Bourbon Atibaia Convention & Spa Resort

NOMAD TRIPS DATA PROTECTION AND PRIVACY POLICY

This Data Protection and Privacy Policy ("Policy") intends to explain how Nomad uses Personal Data that has been provided by you (“User” or “Users”), our customer.

Nomad Trips acts as and intermediary for tourist products, and together with the affiliates of its economic group (together referred to as "Nomad"), and its Partners, will process your personal data collected during the use of our mobile applications, digital platforms, products, software, websites and general interaction channels (together referred to as “Service”), owned and offered by Nomad.

This Data Protection and Privacy Policy (“Policy”) was written considering the Brazilian General Data Protection Law guidelines and others international Data protection guidelines - such as GDPR. Therefore, all your data is processed for specific purposes and in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018) as will be described in this policy.

DEFINITIONS

To facilitate the understanding of this Policy, some important terms and its meaning adopted for this Policy were listed below:

1. Data Processing Agents: the controller and     processor of personal data, i.e., those who process your personal data, including Nomad, independent service providers, and business partners.
2. APP: software program developed by Nomad.
3. API: Application Programming Interface is the set of routines and programming patterns for accessing a software application or web-based platform.
4. Data Protection Authority (ANPD): is the regulatory body responsible for monitoring the compliance with the provisions of the Brazilian General Data Protection Law.
5. Online Chat: is an online communication tool/system that allows instant conversations between people.
6. Cookies: small text files or information fragments that are sent by the server to the Users’ browser, aiming to improve the quality of the services, the platform usability, and the storage of the Users’ preferences, making browsing more efficient and secure.
7. Controller: the natural or legal entity responsible for decisions regarding the treatment of personal data, which may be Nomad, independent service providers, Partners.
8. Personal data: covers all the information related to a natural person, which enables its identification (ex. name and surname, date and place of birth, ID, photograph).
9. Sensitive personal data: personal data concerning the racial or ethnic origin, religious conviction, political opinion, membership in a union or organization of a religious, philosophical, or political nature, data concerning health or sex life, genetic or biometric data.
10. GDPR: General Data Protection Regulation, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free circulation of such data.
11. Personal data security incidents: any and all unexpected events involving personal data or records that leads to unauthorized access and accidental or illicit situations of destruction, loss, alteration, communication or any form of inappropriate or illicit processing,, generating some kind of instability or can cause damage to Nomad and its clients.
12. LGPD: Brazilian Federal Law No. 13,709/18, which provides about the processing of personal data, including in digital media, by a natural person or legal entity governed by public or private law, with the aim of protecting the fundamental rights of freedom and privacy and the free development of the personality of the natural person.
13. Processor: natural or legal entity that acts jointly with the Controller in the data processing. The Processor acts by the Controller’s guidelines and carries out the processing on his behalf.
14. Partners: Independent companies that provide services to you, directly or indirectly through the website or with agreements signed with Nomad or its partners.
15. Data Processing: Is every operation performed with Personal Data (collection, access, evaluation, sharing, storage, deletion, etc.).
16. User(s): any natural person who: (i) register on the Nomad app or Nomad Trips’ website ; (ii) uses the services and products made available by Nomad Trips or its Partners; (iii) who contacts Nomad Trips through one of our service channels; (iv) access or browse our websites; (v) register to receive informative content or newsletters.

DATA PROCESSING

To achieve our goal of Travel with you around the world, we need to use your Personal Data. Any data processing is carried out by respecting your privacy, applying security controls, and being in compliance with the law. Below is a list of some of the purposes for which we may use your Personal Data:

