Last updated: 11 August 2026

The company Memphis Agência de Viagens e Turismo Ltda., registered under Brazilian corporate taxpayer number (CNPJ) 04.482.379/0001-74, with its registered office at Avenida Francisco Matarazzo, 1752, suites 306 and 307, Água Branca, São Paulo — SP, postal code 05001-200, hereinafter referred to as “Memphis Turismo”, respects the privacy of its customers, passengers, representatives, website users and other people with whom it interacts.

This Policy explains how Memphis Turismo collects, uses, stores, shares and protects personal data when browsing the website memphisturismo.com.br, requesting proposals, booking and receiving tourism services, contacting customer service and interacting with the company in other ways.

Simply reading this Policy does not constitute consent to all forms of processing. Where consent is the appropriate legal basis, it will be requested in a specific, freely given, informed and clearly distinguished manner.

1. Who this Policy applies to

This Policy applies to personal data processed by Memphis Turismo through its digital and physical channels, including its website, forms, email, telephone, WhatsApp, social media, in-person service, proposals, contracts, travel documents and post-booking communications.

It covers data relating to:

  • website users and people who request information or proposals;

  • customers, passengers and their representatives;

  • travel companions whose data is provided by the customer or another person in the booking;

  • legal guardians, children and adolescents taking part in a trip;

  • suppliers, partners and professional contacts who are individuals.

Third-party websites, applications and services accessed through external links have their own policies and are responsible for their respective privacy practices.

2. Memphis Turismo’s role in data processing

For most of the activities described in this Policy, Memphis Turismo acts as the controller, because it determines the purposes and essential means of processing personal data.

Depending on the service, airlines, hotels, local tour operators, insurers, transport companies, payment providers, digital platforms and other providers may also act as independent controllers or processors, according to their activities and applicable legislation.

3. Personal data we may process

The data processed varies according to the interaction and services requested. We may process the following categories:

3.1. Identification and contact details

Name, date of birth, nationality, gender as shown in the travel document, Brazilian taxpayer number (CPF), identity card (RG), passport, address, email, telephone, signature and details of the legal guardian or representative.

3.2. Travel and booking information

Destination, dates, itinerary, flights, accommodation, room type, group composition, preferences, emergency contacts, loyalty programmes, visas, authorisations, vouchers and customer service history.

3.3. Contractual and financial data

Proposals, contracts, confirmations, receipts, amounts, payment methods and status, information needed to issue tax documents and records relating to cancellations, refunds or disputes. Where payment is processed by a specialist company, certain data may be collected directly by that provider in accordance with its own privacy policy.

3.4. Communications and customer service

Messages, requests, reviews, complaints, recordings or customer service records, where made lawfully and with appropriate notice, and information provided during the relationship with Memphis Turismo.

3.5. Browsing and device data

IP address, access date and time, pages visited, referral source, device type, browser, operating system, cookie identifiers, approximate location and data about interactions with the website, advertisements and electronic communications.

3.6. Sensitive personal data

Where necessary for safety, accessibility or the proper delivery of services, we may process information about health, disabilities, mobility, allergies, dietary restrictions or other specific needs. This data will be limited to what is necessary and processed in accordance with the circumstances provided for by law, including specific and clearly distinguished consent where applicable.

We do not request sensitive data without a need related to the trip or another legitimate purpose that has been communicated.

4. How we obtain data

We may obtain personal data:

  • directly from the data subject when browsing the website, completing forms, requesting a proposal, booking a trip or making contact;

  • from the customer, legal guardian, representative, travel companion or partner agency arranging the booking;

  • from suppliers involved in the trip, where necessary to confirm, change or provide a service;

  • from platforms used for customer service, signatures, payments, website analysis and communications;

  • from public sources or authorities, where necessary and permitted by law.

Anyone providing data about travel companions or other people must inform them of this sharing and limit the information to what is necessary for the booking and provision of services.

5. Why we use data and the legal bases

Memphis Turismo processes personal data only where there is a legitimate purpose and an applicable legal basis. The main activities are:

Purpose Examples Main legal bases
Preparing proposals and handling requests Responding to enquiries, tailoring itineraries, calculating prices and checking availability Pre-contractual steps taken at the data subject’s request; legitimate interests where applicable
Formalising and performing the contract Identifying passengers, signing contracts, receiving payments, making bookings, issuing documents and providing assistance Performance of a contract; compliance with legal or regulatory obligations
Making travel services possible Sharing necessary data with hotels, airlines, tour operators, guides, insurers and other providers Performance of a contract; lawful exercise of rights; protection of life or physical safety where applicable
Complying with legal duties and protecting rights Issuing tax documents, keeping records, responding to authorities, preventing fraud and handling complaints or disputes Compliance with legal or regulatory obligations; lawful exercise of rights; legitimate interests
Improving the website and customer service Producing statistics, correcting faults, measuring performance and understanding how channels are used Legitimate interests for strictly necessary activities; consent for non-essential cookies where applicable
Sending commercial communications Promoting itineraries, destinations, content and opportunities related to the recipient’s interests Consent where required; or legitimate interests, taking account of the relationship and the data subject’s expectations, always with an opt-out
Handling specific needs Arranging assistance, meals, accessibility or support relating to health and safety Specific and clearly distinguished consent or another authorised basis for sensitive data, as appropriate

Consent may be withdrawn at any time through a free and straightforward procedure. Withdrawal does not invalidate lawful processing carried out before the request and does not prevent processing based on other legal grounds.

