Privacy Police

We collect Personal Data through: Grupo Clara Resorts websites (our own or hosted on third-party platforms, such as social networks and booking engines); email and instant messaging (including WhatsApp and SMS); mobile applications; customer service and the reservations center; online advertisements and forms; offline records (events and in-person interactions); and data received from third parties (social networks, data aggregators, business partners, public sources or corporate acquisition processes).

• Contact information: address, telephone number, email address, social media profiles. • Login information: identification, password (stored in encrypted form) and security questions. • Demographic and interest information: date of birth, age, gender, location, preferences and habits. • Device technical information: IP address, operating system, browser, mobile device identifier, geolocation (when permitted). • Browsing data: pages visited, clicks and time spent, collected through cookies, web beacons and third-party tools – You may object to these technologies as described in the section "Use of Cookies". • Surveys and feedback voluntarily shared. • Guest-generated content (photos, comments, videos) published on our channels or on third-party social networks. • Data from third-party social networks, to the extent that You authorize sharing with Grupo Clara Resorts. • Financial and payment data, processed in accordance with applicable security standards (PCI DSS). Grupo Clara Resorts does not retain sensitive card data beyond what is necessary to process the transaction when processing is performed by a certified third party. • Customer service recordings, where permitted by law and upon prior notice, excluding financial data. • Sensitive data: such data is not collected in the ordinary course of the relationship. When necessary, processing will depend on express consent or another specific legal basis (fraud prevention, compliance with a legal obligation).

Data relating to children and adolescents may be collected directly from parents or legal guardians, with explicit consent and in accordance with applicable legislation (Brazilian General Data Protection Law and the Statute of the Child and Adolescent).

You are responsible for configuring your browser or device to accept or reject cookies. It is possible to browse most of our websites without cookies enabled, although certain features may be unavailable in that case. Grupo Clara Resorts is not responsible for the unavailability of features resulting from configuration choices made by the user.

We use your Personal Data to: provide customer service; conduct marketing and promotional activities (with consent, where required); interact on third-party social networks; personalize your experience (with consent); process reservations and orders, including identity verification and fraud prevention; comply with legal and contractual obligations; and, in the event of a merger, acquisition or corporate restructuring, transfer data to legal successors in accordance with applicable law. We also process data to protect our systems, employees and rights, including for the purpose of defending ourselves in administrative or judicial proceedings. Each of the purposes above relies on a specific legal basis (performance of a contract, compliance with a legal obligation, legitimate interests or consent), as detailed according to the context in which the data is collected.

We may share Personal Data with: service providers engaged to operate our business (subject to contractual confidentiality and security obligations and, where provided by law, joint and several liability in the event of a violation); credit analysis and debt collection agencies, where applicable; and third parties, to comply with a legal obligation, court order, request from a competent authority, or to protect the rights, security and assets of Grupo Clara Resorts. We do not sell or license Personal Data to third parties for their own marketing purposes, except with specific prior consent and identification of the company involved.

We retain your Personal Data for the period necessary to fulfill the purposes described in this Policy or to comply with applicable legal obligations. Once processing has ended, the data is deleted within the technical limits of our activities, except where retention is permitted or required by law (for example, tax and accounting obligations).

We adopt technical and administrative measures to protect your Personal Data against unauthorized access, loss or improper alteration. These measures do not extend to information that you choose to share in public environments, such as third-party social networks, over which we have no control. No data storage or transmission system is absolutely secure. Grupo Clara Resorts undertakes to act diligently in preventing and responding to information security incidents, including notifying authorities and affected data subjects where required by applicable law, but does not guarantee the absolute inviolability of its systems against sophisticated cyberattacks or events beyond its control. You also have a responsibility to protect your data: use strong passwords, do not share them, avoid saving credentials on shared devices, and log out when you have finished using the service. Grupo Clara Resorts is not responsible for unauthorized access resulting from the user's failure to follow these recommendations. We may transfer Personal Data to other countries, within the purposes of this Policy, provided that the destination country ensures an adequate level of protection or safeguards compatible with Brazilian law are adopted.

You may confirm whether processing is taking place, request a copy of your Personal Data, obtain information about the source and sharing of such data, restrict its use or withdraw consent, subject to legal retention requirements. Exercising these rights requires proof of the data subject's identity (for example, a copy of an official identification document), failing which the request may be automatically rejected. Deletion requests that also require deletion of the user account will be handled accordingly, and residual data may be retained to comply with legal or contractual obligations.

You may manage cookies through your browser settings; unsubscribe from marketing communications at any time using the links provided or through customer service (while remaining subject to essential administrative communications, such as booking confirmations); adjust personalization preferences in your user profile; and obtain more information about targeted advertising through our contact channels.

We may change this Policy at any time to reflect changes in our practices or applicable law. We recommend reviewing it periodically. Material changes will be communicated through reasonable means, without prejudice to the validity of the version in effect at the time the data was originally collected.

Data Protection Officer (DPO): Felipe Januário – dpo@clararesorts.com.br Grupo Clara Resorts will receive, review and respond, within a reasonable period, to requests and complaints relating to the processing of Personal Data, including any violations of rights provided for under applicable data protection legislation.