privacy policy

We do not use any type of solely automated decision-making that affects your interests.

How we share data

Data-sharing scenarios.  The Data processed and activity records (logs) may be shared:

• (I) With our suppliers and business partners, with whom we have entered into contractual obligations concerning the security and protection of personal data. Suppliers include data hosting and server companies; security companies, such as the company responsible for managing the whistleblowing channel; and the payment service provider responsible for processing payments for reservations made through the Site and Application;
• (II) With competent judicial, administrative or governmental authorities whenever required by law or pursuant to a legal requirement, request or order;
• (III) With the companies that make up the Economic Group to which GRUPO WISH belongs, always in accordance with the guidelines of this Policy;
• (IV) With service providers or partner companies, to facilitate, provide or perform activities related to our environments;
• (V) With marketing and advertising companies, to deliver promotions and information suited to your profile and;
• (VI) Automatically, in the event of corporate transactions such as a merger, acquisition or incorporation of GRUPO WISH.

If you have any questions about with whom we share your Data, please contact us through the Customer Service Channels provided at the end of this Policy. 

Data Anonymization. For the purposes of market intelligence research, sharing information with the press and carrying out advertising activities, the Data will be shared in anonymized form so that you cannot be identified.

How we protect your data and how you can protect it too  

Security and Governance Practices. To safeguard your privacy and protect your Data, we have a governance program that includes best practices, internal policies and procedures establishing organizational measures, training, educational initiatives, and mechanisms for supervising and mitigating risks related to the Processing of Personal Data.

Data access, proportionality and relevance. Internally, processed Data is accessed only by duly authorized professionals, in accordance with the principles of proportionality, necessity and relevance to our business objectives, as well as our commitment to confidentiality and protecting your privacy under this Policy. In the event of individual breaches or unauthorized access involving your Personal Data, we may, provided they cause you significant harm or risk and you agree, pursue direct settlement in accordance with Article 52, Paragraph 7, of the Brazilian General Data Protection Law.

Password sharing. You are also responsible for keeping your Personal Data confidential and must always be aware that sharing passwords and access credentials violates this Policy and compromises the security of your Personal Data and the Site and Application.

Precautions You should take. It is very important that You take the necessary precautions against unauthorized access to your computer/smartphone, account or password, and always make sure to click “Log out” when ending your browsing session on a shared computer. GRUPO WISH never sends emails requesting confirmation of data or containing attachments that can be executed (extensions: .exe, .com, among others), or links to possible downloads. If you identify or become aware of a breach of the security of your Data, contact our Data Protection Officer through the Customer Service Channels provided at the end of this Policy. 

Information Security. All credit card payment transactions are carried out using SSL (secure socket layer) technology, ensuring that your Personal Data is not unlawfully disclosed. In addition, this technology is intended to prevent information from being transmitted to or accessed by third parties. 

External links. When using the Site and Application, You may be directed via links to third-party platforms that may collect your information and have their own Data Processing Policy. You are responsible for reading the Privacy Policies of such third-party platforms and deciding whether to accept or reject them. We are not responsible for third parties’ Privacy Policies or for the content or services of any websites other than our own.

Processing by third parties under our direction. We carefully assess our partners and service providers and enter into contractual obligations with them regarding confidentiality, information security and Data protection, with the aim of protecting you.

Email communications. To optimize and improve our communications, when we send You an email, we may receive a notification when it is opened, provided this feature is available. Please remain vigilant, as emails are sent only from the domains “@grupowish.com” or “@exclusiveguest.com.

How we store your data and activity records (logs)

Storage location. The Data processed and activity records (logs) are stored in a secure, controlled environment, which may be on our servers located in Brazil or in an environment using cloud resources or servers (cloud computing), which may require your Data to be transferred and/or processed outside Brazil. These transfers involve only companies that demonstrate compliance with applicable laws, maintaining a level of compliance similar to or more rigorous than that required under Brazilian law.

Storage period. We store Data only for as long as necessary to fulfill the purposes for which it was processed or to comply with any legal or regulatory obligations or preserve rights.

Data disposal. Once the retention period has ended and there is no further legal need to retain the Data, it will be deleted using secure disposal methods or anonymized for statistical purposes.

What are your rights and how can you exercise them

Your basic rights. The Data belongs to you, and applicable law grants a range of rights relating to it, which you may exercise by submitting a request to our Data Protection Officer through the Customer Service Channel provided at the end of this Policy.

• (VII) Confirmation and access: you may request confirmation of the existence of Processing and access to your Data, including by requesting copies of records we hold about you;
• (VIII) Correction: you may request the correction of your Data if it is incomplete, inaccurate or out of date;
• (IX) Anonymization, blocking or deletion: you may request the anonymization of your Data so that it can no longer be linked to you, the blocking of your Data, temporarily suspending its Processing for certain purposes, or the deletion of your Data;
• (X) Data portability: you may request that we provide your Data in a structured, interoperable format for transfer to a third party, subject to our intellectual property rights or trade secrets;
• (XI) Information about sharing: you may request information about third parties with whom we share your Data, limited to information that does not infringe our intellectual property or trade secrets;
• (XII) Withdrawal of consent: you may choose to withdraw your consent for any purpose to which you have consented. This withdrawal will not affect the lawfulness of any Processing carried out previously. If you withdraw your consent for purposes essential to the proper operation of our environments and services, they may become unavailable to you;
• (XII) Objection: you may object to the Processing of your Data if you do not agree with a particular purpose;
• (XIV) Review: in the event of decisions based solely on automated processing, you may request a review of the decision, identifying any interests that may have been affected.

Request. For your security, whenever you submit a request to exercise your rights, we may ask for additional information to verify your identity and prevent fraud.

Requests not fulfilled. We may decline to fulfill a request to exercise your rights if doing so would infringe our intellectual property or trade secrets, or where we are legally or regulatorily required to retain Data. We may also decline your request if we need to retain the Data to enable our defense or that of third parties in disputes of any kind.

Responses to requests. We undertake to respond to all requests within a reasonable period and always in accordance with applicable law.

Information about this policy

Changes and updates. You acknowledge our right to change this Policy at any time, according to its purpose or necessity. If significant updates are made to the Policy, you will be notified using the contact details you provide or through announcements on our official profiles.

Severability. If any provision of this Policy is deemed unenforceable by a Data Authority or court, the remaining provisions will remain in full force and effect.

Customer Service Channels. If you have any questions regarding the provisions of this Policy, including exercising your rights, you may contact our Data Protection Officer, who is available at the following addresses:

• Data Protection Officer: ESPALLARGAS, GONZALEZ, SAMPAIO – SOCIEDADE DE ADVOGADOS – ESG Advogados;
• Data Protection Officer appointed by EGS Advogados: Júlio Cesar Beltrão;
• Alternate Data Protection Officer appointed by EGS Advogados: Bruna Komoni;
• Mailing address: Av. Dra. Ruth Cardoso, 7815, CONJ 901, 1001 e 1002, São Paulo – SP;
• Contact email: lgpd@grupowish.com

Governing law. This Policy shall be interpreted in accordance with Brazilian law, in the Portuguese language.

Updated:  01/01/2025