Privacy and Cookies Policy

Last updated: March 24, 2026

1. Introduction

Spa H Rio respects your privacy and handles information with seriousness, transparency, and security.

This Privacy and Cookies Policy clearly explains how information is processed across our channels, including the website spahrio.com.br, the contact form available on the site, customer service via WhatsApp, phone, and email, security procedures adopted in our physical space, and the use of cookies, tags, and similar technologies for navigation analytics.

By using our channels, you acknowledge and agree to the terms of this Policy.

2. About our website

The Spa H Rio website is primarily informational and institutional, and is used to present the spa, its services, contact options, and general guidelines.

Our website does not have a login area, does not require registration, does not request account creation, and does not ask for email or other personal data for simple browsing.

We also do not maintain a commercial client list, promotional mailing list, or CRM database based on website navigation. All pages can be accessed freely without mandatory submission of personal data.

3. What information may be processed

3.1. Website browsing

During normal website browsing, only technical and behavioral navigation data may be processed, such as IP address, browser type, device used, pages visited, time spent on each page, number of visits to specific pages, number of times certain buttons are clicked (such as the booking button), traffic source, and general interactions with the site.

This information is used in an aggregated and operational manner, focusing on understanding website performance, which pages receive more visits, which content generates more interest, and how to improve the overall navigation experience.

Spa H Rio does not use the website to collect sensitive personal data, does not require registration to access content, and does not use normal browsing data to build a client list.

3.2. Contact form

The only point of direct personal data collection on the website is the contact form located in the footer, where users may voluntarily provide their name and phone number.

This information is used solely to enable a return contact and continue the requested service, especially via WhatsApp when that is the user’s intention.

3.3. Communication channels

When users contact us via WhatsApp, phone, or email, the information they provide in the communication may be processed exclusively to respond, guide, organize service, pre-booking, scheduling, or other requests made by the user.

4. Purposes of processing

Information processed by Spa H Rio may be used to present and promote spa services, respond to questions and requests, contact users who voluntarily fill out the form or initiate communication, continue conversations initiated by the user, organize contacts related to service, pre-booking, and scheduling, understand website navigation behavior, measure which pages are most accessed, verify which content receives more time of visit, measure button clicks and important interactions on the site, improve the structure, clarity, and performance of pages, protect clients, staff, property, and physical access to the location, and comply with legal obligations and protect rights when necessary.

5. Legal bases

Information processing by Spa H Rio may occur, depending on the case, based on legal grounds provided in applicable law, especially the execution of preliminary procedures related to services requested by the user, legitimate interest when necessary for website operation, security, navigation statistics, service organization, and protection of the physical environment, compliance with legal or regulatory obligations when applicable, and consent when required for specific categories of non-essential cookies or technologies.

6. Information sharing with third parties

Spa H Rio does not sell personal data and does not work with a commercial client list extracted from the website.

We also do not maintain promotional CRM systems, do not create campaign mailing lists, and do not share client information indiscriminately.

Technical tools may be used when necessary for website operation, navigation analytics, security, customer service, and operation of the channels used, always aligned with the purposes described in this Policy.

7. Meta, WhatsApp Business, and advertising

Spa H Rio does not actively share client-related activity data with Meta for advertising purposes.

In the WhatsApp Business app used by Spa H Rio, the option to share client-related activity data with Meta remains disabled.

This feature is mainly related to using such information for ad segmentation, measurement, and optimization on Facebook and Instagram.

As an operational policy, Spa H Rio does not use this sharing, does not run active ads on Facebook, does not run active ads on Instagram, and does not run ads inside WhatsApp based on data from clients served through its channels.

Information sent by users in conversations with Spa H Rio is used solely for service, contact organization, pre-booking, scheduling, and continuation of communication requested by the user.

8. Cookies, tags, and similar technologies

Spa H Rio uses a cookie consent banner to inform users about the use of cookies and similar technologies.

