Protecting your personal data matters to us. This Privacy Policy explains which personal data we process when you visit oca-valhalla.com, send us an enquiry or book a stay, why we do so, and which rights you have. It is based on the EU General Data Protection Regulation (GDPR) and the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados – LGPD, Law No. 13.709/2018).
1. Controller
Giseli Blankenhorn & Christian Blankenhorn
Trading name: Oca Valhalla
XP2V+46 Iranduba, 69099-899 Manaus Rural, Amazonas, Brazil
E-mail: oca.valhalla@outlook.com
Please send all questions about data protection and all requests to exercise your rights to the e-mail address above. We are not legally required to appoint a data protection officer; the persons named above are also the contact persons (encarregado) within the meaning of the LGPD.
2. Which laws apply
Oca Valhalla is operated from Brazil, so the LGPD applies to all processing. Because our website is also aimed at guests from the European Union (for example in German), the GDPR additionally applies to the personal data of people in the EU (Art. 3(2) GDPR). Where the two laws differ, we apply the level of protection that is more favourable to you.
3. Visiting the website (hosting and server log files)
Our website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. Whenever you open a page, your browser automatically transmits technical data, which Netlify processes on our behalf in server log files:
- IP address
- date and time of the request
- requested page or file and the amount of data transferred
- referrer URL (the page you came from)
- browser type and version, operating system
This data is necessary to deliver the website, keep it stable and secure and detect misuse. It is not combined with other data and not used to identify you. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, functioning website) and Art. 7(IX) LGPD. Netlify deletes log data after a short period in accordance with its own retention periods.
Netlify processes data under a data processing agreement. Netlify may process data in the USA. Transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Netlify's privacy policy: netlify.com/privacy.
The page language is determined solely by the address you open (/de/, /en/, /pt-br/). Where you open oca-valhalla.com without a language, your browser's language setting is read once to forward you; this setting is not stored.
4. No cookies, no tracking, no analytics
Our website does not set any cookies, does not store data in your browser (e.g. local storage), and uses no analytics, advertising or tracking tools. All fonts, images and scripts are loaded from our own server; no content is loaded from third-party servers (such as Google Fonts, maps or videos). For this reason we do not show a cookie banner.
5. Availability enquiry via the contact form
If you send us an enquiry through the form on our website, we process the following data:
- name
- e-mail address
- desired arrival and departure dates
- number of guests
- your message and any wishes you tell us about
We use this data solely to check availability, answer your enquiry and, if you wish, prepare an offer. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and Art. 7(V) LGPD. Providing the data is voluntary; without a name and e-mail address, however, we cannot reply.
The form is processed by the form service of our host Netlify (Netlify Forms, see section 3). Netlify stores the enquiry in our account and forwards it to us by e-mail. A hidden field is used to filter out automated spam; it contains no personal data.
Please do not send us sensitive data (e.g. health data) via the form. If you tell us about dietary requirements or health-related needs for your stay, we process them only with your consent and only for your stay (Art. 9(2)(a) GDPR, Art. 11(I) LGPD).
6. Communication by e-mail, WhatsApp and social media
If you contact us by e-mail, WhatsApp or via Instagram, we process the data you send us (e.g. name, contact details, content of the message) to deal with your request. Legal basis: Art. 6(1)(b) GDPR / Art. 7(V) LGPD for enquiries about a stay, otherwise Art. 6(1)(f) GDPR / Art. 7(IX) LGPD.
Our e-mail mailbox is operated by Microsoft (Outlook.com, Microsoft Corporation, USA / Microsoft Ireland Operations Ltd., Ireland). WhatsApp and Instagram are services of Meta Platforms (Meta Platforms Ireland Ltd., Ireland / Meta Platforms, Inc., USA). When you use these services, their own privacy policies apply as well. You are free to choose which channel you use.
7. Bookings and your stay
If you book a stay, we process the data needed to carry out the contract: names of the travellers, contact details, travel dates, booked services, arrival details for the boat transfer, dietary requirements you tell us about, and payment and invoice data. Legal basis: Art. 6(1)(b) GDPR / Art. 7(V) LGPD, and for mandatory retention Art. 6(1)(c) GDPR / Art. 7(II) LGPD (legal obligations, e.g. tax and accommodation registration duties under Brazilian law).
Where necessary for your stay, we pass data only to the extent required to local service providers who carry out booked services (e.g. boat transfers or guided excursions) and to payment providers or banks for processing payments.
We will not use identifiable photographs or videos of guests for promotional purposes without your express consent.
8. Transfer of data to Brazil
Oca Valhalla is based in Brazil. If you contact us from the EU, your data is therefore transferred to Brazil. This transfer is necessary to answer your enquiry and to carry out the contract you requested (Art. 49(1)(b) GDPR). Where the European Commission has adopted an adequacy decision for Brazil, the transfer is additionally based on that decision (Art. 45 GDPR). In Brazil, your data is protected by the LGPD.
9. External links, Instagram and Amazon affiliate links
Our website contains links to other websites, for example to Instagram, to museums and venues in Manaus, and to products on Amazon. No data is transmitted to these providers merely because you visit our website. Only when you click a link does your browser open the other website; from then on, that provider's privacy policy applies.
We participate in the Amazon EU Associates programme. Some product links contain our partner ID. If you click such a link, Amazon may use cookies on its own website to recognise that you came from our site and to attribute a purchase to us. We do not receive any personal data about you from Amazon – only anonymous commission reports. Controller for this processing is Amazon Europe Core S.à r.l., Luxembourg. More information: Amazon Privacy Notice.
10. How long we store data
- Server log files: deleted automatically by Netlify after a short period.
- Enquiries and booking data: kept as part of our customer relationship so that we can refer to them for later enquiries and stays, and in any case for the retention periods required by Brazilian tax and commercial law. At your request we delete your data, unless a legal retention obligation prevents this.
- Data based on consent: until you withdraw your consent or the purpose no longer applies.
11. Your rights
Under the GDPR you have the right to:
- access to your personal data (Art. 15 GDPR);
- rectification of inaccurate data (Art. 16 GDPR);
- erasure (Art. 17 GDPR);
- restriction of processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- withdraw consent at any time with effect for the future (Art. 7(3) GDPR);
- lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).
Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
Under the LGPD (Art. 18) you also have the right to confirmation that processing takes place, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about the entities with which we share data, information about the possibility of refusing consent and its consequences, and withdrawal of consent. You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD, gov.br/anpd).
To exercise your rights, a short e-mail to oca.valhalla@outlook.com is enough. We will reply without undue delay and in any case within one month.
12. Automated decisions and security
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Our website is delivered exclusively over an encrypted HTTPS (TLS) connection, so data you enter in the form is transmitted in encrypted form.
13. Changes to this Privacy Policy
We update this Privacy Policy when our website or our processing changes, or when the law requires it. The version published here applies. The German, English and Portuguese versions have the same content.