Draft version. This document is an initial template and will be reviewed before the platform's commercial launch. Information in brackets is still to be defined.
Last updated: Sunday, October 18, 2026
1. Who is the data controller
This policy applies to the Seven Wonders Tours platform, operated by [company name to be defined], registered with the Brazilian National Registry of Legal Entities (CNPJ) under No. [tax ID to be defined], with its registered office at [address to be defined]. For the purposes of Law No. 13,709/2018 (Brazilian General Personal Data Protection Law — LGPD), Seven Wonders Tours is the controller of the personal data processed on the website.
2. What data we collect
We collect only the data needed for each purpose:
- Buyer: first name, last name, email, phone number with country code and country of residence.
- Visitors: only when the ticket requires individual visitor details — as applicable, full name, passport or ID number, nationality and date of birth.
- Order: tickets, dates, times, quantities, amounts, acceptance of the terms and the status of the order, payment and booking.
- Customer support: name, email, subject, order number (optional) and the content of the message sent through the contact form.
- Technical data: the IP address is processed temporarily for security purposes and to limit abusive requests; hosting providers may keep technical access logs.
Card details are neither collected nor stored by the site. They are entered and processed directly in the payment provider’s environment.
3. How we use the data
- To record and process the order and calculate the amounts due.
- To request the booking from the attractions’ management and the ticket suppliers.
- To make the tickets available and communicate changes in the order status.
- To provide customer support and reply to the messages sent.
- To prevent fraud, protect the platform and comply with legal and regulatory obligations.
4. Legal bases
- Performance of a contract and of preliminary procedures (Article 7, item V, of the LGPD): order, booking and tickets.
- Compliance with a legal or regulatory obligation (Article 7, item II): tax and accounting records.
- Regular exercise of rights (Article 7, item VI): defense in legal proceedings and complaints.
- Legitimate interest (Article 7, item IX): platform security and fraud prevention.
6. International data transfer
Six of the seven attractions are located outside Brazil (Christ the Redeemer is in Rio de Janeiro). To issue named tickets, visitors’ data may be sent to the site’s management or the supplier in the attraction’s country (China, Jordan, Peru, Mexico, Italy and India), to the extent necessary to perform the contract, pursuant to Article 33 of the LGPD.
7. Browser storage and cookies
- Cart: saved in your browser’s local storage (localStorage) so that it is not lost when the page is reloaded. It contains no personal data.
- Checkout in progress: buyer and visitor details are kept in session storage (sessionStorage) and deleted when the order is completed or the tab is closed.
- Order access: a signed technical cookie that cannot be accessed by scripts allows the order to be viewed in this browser for up to 120 days.
- Preferred language: when you choose a language or dismiss the language suggestion, your choice is saved in your browser’s local storage (localStorage). It contains no personal data.
- Reference currency: the currency you choose for approximate prices is saved in your browser’s local storage. It contains no personal data.
- Visit source: the parameters of the campaign that brought you to the site (for example, UTM parameters and ad click identifiers), the landing page and the referring site are saved in local storage for up to 90 days and recorded with your order, so that we can measure the results of our campaigns.
- Measurement and advertising: when measurement tools (such as Google Analytics or Google Ads, through Google Tag Manager) are active, analytics and advertising cookies are only used with your consent, which you can change at any time under “Cookie preferences” in the footer.
8. How long we keep data
Order data is kept for as long as necessary to comply with legal, tax and accounting obligations and for the regular exercise of rights [specific periods to be defined]. Customer support messages are kept for as long as necessary to resolve the request. Once these purposes have been fulfilled, the data is deleted or anonymized.
9. Your rights
Under Article 18 of the LGPD, you may request: confirmation of the existence of processing; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data; portability; information about data sharing; and review of automated decisions, where applicable.
To exercise your rights, contact our data protection officer at [data protection officer email to be defined] or through the contact page.
10. Security
We adopt technical and administrative measures to protect the data, such as encrypted connections, server-side data validation, order access via signed tokens, request rate limiting and restricted access to our systems. No system is completely immune to incidents; should one occur, we will take the measures required by law.
11. Children’s and adolescents’ data
When an attraction requires individual details of underage visitors, these are provided by the responsible adult who makes the purchase and processed solely to issue the ticket, in the best interests of the child or adolescent, in accordance with Article 14 of the LGPD.
12. Changes to this policy
This policy may be updated. The current version is always available on this page, together with the date of the last update. Orders record the version accepted at the time of purchase.