Our website uses cookies, tags, and similar technologies primarily for technical operation of navigation, measurement of navigation behavior, identification of most-visited pages, verification of time spent on pages, measurement of button clicks, such as the booking button, and analysis of overall website performance.

These tools are used with a focus on statistics, performance, and understanding navigation behavior, and not to require user registration or create a commercial client list.

Users can manage preferences through the cookie banner, when applicable, and also through their browser settings.

9. WhatsApp, phone, and email

When users contact Spa H Rio via WhatsApp, phone, or email, the information provided in the communication may be processed to respond to questions, provide information about services, continue a service initiated by the user, organize data necessary for pre-booking or scheduling, and maintain minimal operational records of the communication when necessary for organization, security, and continuity of service.

Spa H Rio does not actively use these conversations for advertising campaigns on Facebook, Instagram, or WhatsApp, nor for building promotional databases or commercial CRM systems.

10. Website without registration and without broad personal data collection

Spa H Rio reinforces that its website is intended for service presentation and institutional information.

Therefore, there is no account creation, no user login, no restricted area, no registration requirement to read content, no email request for site access, no commercial client list created from browsing, and no broad personal data collection for simple visits to the pages.

Processing related to the website is generally limited to technical navigation data, behavioral statistics, and, when the user voluntarily fills out the form, name and phone number for return contact.

11. Security cameras and privacy

To protect clients, staff, property, and access control, Spa H Rio uses security cameras exclusively in hallways, entrances, and common areas.

There is no camera monitoring in intimate, private, or treatment-exclusive areas.

Images are processed with restricted access and used only for legitimate purposes of security, access control, incident verification, property protection, and investigation of occurrences when necessary.

Storage is limited and operates on a continuous recording cycle, with automatic overwriting of older footage after the internally adopted retention period, unless specific preservation is required for investigation of a particular incident, exercise of legal rights, or compliance with legal obligations.

12. Information security

Spa H Rio adopts reasonable technical, administrative, and organizational measures to protect processed information against unauthorized access, misuse, alteration, loss, destruction, or improper disclosure.

These measures aim to be compatible with the nature of the operations carried out and the scale of the operation.

13. Information retention

Information is retained only for the time necessary to fulfill the purposes of this Policy, considering continuity of the requested service, operational organization, security, legal obligations, and the need to protect rights in case of specific incidents.

For security camera footage, the cyclical storage logic with automatic overwriting applies, unless specific preservation is required.

14. Data subject rights

Under applicable law, data subjects may request information about any personal data processing carried out by Spa H Rio in relation to their person, within the limits of what actually exists in our channels and records.

Given Spa H Rio’s operational model, there is no user registration on the website, no access accounts, no broad personal data database for simple browsing, no promotional CRM or structured commercial client list, and no storage of personal data beyond specific situations arising from voluntary contact, service, pre-booking, scheduling, communication via WhatsApp, phone, email, or specific security incidents.

Requests will be evaluated according to the reality of each case and may involve, when applicable, confirmation of whether personal data is processed, access to existing data, correction of incorrect information, requests for deletion, blocking, or interruption of processing when applicable and when there is no legal basis for retention, and information about any sharing, when it exists and is applicable to the specific case.

When there is no database linked to the requester or no identifiable processing in their name, Spa H Rio may respond by informing the absence of records or identifiable processing, as applicable.

To exercise these rights, data subjects may contact us via the email provided in this Policy.

15. Minors

Spa H Rio’s services and channels are not directed to individuals under 18 years old.

If inappropriate submission of information is identified in disagreement with this guideline, measures may be taken to delete or interrupt processing, in accordance with applicable legal provisions.

16. Changes to this Policy

This Policy may be updated at any time to reflect legal, regulatory, operational, technical, or security changes.

The current version will always be available on this page, with the corresponding update date.

17. Contact

For questions, requests, or matters related to privacy and information processing:

Spa H Rio
Email: contato@spahrio.com.br
Address: Avenida Nossa Senhora de Copacabana, 647 – Copacabana – Rio de Janeiro – RJ – Brazil