This Privacy Policy describes how BLUMAR TURISMO LTDA (“Blumar”) collects, uses, stores, and protects personal data of users who access the website www.blumar.com.br and its subdomains.

We are committed to ensuring transparency, security, and compliance with applicable Brazilian laws, including the General Data Protection Law (Law No. 13.709/2018 – LGPD) and the Digital Statute of Children and Adolescents (ECA Digital).

Blumar acts as the data controller for personal data processed through this website.

DATA PROCESSING OVERVIEW

Blumar processes personal data of users who interact with its digital channels, including website visitors, clients, and potential customers.

Data may be provided directly by users or collected automatically during browsing.

DATA WE COLLECT

Data provided by the user:

• Name
• Email address
• Phone number
• Company (when applicable)
• Information related to service requests

Data collected automatically:

• IP address
• Device type and browser
• Pages visited
• Time spent on the website
• Approximate location (city/country)

Data collection is always limited to what is necessary for each specific purpose.

COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to ensure website functionality, analyze usage, improve user experience, and deliver personalized content where authorized by the user.

Cookie Consent Banner

Upon visiting our website, users are presented with a cookie consent banner offering three choices:

• Accept — authorizes all tracking and analytics technologies
• Customize — allows individual selection of each cookie category
• Reject — blocks all non-essential cookies; only session and security cookies remain active

Consent is recorded in a browser cookie named cc_consent, which stores the user's preferences along with a timestamp. This cookie is valid for 365 days and is set with SameSite=Lax and Secure flags to ensure safe transmission.

Users may update or withdraw their consent at any time by clicking the "Privacy" button located at the bottom-left corner of the website.

Cookie Categories

• Essential — session management and security. Always active; not subject to user consent.
• Analytics — website traffic measurement and performance analysis. Requires consent.
• Marketing — advertising and remarketing. Requires consent. Automatically blocked on pages involving minors' data.
• Functional — chat widgets, maps, embedded videos. Requires consent.

Google Consent Mode v2

Our website implements Google Consent Mode v2, an industry-standard framework that communicates the user's consent choices directly to Google's tag infrastructure. When consent is denied, tracking tags are blocked from firing or operate in a privacy-preserving mode that does not collect personal data.

ANALYTICS AND MARKETING TOOLS

The following third-party tools may be activated depending on the user's consent choices:

Analytics (requires analytics_storage consent):

• Google Analytics 4 (GA4) — website traffic and behavioral analysis (Google LLC)
• Universal Analytics — legacy traffic measurement (Google LLC)
• Microsoft Clarity — session recording and heatmaps (Microsoft Corporation)

Marketing (requires ad_storage, ad_user_data and ad_personalization consent):

• Meta Pixel (Facebook Pixel) — conversion tracking and audience targeting (Meta Platforms, Inc.)
• Google Ads — search and display advertising measurement (Google LLC)

Functional (requires functionality_storage consent):

• RD Station — marketing automation and WhatsApp button (RD Station / TOTVS S.A.)

These tools may collect browsing data in aggregated or pseudonymized form. Each provider's own privacy policy governs how they process data received from our website.

On pages where interactions may involve individuals under 18 years of age, marketing tags are automatically blocked regardless of the user's consent, in compliance with the Digital Statute of Children and Adolescents (ECA Digital).

PURPOSE OF DATA USE AND LEGAL BASIS

Personal data may be used for:

• Responding to inquiries and requests
• Providing information about services
• Sending marketing communications (when authorized)
• Improving website functionality and content
• Complying with legal and regulatory obligations

Personal data is processed based on applicable legal grounds, including:

• User consent
• Performance of contracts or pre-contractual measures
• Compliance with legal obligations
• Legitimate interests, when applicable and respecting user rights

DATA SHARING

Personal data may be shared with:

• Operational partners (hotels, airlines, and service providers)
• Technology providers (such as hosting, cloud, CRM, and analytics services)
• Marketing and advertising platforms (when authorized)
• Legal or regulatory authorities, when required

This sharing is always limited to what is necessary for each purpose.

We adopt appropriate measures to ensure data security and confidentiality in all sharing processes.

DATA OF CHILDREN AND ADOLESCENTS — ECA DIGITAL

Our services are intended for a general adult audience. However, certain areas of our website may involve information related to travelers under 18 years of age as part of family or group bookings.

In compliance with the Digital Statute of Children and Adolescents (ECA Digital — Law No. 14.010/2020) and the LGPD, we apply the following protections:

• Marketing and advertising tracking tags are automatically blocked on pages designated as sensitive (such as the client area), regardless of the user’s general consent choice
• This blocking is enforced technically at the Google Tag Manager level, preventing any advertising data from being collected on those pages
• Data collection involving minors is limited to what is strictly necessary for the provision of the contracted service (e.g., age for accommodation purposes)
• Any data related to minors must be submitted by a parent or legal guardian
• We do not use data related to minors for profiling, advertising, or marketing purposes

If we identify any improper collection of personal data from minors, we will immediately restrict access to and delete such information.

To report concerns regarding minors’ data, please contact: viajepelobrasil@blumar.com.br

DATA STORAGE AND SECURITY

Data is stored in secure environments, including internal servers and cloud services, which may involve international data transfers.

When international data transfers occur, we adopt appropriate safeguards in accordance with applicable data protection laws.

We implement technical and organizational measures to protect personal data against unauthorized access, loss, or misuse.

USER RIGHTS

In accordance with the LGPD (Art. 18), users may, at any time:

• Request access to their personal data held by Blumar
• Request correction of inaccurate or incomplete data
• Request deletion of their data
• Withdraw or update cookie consent — via the "Privacy" button at the bottom-left of the website
• Request data portability to another service provider
• Object to processing based on legitimate interests
• Request information about third parties with whom data has been shared

Cookie consent may be withdrawn at any time by clicking the "Privacy" button at the bottom-left corner of the website and updating your preferences. Changes take effect immediately.

For all other data rights requests, please contact:
viajepelobrasil@blumar.com.br

DATA RETENTION

Data is retained only for as long as necessary to fulfill its purposes, in compliance with legal and regulatory obligations.

THIRD-PARTY LINKS

Our website may contain links to third-party websites. We are not responsible for their privacy practices.

POLICY UPDATES

This Privacy Policy was last updated on April 15, 2025.

It may be updated at any time to reflect changes in our data practices, tools, or applicable regulations. We recommend periodic review. Continued use of our website after updates constitutes acceptance of the revised policy.

GOVERNING LAW AND JURISDICTION

This Policy is governed by Brazilian law. Any disputes shall be resolved in the courts of Rio de Janeiro, Brazil.