Privacy notice

1. Who is responsible for your data

The hotel operator is responsible for the personal data processed in connection with this website and your enquiries:

AIOLOS HOTEL & DISCOVERIES LTDA
CNPJ: 47.637.922/0001-78
Rua das Dunas, s/n · Vila Preá
CEP 62.595-000 · Cruz – Ceará · Brazil

For privacy enquiries, contact Aiolos Hotel Reception at admaioloshotel@gmail.com.
Telephone / WhatsApp: +55 88 98215-5941.

2. Website access and hosting

The website is hosted by cyon AG, Brunngässlein 12, 4052 Basel, Switzerland. cyon identifies Basel as its data-centre location. Hosting is covered by the data-processing agreement included in cyon’s terms.

When you access the website, the server records, in particular, your IP address, date and time, requested URL, HTTP status, data volume, browser identifier and, where available, referring page. These logs support website delivery, fault diagnosis and security. By default, cyon deletes raw logs daily; the access data in them is no more than 24 hours old. Additional raw-log archives may be retained longer. This default period is therefore not a guarantee covering every log file stored in the hosting account.

For the time being, AWStats continues automatically generating statistics from hosting access logs. Monthly data containing full IP addresses has been identified for the HTTPS test address produktion.tasipusi.cyon.site. AWStats can analyse visits, requested pages, sources and technical access information, among other things. Under cyon’s default policy, this statistical data is retained without a fixed time limit until deletion. Automatic monthly deletion of these statistics is not guaranteed.

Aiolos has decided to stop using AWStats. The collection described above continues until technical deactivation. We do not state that it has already been disabled. Stopping collection and deleting existing data are separate operations. Deactivation does not automatically remove stored data. The legal requirements concerning purpose limitation, necessity and deletion continue to apply to that data.

Technically necessary connection, access and error logs remain separate from AWStats deactivation. cyon describes temporary storage for secure operation, without specifying one uniform retention period for every log category.

Further information: raw logs · AWStats · other logs.

3. Enquiries about stays, transfers and day trips

We use the information you send us, such as travel dates, guest numbers, preferred accommodation, journey details, flight information and your message, to respond to your enquiry and plan the requested service. If you are travelling with children, you may provide their ages so we can suggest suitable accommodation.

The forms prepare a message in your browser. They do not automatically send the information to the hotel or store it in a website database. The form entries are not saved permanently in cookies or browser storage either.

For stay enquiries, WhatsApp opens when you prepare the enquiry; for transfer and day-trip enquiries, it opens through the subsequent WhatsApp link. The prepared text is passed to wa.me as a URL parameter. WhatsApp therefore receives the text when it opens; the hotel receives your message only when you send it there.

4. Internal guest administration and documents

This section concerns hotel operations following contact or a booking. We use Desbravador Cloud for internal guest administration. Existing PDF identification copies are stored in Microsoft OneDrive through a personal Microsoft account. According to the hotel, reception staff have access. Desbravador is not integrated into this website as a booking system. Merely visiting the website does not send form entries or identification copies to either service.

Our internal policy does not provide for routinely retaining complete identification copies permanently. Retention requires a specific legal or operational need, checked and documented in advance, and a valid legal basis. A general possibility of a later police enquiry is insufficient. Where retention is necessary and permitted, a provisional internal maximum of twelve months after check-out applies, subject to overriding obligations. Copies must be deleted sooner if the need ends earlier.

Internal periods are distinct from configured automatic deletion and legally required guest registrations. They do not guarantee that all existing files have already been fully reviewed and cleared where appropriate.

Information about Microsoft’s processing is available in the Microsoft Privacy Statement.

5. WhatsApp and email

We use WhatsApp Business to communicate with guests. Using it is optional; you can also contact us by email. On WhatsApp, we receive your phone number, possibly your profile name, and the content you send. WhatsApp also processes data under its own policies.

Our contact mailbox uses Google’s Gmail service. We use your email address, message and any information you include to respond to your enquiry. If further details are needed to confirm a booking, we will discuss them with you.

