Privacy Policy

We do not use any type of solely automated decision-making that affects your interests.

How we share data

Data Sharing Hypotheses. Processed Data and recorded activities (logs) may be shared:

• (I) With our suppliers and business partners, with whom we have entered into contractual obligations regarding the security and protection of personal data. Suppliers include data hosting and server companies; security companies, such as the company responsible for managing the whistleblower hotline; payment method companies, responsible for processing payments for reservations made on the Website and Application;
• (II) With competent judicial, administrative or governmental authorities, whenever there is a legal determination, request, requisition or order to that effect;
• (III) With the companies that make up the Economic Group to which the WISH GROUP belongs, always in compliance with the guidelines of this Policy;
• (IV) With service providers or partner companies, to facilitate, provide or carry out activities related to our environments;
• (V) With marketing and advertising companies, to deliver promotions and information appropriate to your profile and;
• (VI) Automatically, in the event of corporate transactions, such as merger, acquisition or incorporation of the WISH GROUP.

If you have any questions about who we share your Data with, please contact us through the Service Channels provided at the end of this Policy.

Data Anonymization. For the purposes of market intelligence research, press releases, and advertising, data will be shared anonymously, preventing your identification.

How we protect your data and how you can protect it too

Security and Governance Practices. To safeguard your privacy and protect your Data, we have a governance program that contains best practice rules, internal policies, and procedures. These establish organizational conditions, training, educational initiatives, and mechanisms for monitoring and mitigating risks related to the Processing of Personal Data.

Data Access, Proportionality, and Relevance. Internally, processed data is accessed only by duly authorized professionals, respecting the principles of proportionality, necessity, and relevance to our business objectives, in addition to the commitment to confidentiality and preservation of your privacy as per this Policy. In the event of individual leaks or unauthorized access to your Personal Data, we may, provided that these leaks pose significant harm or risk to you and you agree, promote direct conciliation under the terms of art. 52, § 7, of the General Personal Data Protection Law.

Password Sharing. You are also responsible for the confidentiality of your Personal Data and should always be aware that sharing passwords and access data violates this Policy and compromises the security of your Personal Data and the Website and Application.

Precautions You Should Take. It is very important that you take the necessary precautions against unauthorized access to your computer/smartphone, account, or password, and ensure that you always click "Log Out" when ending your browsing session on a shared computer. WISH GROUP never sends emails requesting data confirmation or containing executable attachments (extensions: .exe, .com, among others) or links to downloads. If you identify or become aware of a compromised security of your Data, please contact our Data Protection Officer through the Customer Service Channels provided at the end of this Policy.

Information Security. All credit card payment transactions are executed using SSL (secure socket layer) technology, ensuring that your Personal Data is not unlawfully disclosed. Furthermore, this technology prevents information from being transmitted to or accessed by third parties.

External Links. When using the Website and Application, you may be redirected, via links, to third-party platforms that may collect your information and have their own Data Processing Policies. It is your responsibility to read the Privacy Policies of such third-party platforms and accept or reject them. We are not responsible for the Privacy Policies of third parties or for the content or services of any websites other than our own.

Data processing by third parties under our guidelines. We carefully evaluate our partners and service providers and enter into contractual obligations with them regarding confidentiality, information security, and data protection, with the aim of protecting you.

Email Communication. To optimize and improve our communication, when we send you an email, we may receive a notification when it is opened, provided this option is available. Please note that emails are only sent from the "@grupowish.com" or "@exclusiveguest.com" domains.

How we store your data and activity logs

Storage location. Processed Data and activity logs are stored in a secure and controlled environment, which may be on our servers located in Brazil, as well as in a resource-using environment or cloud computing servers, which may require the transfer and/or processing of your Data outside of Brazil. These transfers only involve companies that demonstrate compliance with applicable laws, maintaining a level of compliance similar to or stricter than that required by Brazilian law.

Storage period. We store Data only for as long as necessary to fulfill the purposes for which it was processed or to comply with any legal or regulatory obligations or to preserve rights.

Data Disposal. After the retention period and legal requirement have expired, the Data will be deleted using secure disposal methods or used in an anonymized form for statistical purposes.

What are your rights and how to exercise them?

Your basic rights. The Data is yours, and applicable legislation provides a series of rights related to it, which you may exercise by submitting a request to our Data Protection Officer through the Customer Service Channel available at the end of this Policy.

• (VII) Confirmation and access: you may request confirmation about the existence of Processing and access to your Data, including by requesting copies of records we have about you;
• (VIII) Correction: you may request the correction of your Data that is incomplete, inaccurate or out of date;
• (IX) Anonymization, blocking or deletion: you may request the anonymization of your Data, so that they can no longer be related to you, the blocking of your Data, temporarily suspending the possibility of Processing for certain purposes, or the deletion of your Data;
• (X) Portability: you may request that we provide your Data in a structured and interoperable format for transfer to a third party, respecting our intellectual property or business secrets;
• (XI) Information about sharing: you may request information about third parties with whom we share your Data, limiting such disclosure to information that does not violate our intellectual property or trade secrets;
• (XII) Withdrawal of consent: You may choose to withdraw your consent for any purpose to which you have consented. This withdrawal will not affect the legality of any Processing previously performed. If you withdraw your consent for purposes essential to the proper functioning of our environments and services, these may become unavailable to you;
• (XII) Opposition: you may object to the Processing of your Data if you do not agree with any purpose;
• (XIV) Review: in the case of decisions based exclusively on automated processing, you may request a review of the decision, indicating your interests that may have been affected.

Request. For your security, whenever you submit a request to exercise your rights, we may request additional information to verify your identity, seeking to prevent fraud.

Failure to comply with requests. We may fail to comply with a request to exercise rights if such compliance violates our intellectual property or trade secrets, or if there is a legal or regulatory obligation to retain data. Furthermore, we may fail to comply with your request if we need to retain the data to enable our defense or that of third parties in disputes of any nature.

Responses to requests. We are committed to responding to all requests within a reasonable timeframe and always in compliance with applicable law.

Information about this policy

Changes to content and updates. You acknowledge our right to change the content of this Policy at any time, depending on the purpose or need. If there are any relevant updates to the Policy, you will be notified through the contact information you provide or by posting them on our official profiles.

Inapplicability. If any provision of this Policy is deemed unenforceable by a Data Authority or court, the remaining provisions will remain in full force and effect.

Service Channels. If you have any questions regarding the provisions of this Policy, including regarding the exercise of your rights, you may contact our Data Protection Officer, who is available at the following addresses:

• In charge: ESPALLARGAS, GONZALEZ, SAMPAIO – LAW FIRM – ESG Advogados;
• Responsible person appointed by EGS Advogados: Júlio Cesar Beltrão;
• Substitute Responsible appointed by EGS Advogados: Bruna Komoni;
• Address for correspondence: Av. Dra. Ruth Cardoso, 7815, CONJ 901, 1001 and 1002, São Paulo – SP;
• Contact email: lgpd@grupowish.com

Applicable Law. This Policy shall be interpreted in accordance with Brazilian law, in the Portuguese language.

Update: 01/01/2025