Privacy Policy

Last updated: September 2026

HotelTI respects your privacy and is committed to protecting your personal data. This policy explains what data we collect, how we use it and what your rights are, in line with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018).

This is an English translation of our Política de Privacidade. If the two versions differ, the Portuguese version prevails.

---

1. Who we are

HotelTI specialises in IT, technology and cybersecurity for hotels and resorts in Brazil. For any questions about this policy or about how your data is processed, contact our privacy channel, handled by our data protection officer (encarregado), Ryland Deakin: privacidade@hotelti.com.br.

2. Data we collect

We only collect the data needed for each stated purpose:

• Browsing data (with your consent): when you accept analytics cookies, we collect aggregated information about the pages visited, session length and traffic source through Google Analytics 4, linked to a pseudonymous client identifier, not to your name or other data that identifies you directly.
• Website forms: on the contact form, we collect your name, email, hotel or company, the topic and type of operation you select, and your message. On the checklist download forms, we collect your name, email and hotel. On the cybersecurity self-assessment, we collect your name, email and hotel, plus your answers to the questions and the calculated result.
• Email and WhatsApp: when you contact us at info@hotelti.com.br or on WhatsApp, we receive your email address or phone number and the content of your message, in order to reply to your request.
• Interactive checklist: your progress on the interactive checklist is saved only in your browser (localStorage) and is not sent to us.
• Technical data: like any website, our servers automatically log IP address, browser type and time of access for security and operational integrity. These logs are kept for no more than 90 days.

3. How we use your data

• Website analytics: to understand how visitors interact with the content and improve the experience, only with your prior consent.
• Responding to you: to reply to messages sent through the forms, by email or on WhatsApp, and to send the materials you request. Legal basis: steps taken at your request prior to a contract, or legitimate interest.
• Security: to detect and prevent unauthorised access. Legal basis: legitimate interest.

4. Cookies

We use three categories of cookies:

• Strictly necessary: essential for the website to work. They cannot be switched off and do not require consent.
• Analytics: Google Analytics 4, to measure use of the site in aggregate, using a pseudonymous identifier that does not reveal your name. Only enabled after your explicit consent.
• Functional: remember preferences such as the interface theme. Only enabled after your consent.

You can manage your cookie preferences at any time through the Cookie Settings link in the site footer.

5. Sharing your data

We do not sell or rent your personal data. We only share data with:

• Google LLC: for the Google Analytics 4 service, when you consent to analytics cookies. Google processes data under its Privacy Policy.
• Cloudflare, Inc., our hosting and content delivery network provider, which may process traffic data to keep the site secure and available.
• Web3Forms: a form delivery service that receives the data entered in the website forms and forwards it to our email.
• WhatsApp (Meta Platforms): when you choose to contact us through this channel, the conversation is subject to WhatsApp's terms and privacy policy.

6. International data transfers

Google Analytics may transfer browsing data to servers in the United States. Google uses standard contractual clauses and other safeguards recognised by the LGPD for these transfers. Cloudflare, Web3Forms and WhatsApp may also process data on servers outside Brazil.

7. How long we keep your data

• Google Analytics data: kept for 14 months on the Google platform and then deleted automatically.
• Messages received (forms, email and WhatsApp): kept for as long as needed to respond to your request, and for up to 2 years as a historical record.
• Server logs: deleted after 90 days.
• Cookie preferences and interactive checklist progress (localStorage): remain on your device until you clear them or withdraw consent.

8. Your rights (LGPD, Article 18)

As a data subject, you have the following rights:

• Confirmation and access: to know whether we process your data and obtain a copy.
• Correction: to have incomplete or inaccurate data updated.
• Deletion: to have data processed on the basis of consent deleted.
• Portability: to receive your data in a structured format.
• Withdrawal of consent: to withdraw consent at any time, without affecting processing already carried out.
• Objection: to object to processing carried out on the basis of legitimate interest.
• Information about sharing: to know which organisations your data is shared with.

To exercise any of these rights, email privacidade@hotelti.com.br with the subject "LGPD rights". We will reply within 15 days, the period set in Article 19 of the LGPD.

9. Security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction, including encrypted connections (HTTPS), HTTP security headers and periodic access reviews.

10. Changes to this policy

We may update this policy from time to time. The date of the last update is always shown at the top of the page. Significant changes will be highlighted on the site.

11. Contact

Questions, requests or complaints about how your data is processed can be sent to our data protection officer, Ryland Deakin, at privacidade@hotelti.com.br. You can also file a complaint with Brazil's National Data Protection Authority (ANPD) at www.gov.br/anpd.