1. To provide our service to you, such as intermediate air reservations, accommodation, tickets, cars, among others;
2. To enable the offering of advantages, benefits and third-party services to you, such as: discounts, cashback, and others;
3.  To verify and confirm your identity and your legal capacity;
4. Adopt measures to prevent and combat fraud and other legal measures, aiming to increase your protection and security by avoiding risks and preventing fraud against you;
5. To promote the protection and security of our users, products and services, and partners, as well as your protection;
6. To ensure the safety and security of Users and Partners;
7. Improve security and personal data protection procedures;
8. Search, analyze, develop and improve Users’ experience, usability, survey and interactivity when using our Site and application;
9. Send advertising communications or educative materials of Nomad or Partners, always assuring the possibility of objecting to the receipt of such communications;
10. Send content by email, newsletter, and other communications related to Nomad, and the User may, at any time, manifest its opposition by deactivating its sending;
11. Reply to doubts, suggestions, complaints, and requests from Users made through our Customer service channels; Support for the solution of problems or doubts presented;
12. Research and recommend services or products from our Partners that best fit your profile;
13. Complying with legal and regulatory obligations or with judicial or administrative determinations that fall upon Nomad;
14. To exercise the right of defense in administrative, judicial, or arbitration proceedings or to protect its rights or those of third parties related to Nomad;
15. Conduct satisfaction surveys regarding NomadTrips and/or its Partners;
16. When necessary, data may be processed for other purposes, with the consent of the Nomad user.

Furthermore, we detail below the Personal Data that may be collected and processed by Nomad as a result of the provision of products and Services made available by Nomad Trips and the purposes for which they might be processed:

Personal Data processing by Nomad

Personal Data  

Full name;     Individual Taxpayer Registration; Passport number; ID; Driver’s license number; birth date; Affiliation; Address; Gender; E-mail; Nationality; Telephone.

Purpose 

Customer registration; compliance with legal obligations from national and international regulators; fraud prevention; cardholder security; preliminary procedure related to a contract; execution of a contract.

Personal Data  

Identification document (ID, Driver’s license, Brazilian Individual Taxpayer  Registration, Passport); birth date; age; full name;telephone; cell phone; address.

Purpose

Data validation; fraud prevention; cardholder security. 

Personal Data  

Name; e-mail; phone number and Brazilian Individual Taxpayer  number.

Purpose 

Service and Support - including but not limited to the use of email and OnlineChat, as part of the compliance with a contractual obligation

Personal Data  

Name,email, l Taxpayer  number and purchases made on partner store websites and apps.

Purpose 

Offer of benefits, discounts or advantages through Partners.

Personal Data  

Name; e-mail; phone number; birth date; gender, photography, and testimony.

Purpose 

Satisfaction surveys, customer research and Marketing Campaigns (such as activations in forums, events and others).

Personal Data  

Geolocation.

Purpose

Fraud prevention; safety of the data subject; preliminary procedure related to a contract; execution of a contract; legitimate interest.

Data Obtained from Third Parties:

In order for you to be able to book travel for other people, you may be required to provide third parties personal data, ensuring that they are aware of the processing of their personal data. In this case, this personal data will be processed in accordance with this Privacy Policy.

Data collected automatically

Some data may be automatically processed when you use the Nomad APP, or our website (“Site”), such as your device information (hardware model, operating system version, unique device identifier, mobile network information,), IP address, your devices’ identifier numbers, device event information such as crashes, system activity, and hardware settings, and hardware settings, location preferences, timestamps, amount, details of the merchant or payee or ATM associated with your transactions, system settings information, among others.

We may also process data and information obtained through our own or third-party cookies.

DATA SHARING/DATA SHARE



We may share your data in the following situations or occasions:

• Nomad: We may share information with companies within the Nomad Group in order to enable and improve products and services available, and enable compliance with legal or regulatory obligations or contractual obligations.
• Partners/Independent Data Controllers: To provide travel intermediation services such as booking flights, accomodations, tickets, cars reservations, and others,, we rely on the assistance and grant various benefits, advantages or discounts to our Clients, together with Partners.
• Third Party Service Providers: we rely on third-party service providers who help us execute, operate, enhance and support our services and products and we require them to use the data we share following their purposes and the adoption of technical and organization security measures capable of protecting personal data. 
• Regulatory Bodies or Judicial or Administrative Authorities: we need to provide information to various regulatory bodies or competent authorities, ; and if they request to share personal data, we will be required to share it. 
• Protection of our Rights or Others’ Rights: We reserve the right to share any Personal Data necessary to comply with a legal obligation, to enforce and apply our Terms of Use, or to protect Nomad’s rights, our employees, Partners, and customers.

