adoption of standard contractual clauses;
• ensuring a level of protection compatible with the LGPD;
• performance of a contract with the data subject or preliminary procedures;
• compliance with specific legally provided grounds.

8.1. Personal data will be retained for as long as necessary to fulfill its purposes, subject to the following minimum periods:

• Access logs: 6 (six) months (Art. 15 of the Internet Civil Rights Framework);
• Registration and contractual data: during the term of the contract and for up to 5 (five) years after its termination (civil statute of limitations – Art. 206, §5, I, Civil Code);
• Tax data: 5 (five) years (Art. 173, Tax Code);
• Employment data: up to 5 (five) years after termination.

You may, at any time, request:

• confirmation of the existence of processing;
• access to your data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data;
• data portability;
• deletion of data processed with your consent;
• information about data sharing;
• information about the possibility of withholding consent;
• revocation of consent;
• review of automated decisions that affect your interests (Art. 20 of the LGPD).

NeoTrip adopts technical and organizational measures consistent with the state of the art, including:

• encryption in transit (TLS 1.2+) and at rest;
• access control with least privilege;
• multi-factor authentication for administrative access;
• continuous monitoring, backups, and business continuity plans;
• periodic vulnerability testing and penetration tests;
• employee training;
• incident response policy with notification to the ANPD and data subjects, where applicable (Art. 48 of the LGPD).

13.1. NeoTrip may use your contact data to send marketing, relationship, and commercial nurturing communications, including:

• promotion of NeoTrip Platform products, services, modules, and features;
• newsletters, educational content, industry reports, and rich materials on hospitality, technology, and AI;
• invitations to events, webinars, workshops, and demonstrations;
• satisfaction surveys, NPS, and market studies;
• promotions, special commercial conditions, and offers aligned with the recipient's profile;
• institutional communications (product updates, news, success stories).

13.2. Applicable legal bases. Marketing communications will follow the appropriate legal basis according to context:

• Legitimate interest (Art. 7, IX of the LGPD), in B2B relationships with active clients, qualified leads, and professionals who have expressed interest in NeoTrip content, subject to a balancing test and respect for the data subject's legitimate expectations;
• Consent (Art. 7, I of the LGPD), free, informed, unambiguous, and granular, whenever the audience is B2C, the communication is outside a professional context, or when required by specific legislation.

13.4. Right to unsubscribe (opt-out). In all marketing communications sent, NeoTrip will provide:

• a functional, free, easy-to-access, and visible unsubscribe link, placed prominently;
• a simple mechanism requiring no more than one reasonable step to complete;
• a maximum period of 5 (five) business days to effectively remove the recipient from the marketing communications list, counted from the receipt of the request;
• confirmation of unsubscription, where technically feasible.

13.5. Effects of unsubscribing. Exercising the opt-out for marketing communications does not affect:

• the sending of transactional and operational communications essential to the performance of an ongoing contract (invoices, service alerts, security notifications, incident-related communications, contractual updates);
• the sending of communications required by law or a competent authority;
• other data processing carried out on a different legal basis.

13.8. Multi-channel communications. The provisions of this section apply to communications sent by email, SMS, WhatsApp, phone, push notifications, and other channels, subject to:

• the specific rules of the WhatsApp Business Policy regarding qualified opt-in;
• Meta's policies (WhatsApp Business Messaging Policy);
• any applicable sector-specific regulations.