See the WhatsApp Privacy Policy and the Google Privacy Policy.

6. Booking.com, social media and maps

Booking.com, Instagram, Facebook and map services are provided as external links. We do not automatically load booking widgets, social media feeds or maps when you visit a page.

Following one of these links takes you away from our website. The relevant service then processes information under its own terms. If you book through Booking.com, we receive the details needed to manage your reservation.

The rating and review selection displayed on the website are a dated snapshot stored with the site. Reading them does not create a live connection to Booking.com. See the Booking.com Privacy Statement.

7. YouTube film

The film’s cover image is served with the website. The YouTube player loads only after your explicit choice. This choice applies only to the open page and is not stored permanently.

Loading the player may send your IP address, device information and usage data to Google / YouTube. Data may be processed outside Brazil, including in the United States. The enhanced privacy mode does not mean anonymous use or that no data is processed.

You can disable the film to remove the player. This does not undo data already sent. See the Google Privacy Policy.

8. Cookies, fonts and analytics

The website uses no analytics or advertising-tracking scripts of its own. It has no shop, customer account or newsletter service. Fonts and images are supplied locally with the website; external font servers are not contacted.

The temporarily continuing server-side AWStats analysis and technical logs are described in section 2. No additional website analytics are planned. Metricool and social-media analytics tools are not embedded as website analytics.

When you deliberately open a third-party service or load the YouTube player, that service may use its own cookies or similar storage technologies. Section 7 explains the video choice.

9. Purposes, legal framework and recipients

Our offering is directed at Brazil and Switzerland. We take account of Brazil’s General Data Protection Law (LGPD) and Switzerland’s Federal Act on Data Protection (FADP/DSG) for circumstances with effects in Switzerland. We do not specifically target people in Germany or other EU countries. Whether the EU GDPR applies to a particular processing operation depends on its legal requirements; it is neither presumed solely because a German version is available nor ruled out generally.

Necessary enquiry handling, steps you request before entering into a contract and contract performance are based on Article 7 V LGPD. Specific legal or regulatory obligations fall under Article 7 II. Voluntary activation of the YouTube player is based on consent under Article 7 I. Necessary technical operation, security and the temporary hosting access analysis are addressed under legitimate interests pursuant to Article 7 IX, taking account of necessity and your rights. Consent to the film does not cover other purposes.

Under Swiss law, we observe in particular lawfulness, transparency, proportionality, purpose limitation and data security. Where justification is required, consent, overriding private interests, particularly in connection with a contract, or statutory provisions may be relevant depending on the processing.

Depending on the channel used, the hosting, communication, cloud or booking providers described receive data for their respective function. cyon supplies hosting; Gmail and WhatsApp enable communication; Desbravador supports internal guest administration; OneDrive provides the document storage described; YouTube supplies the deliberately loaded film; Booking.com handles reservations made on its platform. This does not assign one uniform contractual role to every provider. Their own privacy information applies to their own processing activities.

According to the hotel, we do not share guest data with drivers or day-trip or kite partners. Where a specifically applicable legal obligation requires disclosure, it is limited to the required data and legally designated recipients. No particular official reporting system or routine disclosure to a named authority is presented here as an existing procedure.

10. International processing and retention

The hotel processes data in Brazil; website hosting at cyon is located in Switzerland. The information below distinguishes website services deliberately used by visitors from internal hotel administration. It does not guarantee that all data is stored exclusively in one country.

Public website and external services: For people in Switzerland who choose to load the YouTube video, Google Ireland Limited in Ireland is generally responsible; processing in the United States is possible. Google privacy information. When you visit Booking.com, the platform operator is Booking.com B.V. in the Netherlands; reservation data reaches our hotel in Brazil. Booking.com privacy information. Simply visiting our website does not send guest documents to OneDrive or Desbravador.

WhatsApp Business: The app terms identify WhatsApp LLC in the United States, or WhatsApp Ireland Limited in Ireland for businesses in the European Region. They name the United States as a processing country. WhatsApp terms. WhatsApp’s Swiss–U.S. DPF disclosure covers data received in the United States under that framework in connection with services offered by WhatsApp Ireland; it does not establish blanket DPF coverage for the hotel’s Brazilian account. WhatsApp DPF disclosure.