Any sharing of information is conducted within strict standards of security and confidentiality, as well as in compliance with the laws and regulations for the protection of personal data and privacy.

INTERNATIONAL DATA TRANSFER

Nomad Trips handles personal data following the legislation applicable to its activities, in addition to working with Partners located in other jurisdictions. Therefore, Nomad Trips carries out international data transfer and seeks to offer the same degree of protection required by the strictest applicable legislation regarding the protection of personal data, through the inclusion of Standard Contractual Clauses and/or the signing of International Data Transfer Agreements.

SECURITY MEASURES OR SAFEGUARDS

Nomad uses several security measures or safeguards to protect your data, with the purpose to ensure confidentiality, integrity, and availability, always in compliance with national and international security standards, best practices, legislation, and regulatory agencies. Your personal data is stored in our databases in encrypted form, in systems and cloud storage providers with high standards of security and protection. We also adopt a series of technical, administrative, and organizational security measures to prevent unauthorized access, destruction, loss, alteration, or any other form of irregular or illicit treatment, and we use tools to identify and prevent vulnerabilities in our systems. In addition to all this, our staff is highly qualified and we rely on periodic tests and updates on information security and cybersecurity so that everyone is able and aware to act in a preventive way, but also knows how to deal with eventual misfortunes. 

Personal data security incidents

In case of security incidents or violations with personal data that cause risk or relevant damage to data subjects, communication to the subject and the competent authorities will be carried out in accordance with the provisions of the LGPD and other applicable legislation.

Cautions you can take 

It is important that you help us by taking some security measures that can guarantee the secrecy and protection of your personal data:

✔ Use only the official Nomad channels to contact us;

✔ Keep your data updated on our webiste, this is important to ensure and prevent possible fraud;

✔ Always use secure passwords and change them regularly and never share them with others;

✔ Be aware of the origins of messages and links you receive and if you suspect something, contact us;

✔ Keep your computer and smartphone operating systems and antivirus always up to date;

✔ Use the official stores to download our application, always check the website address and be suspicious of incorrect writing or symbols in the middle of words;

✔ Carefully read the information contained in our official documents, such as this Privacy and Data Protection Policy, the Terms of Use, and other contracts that you enter into with us.

DATA LIFE CYCLE   

Your personal data will be kept in our database for as long as you continue to use our services. If you stop using our services, we may keep your personal data with us when we are required to do so by law, where there is a legitimate and lawful purpose for which we are authorized or required to keep it. If you come to request the deletion of your data, we will delete it, provided that there is no legal obligation or a request from a competent authority that requires its maintenance and that the purpose for which it was collected has been fulfilled.

RIGHTS OF THE DATA SUBJECT 

Ensuring your freedom is very important to us, and we therefore clearly and objectively set out what your rights are about privacy and data protection and how you can exercise them. 

1. Confirmation of the existence of processing of personal data and access to it: You can confirm with us whether we process any personal data on your behalf, and if so, request access to it by generating a copy.

2.    Right to rectification: It is very important to us that your data is correct and up to date. Thus, if you identify any incorrect, incomplete, or outdated data, please request the necessary rectifications.

3. Right to data portability: You have the right to request the portability of your personal information to another organization. 

4. Erasure, limitation, or anonymization of personal data: You have the right to request that we anonymize (anonymize), block, or permanently delete your data if it is unnecessary or excessive for processing, or if it is being processed in non-compliance with the LGPD or other applicable legislation. It is important to remember that we may have some legal obligations to keep your data with us, even in the face of a request for deletion, limitation or deletion.

5. Refusal and revocation of consent: if we request your consent, you have the right to know the consequences of your refusal and if you have already consented, you may revoke it.

