LGPD · Brazilian Law 13,709/2018
Privacy policy
This page explains, in plain language, what data the Grupo RARO website collects, what it is used for, who it is shared with and how you can exercise your rights.
Draft version of
Draft version. Grupo RARO has yet to confirm the controller’s legal name and CNPJ tax ID, the address, the data protection officer (DPO), the retention periods and the age rule for the forms. Wherever it says “to be confirmed”, that detail has not been provided yet.
Who looks after your data
The controller of the personal data processed on this website is Grupo RARO, based in Belo Horizonte, Brazil, which runs the RARO parties, Caza Raro, Raro Life Preá, Raro Club, brand activations and JARDIM. The company acting as controller (legal name, CNPJ tax ID and address) is still to be confirmed by Grupo RARO and will be listed here as soon as it is provided.
- Legal name
- to be confirmed
- CNPJ (company tax ID)
- to be confirmed
- Address
- to be confirmed
What we collect
We only collect what you type into the forms, plus a few technical details about where your visit came from. We never ask for ID documents, bank details or sensitive data (such as health, religion or political opinions); please don’t include them in your messages.
- Lista RARO
- name, the channel you choose (WhatsApp or email), your contact on that channel, city and interests. The other channel’s contact is neither asked for nor sent.
- Leaving Lista RARO
- only the channel (WhatsApp or email) and your contact on it, used solely to take you off the list.
- Brand activations
- name, company, job title, email, WhatsApp, brand or product, goal, RARO fronts of interest, budget range and message.
- Careers
- name, email, WhatsApp, city, area, type of work, portfolio or LinkedIn link and message.
- Promote RARO
- name, Instagram, WhatsApp, city, university or community, estimated reach and your introduction.
- Private events
- name, email, WhatsApp, type of event, preferred venue, number of guests, approximate date and message.
- Go with your crew
- chosen party and date, group size, occasion, name and WhatsApp.
- Contact and press
- name, email, company or media outlet, subject and message.
- Suppliers
- company, contact name, email, WhatsApp, city, main service, website or portfolio and the text about the company.
- Technical data sent with the form
- language, page, date and time and consent record (including the version of this policy).
- Where your visit came from
- the campaign parameters of the link you arrived with (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid), the landing page and the referring site, without parameters. The first and latest sources recorded in this browser over the last 90 days are sent along with them.
If you choose to reach us on WhatsApp, email or Instagram, we also receive whatever you send through those channels.
What we use it for
- To answer your request: a brand activation proposal, a private event quote, a group request for a party, a job application, a promoter application, a supplier registration, a press enquiry or a general message.
- To send you pre-sales and news, only if you ticked that option.
- To take you off Lista RARO when you ask.
- To understand, in aggregate, which channels and campaigns bring in contacts, so we can communicate better.
- To prevent spam and abuse of the forms.
We do not sell personal data and we do not make automated decisions about you based on it.
Legal bases
Each use relies on a legal basis set out in article 7 of the LGPD:
- Consent (art. 7, I): Lista RARO and news and pre-sale messages. You can withdraw it at any time; withdrawal applies from then on.
- Steps prior to a contract, at your request (art. 7, V): brand activation proposals, private events, group requests, supplier registrations and job applications.
- Compliance with a legal obligation (art. 7, II): handling requests to leave the list and your other rights as a data subject.
- Legitimate interest (art. 7, IX): answering general and press enquiries, measuring campaigns and keeping the forms secure, always within what you can reasonably expect and respecting your rights.
Who we share it with
Your data is accessed by the Grupo RARO team handling each request and by the providers that run the website on our behalf, only for these purposes:
- the form and spreadsheet provider (for example, Google Workspace or Netlify Forms), when set up;
- the website’s own database at Cloudflare (Cloudflare D1), when the site’s form receiver is switched on (to be confirmed by the controller); it does not keep your IP address, only a cryptographic digest (hash) of it, erased after 30 days, to stop automated submissions;
- a CRM or messaging tool (for example, RD Station or HubSpot), when set up;
- the website host, which processes technical access data such as your IP address to deliver the pages securely;
- public authorities, when required by law or court order.
Some of these providers store data outside Brazil. In those cases, the international transfer follows article 33 of the LGPD, with providers that offer contractual data protection safeguards.
When you use WhatsApp, Instagram, Vimeo or YouTube, those platforms’ own privacy policies also apply.
How long we keep it
- Lista RARO and news: until you ask to leave, or after 24 months without interaction.
- Brand proposals, private events, group requests, supplier registrations, contact and press: up to 24 months after the last contact. If it becomes a contract, the applicable legal retention periods apply.
- Job and promoter applications: up to 12 months.
- Requests to leave the list: only the channel and the contact, for as long as needed to make sure you get no more updates.
- Campaign parameters stored in your browser: 90 days.
After that, the data is deleted or anonymised.
Your rights
Under article 18 of the LGPD, you can ask at any time, free of charge, for:
- confirmation that we process your data;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
- portability of your data to another provider, under the ANPD’s regulations;
- deletion of data processed on the basis of your consent, except where article 16 applies;
- information about the public and private entities we share your data with;
- information about the option of not giving consent and the consequences of refusing;
- withdrawal of consent;
- objection to processing carried out on another legal basis, if it breaches the LGPD (art. 18, § 2).
To exercise these rights, contact our data protection officer (next section). You can also file a complaint with Brazil’s National Data Protection Authority (ANPD) (opens in a new tab).
To leave Lista RARO or stop receiving news, just reply STOP (or SAIR) on the channel where you received the message, ask through the site’s contact desk, or contact the data protection officer. The request applies from then on.
Data protection officer
Questions, requests and complaints about personal data go to our data protection officer (DPO):
- Data protection officer
- to be confirmed
- to be confirmed
Requests for confirmation and access are answered within 15 days, as set out in article 19 of the LGPD.
Security
The website uses an encrypted connection (HTTPS), and access to the data we receive is limited to the people who need it to reply to you. No system is 100% secure; if an incident could cause you significant risk or harm, we will notify the ANPD and the people affected, as the LGPD requires.
Minors
The forms on this website are intended for people aged 18 or over. If you are under 18, please do not send us your data.
Changes to this policy
We may update this policy to reflect changes to the website or the law. The effective date is shown at the top of this page, and significant changes will be announced here on the website.
Still have questions? Talk to Grupo RARO