Privacy Policy

This policy covers the PlanetaEXO website, our EXO Partners mobile app, and the enquiries, bookings and communications that flow from them. PlanetaEXO, based in São Paulo, Brazil, is the controller responsible for your personal data. It does not cover third-party websites we link to, which have their own policies.

We collect personal data in a few ways:

• Information you give us — such as your name, email address, phone number, the trip you're interested in, travel dates, the number of travellers, and anything else you choose to include when you make an enquiry, request a quote, sign up for our newsletter or contact us.
• Booking details — where you go on to book, we collect the further information needed to deliver your trip, which may include dietary needs, accessibility requirements and emergency contacts.
• Information we collect automatically — when you browse the site we receive technical data such as your IP address, device and browser type, the pages you view and how you arrived, gathered through cookies and similar technologies.

We use your personal data to:

• respond to your enquiries and prepare trip proposals and quotes;
• arrange, confirm and deliver any trip you book, including liaising with the local hosts and guides who run it;
• send you service messages about your enquiry or booking;
• send you marketing about trips and stories where you have asked us to or where we are otherwise permitted to, and only until you opt out;
• operate, secure and improve our website and understand how it is used; and
• meet our legal, accounting and regulatory obligations.

We rely on the appropriate legal basis for each use: performing a contract with you (or taking steps at your request before one); our legitimate interests in running and promoting our business in a way that respects your rights; your consent (for example for marketing emails or non-essential cookies, which you can withdraw at any time); and compliance with our legal obligations.

Our website uses cookies and similar technologies to keep the site working, remember your preferences (such as language and currency) and understand how visitors use it through analytics. You can control non-essential cookies through the consent banner shown when you first visit, and through your browser settings.

We do not sell your personal data. We share it only where needed, with:

• the local hosts, guides and suppliers who deliver a trip you have booked;
• service providers who work on our behalf — for example email, hosting, customer-relationship and analytics providers — under agreements that require them to protect your data and use it only as we instruct;
• professional advisers, payment providers and authorities where required by law; and
• a successor organisation if our business is reorganised or transferred.

Because we operate from Brazil and work with partners and providers in different countries, your data may be transferred and processed outside your home country. Where we do this, we put appropriate safeguards in place so that your data remains protected to the standard required by applicable law.

We keep personal data only for as long as we need it for the purposes described here — for example, for the duration of our relationship and a reasonable period afterwards to handle queries, meet legal and accounting obligations, and defend potential claims. When we no longer need it, we delete or anonymise it.

Depending on where you live, you have rights over your personal data, which may include the right to access it, correct it, delete it, object to or restrict how we use it, withdraw consent, and ask for a copy in a portable format. You can also opt out of marketing at any time using the link in our emails or by contacting us.

To exercise any of these rights, please contact us using the details below. You also have the right to complain to your data protection authority — in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD).

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. No method of transmission or storage is completely secure, but we work to keep our safeguards under review.

Our website is intended for adults. We do not knowingly collect personal data directly from children. Where a booking includes minors travelling with their family, the details are provided by the responsible adult making the booking.

EXO Partners is an app for the travel agencies and partners who sell our trips. It is not a consumer app: signing in requires an email address we have already registered as a partner, and no account can be created from the app itself.

Signing in uses a one-time code sent to that email address — the app never asks for or stores a password. Once signed in, it shows the same booking information available in the partner area of our website, and collects nothing beyond what this policy describes.

If you allow notifications, Google (Firebase Cloud Messaging) or Apple (APNs) issues your device an anonymous token, which we store so that we can alert you about new booking requests. You can turn notifications off at any time in your device settings.

The app does not collect your location, contacts, photos or files, it contains no advertising, and it does not use an advertising identifier or track you across other apps or websites.

If you would like us to delete the personal data we hold about you, write to privacy@planetaexo.com from the address we have on file, telling us what you would like removed. We will confirm your request and act on it within 30 days.

Partners can request deletion of their EXO Partners account the same way. Deleting the account removes your ability to sign in and the notification tokens linked to your devices. Booking records we are required to keep for legal, accounting or contractual reasons are retained for the periods described in “How long we keep it” above.

We may update this policy from time to time. The version on this page is the current one, and the “last updated” date above shows when it last changed. If we make a significant change, we will take reasonable steps to let you know.

If you have any questions about this policy or about how we handle your personal data, please reach out via our contact page or write to us at privacy@planetaexo.com.