Privacy Policy
Last updated: October 28, 2026
1. Who we are
KEHL HOSPEDAGEM LTDA, trading as San Diego Flats, Brazilian company registry CNPJ 63.682.865/0001-03, Praça Santo Antônio, 174, first floor, Velha Boipeba, Cairu, Bahia, 45426-000, Brazil, operates this website and controls data processed directly for enquiries and accommodation. Privacy contact: sandiegoflats@gmail.com.
2. Scope and roles
This policy covers the institutional website, contact form and accommodation operation. Availability, booking and payment will be completed through the external Facility booking engine. Once you leave this site, Facility's and the payment provider's notices and terms also apply. Each provider is responsible for processing it determines; when acting on our behalf, it must follow applicable instructions and contract.
3. Data and purposes
We may process name, email, telephone, country, dates, guest count and message to answer questions, provide service and take pre-contractual steps. For a stay we may process identification, companions, booking, payment, preferences, communications, incidents and information required for Brazil's digital guest registration, to perform the contract and meet legal duties.
The site records first-party metrics without advertising cookies, an IP stored by the application or a persistent identifier: event type, page, language, referrer domain, campaign parameters and country supplied by the infrastructure. We use these aggregated signals to understand operation and interest under legitimate interest, following necessity, balancing and safeguards. Infrastructure providers may keep their own technical logs for security and legal compliance.
Calendar feeds may mirror occupied dates to avoid availability conflicts. Operational access is restricted and the public page receives only an aggregate count when all sources are healthy and recent.
4. Legal grounds
Depending on context we rely on pre-contractual steps and contract performance, legal obligations, establishment or defence of legal claims, protection of life, legitimate interests subject to necessity and balancing, or consent where legally required. We do not make accommodation conditional on unnecessary consent.
5. Sharing
As necessary, data may be shared with Facility and booking channels, payment providers, Supabase, Vercel, IT suppliers, accountants, authorities and providers indispensable to the stay. WhatsApp, maps and social networks receive data only when you choose to open or use their links. We do not sell personal data.
6. International transfers
Some providers may operate infrastructure outside Brazil. We require a valid legal ground and, where applicable, mechanisms under Brazil's LGPD and ANPD Resolution 19/2024, with compatible contractual and security safeguards.
7. Retention and deletion
We retain each category only while needed for its purpose, legal periods, fraud prevention and legal claims. We then delete or anonymise it unless the law authorises retention. Relevant incident records follow the regulatory period. Backups have their own cycle and progressive deletion.
8. Your rights
You may request confirmation and access, correction, anonymisation, restriction or deletion when applicable, portability under regulation, information about sharing and consent consequences, withdrawal, objection and review of automated decisions. Write to sandiegoflats@gmail.com. We may verify identity. A simplified response is immediate where possible; a complete statement follows the statutory period. You may also petition the ANPD and consumer authorities.
9. Children
Minors' data is processed only as needed for the stay, safety and registration duties, always in their best interests and with guardian involvement where required. The site is not directed to children.
10. Security and incidents
We use access controls, client/server separation, encryption in transit, change logs, backups and minimisation. No system is infallible. An incident capable of causing relevant risk or harm will be assessed, documented and notified to ANPD and affected people as required.
11. Updates
Material changes will appear here with a new date. The version in effect when a booking is made applies to it, without limiting statutory rights.
International visitors
The accommodation and contract are supplied in Brazil, but we honour mandatory foreign rules when applicable to processing or offers directed to residents there. People in the EEA, UK or Switzerland may, where applicable, exercise access, correction, erasure, restriction, portability, objection and local supervisory-authority complaint rights. Residents of US states with an applicable law may request access, correction, deletion and a copy and may opt out of sale, sharing or targeted advertising. We currently neither sell personal data nor use behavioural advertising. We do not discriminate for exercising rights. Before enabling ads or trackers, we will adopt prior blocking, choice and withdrawal controls, an appropriate CMP where required and Global Privacy Control support.