Privacy policy
Last updated 2026-08-27
This policy explains what Costa Verde Private collects, why, and what you can ask us to do about it. It is written to satisfy Brazil’s Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018) and the EU/UK General Data Protection Regulation (GDPR).
Who is responsible
The data controller for this website, for the purposes of both the GDPR and the LGPD, is:
Sri Lanka Taxi Charter Service International LimitedUnit 2904-05, 29/F, Universal Trade Centre
3 Arbuthnot Road
Hong Kong S.A.R.
Costa Verde Private is a trading name of that company. All privacy enquiries, and any request to exercise the rights set out below, should be sent to hello@costaverdeprivate.com.
The company is registered in Hong Kong S.A.R. It has not appointed a Data Protection Officer, and is not required to. Where a representative in the EU, the UK or Brazil becomes required, this page will be updated with those details.
What we collect
Information you send us
When you submit the transport-plan form, we receive:
- Your email address, and your WhatsApp number if you choose to give one.
- Your travel dates, destinations and itinerary text.
- The number of travellers, children and bags.
- Which priorities you selected, and any notes you add.
We also record which page you first arrived on, which guide you were reading before you opened the form, the referring website, and any UTM campaign parameters in the URL. This is used to understand which guides are useful. It is not used to build a profile of you and it is not sold or shared for advertising.
We do not ask for and will never ask for payment card details, passport or ID numbers, or any government identifier through this website.
Analytics
The site uses Google Analytics 4 to count visits and see which guides are read. Analytics storage is set to denied by default using Google Consent Mode. Nothing is stored on your device for analytics purposes unless you accept the cookie banner. IP addresses are anonymised. You can change your mind at any time by clearing this site’s storage in your browser, which restores the default denied state.
Server logs
Our hosting provider records standard web-server access logs, which include IP addresses, for security and troubleshooting. These are retained by the provider under its own retention policy.
Why we process it, and on what basis
| Purpose | GDPR basis | LGPD basis |
|---|---|---|
| Answering your transport-plan enquiry | Steps prior to a contract (Art. 6(1)(b)) | Execution of preliminary procedures (Art. 7, V) |
| Keeping a record of enquiries so none are lost | Legitimate interests (Art. 6(1)(f)) | Legitimate interests (Art. 7, IX) |
| Analytics | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Spam prevention on the form | Legitimate interests (Art. 6(1)(f)) | Legitimate interests (Art. 7, IX) |
Where it is stored, and for how long
Form submissions are emailed to us and also written to a log file on our hosting account, outside the public web directory. The log exists so that an enquiry is never lost if an email fails to deliver.
Enquiry records are kept for 24 months from your last contact with us, then deleted. If you ask us to delete them sooner, we will.
Hosting is provided by Xserver Inc. (Japan). Google Analytics data is processed by Google LLC. The data controller named above is established in Hong Kong S.A.R. So if you write to us from the EEA, the UK or Brazil, your data is handled outside your own jurisdiction — principally in Hong Kong and Japan. Where personal data leaves the EEA or the UK, transfers rely on the relevant provider’s Standard Contractual Clauses; for correspondence sent directly to us, they rely on your explicit request that we answer you (GDPR Art. 49(1)(b); LGPD Art. 33).
Who we share it with
We do not sell your data and we do not share it for advertising. If — and only if — you ask us to check availability or pricing for a specific transfer, we may need to pass the minimum necessary details (date, route, group size) to a local transport partner in order to get you an answer. We will tell you when that is about to happen.
Your rights
Under both the GDPR and the LGPD you may ask us to:
- confirm whether we hold data about you, and give you a copy;
- correct anything inaccurate or incomplete;
- delete your data, or anonymise it;
- restrict or object to how we use it;
- port it to another provider in a machine-readable form;
- withdraw consent for analytics at any time, without affecting anything else;
- be told about any sharing with third parties, and about the consequences of refusing consent (LGPD Art. 18).
Write to hello@costaverdeprivate.com. We aim to respond within 15 days, which is the LGPD standard and inside the GDPR’s one-month limit.
You also have the right to complain to a supervisory authority — the ANPD in Brazil, or your national data protection authority in the EU or the UK.
Children
This site is not directed at children and we do not knowingly collect data from anyone under 16. Where an itinerary mentions children travelling with you, we use that only to advise on seating and suitability, and we do not ask for their names or ages beyond a count.
Changes to this policy
If this policy changes materially, the date at the top will change and the new version will be published here.