Who is responsible for processing
H3 Turismo & Rent a Car is responsible for decisions about processing personal data used in its services. This notice explains how data is used on the website, in bookings and customer service under Brazilian Law No. 13,709/2018 (General Personal Data Protection Law — LGPD).
For privacy questions or requests, use the data subject rights form or H3 customer service WhatsAppand mention that your enquiry concerns data protection.
What data we use
- Name, email, phone and city, provided when contacting us or booking.
- CPF requested at checkout, order details, tour, date, number of adults and children and notes provided by the customer.
- Payment amount, method and status, booking codes and transaction references.
- Technical browsing and security data, such as IP address, access logs and browser information, when recorded by the services used.
- Data provided in privacy requests and, when authorised, browsing information for analytics and advertising.
Card payments take place on PagBank's platform. H3's checkout does not request or store your full card number or security code (CVV). Avoid sending documents, health data or other sensitive information in booking notes or messages.
Why we use data and the legal bases
- Bookings and customer service: answer enquiries, create checkout sessions, record bookings, confirm payment and organise tours and pickups. Legal basis: performance of a contract or preliminary steps requested by the customer (Article 7, V).
- Legal obligations: keep records required by tax, accounting and other applicable obligations (Article 7, II).
- Defence of rights: process information needed to resolve complaints and exercise legal rights (Article 7, VI).
- Security: protect the website, identify faults and prevent misuse, assessing necessity and respecting data subject rights. Where applicable, legitimate interest (Articles 7, IX, and 10).
- Optional analytics and advertising: use trackers only with the visitor's consent (Article 7, I). Refusing does not prevent booking.
Reading this notice does not constitute general permission for any use of data. Each processing activity must respect its purpose and applicable legal basis.
Who we may share data with
We share information necessary for its purpose with PagBank to create and track payments; with hosting and database providers (Vercel and Supabase) to operate the website; and with the team and providers involved in customer service and delivering the booked services.
When booking notifications are enabled, contact details, tour, date, passengers, amount and status are sent to Telegram for monitoring by authorised H3 staff. When you request help through WhatsApp, conversation data is also processed by that service. Each provider has its own privacy rules.
Google and Meta tools, when configured and authorised by the visitor, may receive browsing information. Data may also be provided to authorities where required by law or a valid order.
Some providers may process data outside Brazil. In such cases, processing must follow the international transfer mechanisms and safeguards established by the LGPD and ANPD regulations.
How long we keep data
Data is kept as long as needed for customer service, fulfilling bookings, legal obligations and the defence of rights. Retention periods may vary by record type and purpose. Once no longer needed, data must be erased or anonymised, except where retention is permitted under Article 16 of the LGPD.
Security and access
The website uses a secure connection, authentication and access controls for the admin panel. Access to data must be limited to authorised people and operational needs. No system guarantees complete protection against incidents; any incidents must be assessed and handled under applicable law.
Cookies and preferences
The website uses local storage for features such as the cart and preferences; administrative access may use necessary session mechanisms. Optional analytics and advertising trackers remain disabled until the visitor gives consent.
You can accept or reject optional trackers below and change your choice at any time through the preferences link in the footer. Withdrawing consent reloads the website to stop new tracking events. Previously stored cookies can also be removed in your browser settings.
Your rights
Under the LGPD and depending on the circumstances, you may request confirmation of processing, access, correction, information about sharing, portability under applicable regulations, anonymisation, restriction or erasure of unnecessary, excessive or unlawfully processed data. You may also withdraw consent, request erasure of data processed with consent subject to legal exceptions, and object where applicable.
Requests are free of charge. H3 may request proportionate information to verify your identity and protect your data. Responses follow legal deadlines and conditions; erasure may be limited by retention obligations. You may also petition the ANPD as provided by law.
Children and teenagers
Bookings must be made by the responsible adult. Currently, the website requests the number of children to calculate the order. If other data about minors is needed to provide the service, processing must respect their best interests and the requirements of Article 14 of the LGPD.
Updates and legislation
This notice may be updated to reflect changes in services or applicable rules. The version date will appear on this page.