6. Deletion of data: if any of your data is processed based on consent, you may request its deletion. 

7. Information about Data Sharing: We share your data with other companies and with Nomad, and you can request information about these shares. 

8. Review of Automated Decisions: You may request that decisions be made in an automated fashion that affect your rights be reviewed.

If you wish to exercise any of these rights, simply contact us via email: [email protected] 

MARKETING

Nomad Trips can send you information and advertisements about our products and services intermediated by her, and eventually, also from Partners. 

In addition, we may also use social media platforms such as Instagram, Facebook, Twitter and LinkedIn, among others, to display targeted advertising to you. These companies have interest-based advertising programs that allow us to target advertisements while these users are using the social media platform. While we may share some data with these platform providers, as described in the “Collected Data” chapter, these platforms may also collect information from visitors to our website via a first-party pixel. These activities are governed by the privacy policies of each of these social media companies.

But, remember that with us, you are in control and if you no longer wish to receive our emails with advertisements, simply click on "unsubscribe" at the end of the e-mail or send an e-mail to [email protected]. 

COOKIES OR SIMILAR TECHNOLOGIES

In Nomad Trips’ website, service providers may allocate cookies to perform analytical or marketing functions which you are notified of and can accept or reject their use. We do not control the use of these Third Party Cookies or the resulting information and are not responsible for any actions or policies of these third parties.

CHANGING OR BLOCKING COOKIES

You can at any time change the settings for the use of cookies, activating, deactivating, or removing them, by accessing the settings of your preferred browser.

• Internet Explorer 
• Microsoft Edge 
• Mozilla Firefox 
• Google Chrome 
• Safari
• Opera

Managing cookies on a smartphone or tablet can be done as follows:

• Android: go to the Google Chrome app and open the "Menu" option. Within that option, select "settings", and then "Site Cookies and Data". Once this is done, you will find and option to manage your cookies preferences.
• IOS: look for the "Settings" option and then go to the "Safari" tab. Once you’ve done that, locate the "Privacy and Security" option, where you can manage your preferences by selecting the "Block all cookies" option.

If you set your browser to refuse all cookies, the performance of some features of the APP or Nomad Trips’ website may be limited or not function properly.

DATA PROTECTION OF CHILDREN AND ADOLESCENTS

Our Website is not intended for persons under the age of 18. In other words, if you are considered a child or teenager, do not use our Website.

Any personal data collected from children and adolescents must be provided by their parents or guardians and must be exclusively for purchasing and booking travel services.

If you are aware that we may have mistakenly processed the data of a child or teenager, please contact us immediately at [email protected]  so that we can take all appropriate measures.

THIRD-PARTY WEBSITES AND THEIR PRIVACY AND DATA PROTECTION POLICIES

When using our services, you may be directed to other websites that are beyond our control. We may allow third-party websites or applications to link to our website, but we are not responsible for their privacy practices or their content, so it is important that you read their Privacy and Data Protection Policy and terms of use. Our Privacy and Data Protection Policy applies only to our services and Website.

HOW TO CONTACT US

If you have any questions about this Policy, the treatment of your collected data, or if you wish to exercise one of your data protection rights, please do not hesitate to contact us through the E-mail: [email protected]

You need to know that we may request some personal data and information to ensure that the exercise of rights is being carried out by you, preventing eventual improper or illegitimate requests. Should you wish to make a complaint about any of travel services we intermediated, please contact our support team via the Nomad official channels.

PRIVACY AND DATA PROTECTION POLICY UPDATE

Just like you, Nomad is constantly evolving, and whenever we must provide even more transparency about the treatment of your data or reflect changes in your business and practices, this Policy will be updated. 

But don’t worry, whenever there are changes in this policy you will be notified via email.

If you object to any change, you may terminate your account and refrain from using our Website, but if you agree to it, you can simply continue using the products and services offered by Nomad Trips’ Partners on the website.

This Privacy Policy was last updated on July, 2nd, 2024.