Internal email and document processing: The Google account region generally determines the Gmail provider: Google LLC (United States), or Google Ireland Limited (Ireland) for Switzerland and the EEA. The account region does not guarantee a storage location. Google account region. For personal OneDrive, Microsoft specifically identifies the United States as a possible processing country. Its public terms do not confirm a storage region for our account. Microsoft privacy statement. Desbravador Cloud’s general policy does not identify the countries for our particular installation. Desbravador privacy information.

Protection for international disclosures: Ireland and the Netherlands appear on Switzerland’s list of countries with adequate protection. For United States recipients, recognition is limited to the scope of an applicable Swiss–U.S. DPF certification. Swiss adequacy list. Google LLC and Microsoft Corporation declare participation in the Swiss–U.S. Data Privacy Framework for covered transfers. Google transfer information; Microsoft transfer information. This does not guarantee that every internal data route or other country is covered. General provider information alone does not establish a complete account-specific list of countries and any necessary safeguards for internal cloud processing.

Aiolos has adopted the following internal retention and deletion rules as its policy. These periods are not statutory requirements or minimum retention periods. They do not justify keeping data without an ongoing purpose and a valid legal basis. Earlier deletion or anonymisation remains necessary where applicable.

Identification copies: as a rule, no permanent storage without a specific, previously checked need. Where retention is necessary and permitted, the provisional internal maximum is twelve months after check-out, subject to overriding obligations.

Booking enquiries that do not result in a reservation: an internal maximum of twelve months after the last contact.

General guest correspondence by email: an internal maximum of 24 months after check-out. Enquiries that do not result in a reservation follow the separate enquiry rule above.

WhatsApp conversations: an internal maximum of twelve months after check-out or, where there was no stay, after the last contact.

Working copies and operational guest lists: an internal maximum of 30 days after check-out. This concerns temporary working material, not original supporting documents or official guest registrations that must be retained.

Backups: the intended rolling retention window is generally 90 days, where technically feasible. The 90 days are a target for our internal backups. This is not a guarantee that data is already removed from every backup after 90 days.

Mandatory guest registrations, invoices and payment records: retention follows the Brazilian rules actually applicable to each record. No single internal period is presented as a statutory retention requirement for these records.

Legally required registrations and supporting records are separate from internal hotel copies. Our internal periods do not determine government retention or replace any reporting or retention obligations actually applicable.

Legal obligations and a specific need to preserve data for an ongoing complaint or dispute take precedence over the internal periods. Any exception must be limited to the necessary data, with its reason, legal basis and review date recorded. Once the reason ends, the need for continued retention must be reassessed.

The policy provides for a monthly review and a record of deletion. This does not postpone deletion that is already due. Recycle bins, version history, local copies and restoration must be considered; previously deleted data should not return to active use without appropriate controls after restoration.

These periods describe the internal retention policy we have adopted. They do not guarantee automatic deletion, complete removal by every provider or a completed review of existing files.

The internal 90-day target is separate from the website host’s backup periods. cyon states a maximum of two weeks for its daily backups. cyon backup information.

11. Your rights

Subject to applicable law, you may request confirmation and access to your data, correction, information about sharing, anonymisation, blocking or deletion where appropriate. You may also request portability, restriction of processing and objection under the applicable legal conditions, and withdraw consent for future processing.

Send your request to admaioloshotel@gmail.com. We may need proportionate proof of identity to protect your information. We will consider applicable obligations and the requirements for each right.

You may also contact Brazil’s National Data Protection Authority — ANPD or another competent supervisory authority.

For circumstances governed by Swiss law, you may exercise statutory access, correction and, where applicable, data delivery or transfer rights, and challenge unlawful processing. You may also contact Switzerland’s Federal Data Protection and Information Commissioner (FDPIC/EDÖB). Where the EU GDPR applies to an individual case, its rights are also available subject to their respective conditions.