6. Sharing personal data

Memphis Turismo does not sell personal data. Data is shared only where necessary for the purposes described in this Policy, with access limited to relevant information.

Data may be shared with:

  • airlines, hotels, cruise companies, local tour operators, guides, carriers, insurers, rental companies, attractions and other travel suppliers;

  • banks, card issuers, acquirers, intermediaries and other providers involved in payments, collection, refunds and fraud prevention;

  • electronic signature platforms, including D4Sign where used for the contract;

  • hosting, storage, email, customer service, security, management, marketing and technology support providers;

  • analytics and digital advertising tools, such as Google and Meta services, in accordance with cookie preferences and the applicable legal basis;

  • accountants, lawyers, auditors and other advisers subject to confidentiality obligations;

  • public authorities, regulators, consumer protection bodies or third parties where required by law, a valid order or the need to lawfully exercise rights;

  • successors or parties to a possible corporate reorganisation, subject to applicable legislation and safeguards.

Some suppliers receive data as independent controllers and may request additional information directly from the passenger. We recommend reading the privacy policies of the providers used for each trip.

7. International data transfers

International travel requires data to be sent or made available to providers located in the destination, connection or service operating countries. This may include airlines, hotels, local tour operators, guides, insurers, immigration authorities and other suppliers necessary to deliver the trip.

Data may also be processed abroad by technology and digital infrastructure providers.

International transfers will take place in the circumstances and through the mechanisms permitted by Brazil’s General Personal Data Protection Law (LGPD) and the regulations of the National Data Protection Authority, as appropriate. These include the need to perform a contract requested by the data subject, adequacy decisions or appropriate contractual and organisational safeguards.

Memphis Turismo will limit sharing to necessary data and seek to adopt safeguards appropriate to the nature of the operation, without prejudice to legal obligations imposed on providers in the destination country.

8. Data relating to children and adolescents

Data relating to children and adolescents may be processed when they take part in a trip or service requested by their parents, legal guardians or authorised representatives.

Processing will take account of the child’s or adolescent’s best interests and be limited to what is necessary to prepare proposals, check documents, make bookings, provide assistance, protect their safety and comply with legal obligations.

Where legislation requires specific consent, authorisation or a document from the responsible adult, Memphis Turismo may request the relevant evidence. The company does not intentionally target children with campaigns based on behavioural profiling.

9. How long we keep data

Data is kept for the period necessary to fulfil the purposes for which it was collected. To determine that period, we consider:

  • the duration of discussions, the contract and the provision of services;

  • the retention periods required by civil, consumer, tax, accounting, regulatory and fraud-prevention legislation;

  • the need to evidence transactions, handle requests and exercise or defend rights;

  • the duration of the relationship and the data subject’s legitimate expectations;

  • consent and any withdrawal of it, where that is the legal basis;

  • the periods and settings applicable to cookies and digital tools.

Once the purpose has ended and there is no obligation or basis for retention, data will be deleted, anonymised or kept securely in the circumstances authorised by law.

10. Cookies and similar technologies

The website uses cookies, pixels, identifiers and similar technologies to operate, remember preferences, understand browsing, measure results and support communications and advertising.

The main categories are:

  • necessary cookies: enable essential functions, security, stability and basic website preferences;

  • functional cookies: remember choices and improve features requested by the user;

  • analytics cookies: help us understand visits, pages accessed and performance, including through tools such as Google Analytics;

  • advertising cookies: measure campaigns and may support the display of relevant advertisements, including through Meta technologies;

  • tag managers: tools such as Google Tag Manager help manage the technologies installed on the website.

Non-essential cookies, where based on consent, must remain disabled until the user makes a choice. Users may accept, reject or manage these categories in the website’s cookie banner or preferences panel and may also block or delete cookies in their browser settings.

Rejecting non-essential cookies should not prevent basic browsing, although some personalised features may be limited. Blocking strictly necessary cookies may affect essential functions.

Third-party tools have their own retention periods and practices. Their settings and policies can be consulted through the respective services.

11. Commercial communications

Memphis Turismo may send travel-related content, information and offers through channels provided by the data subject, subject to the legal basis and their legitimate expectations.

Data subjects may opt out of these communications at any time through the mechanism indicated in the message itself or by emailing atendimento@memphisturismo.com.br. Opting out of marketing does not prevent the sending of operational messages necessary for a proposal, booking, contract, payment or trip in progress.

12. Information security

Memphis Turismo adopts technical, administrative and organisational measures appropriate to the nature of the data and the processing risks, seeking to protect data against unauthorised access, loss, destruction, alteration, disclosure or misuse.

These measures may include access controls, system protection, backups, confidentiality obligations, provider selection and internal procedures. No physical or digital environment is entirely free of risk, but security practices are continually assessed and improved.

If an incident occurs that could cause significant risk or harm, Memphis Turismo will take the appropriate measures and make the notifications required by applicable legislation and regulations.

13. Data subject rights

Under the LGPD, data subjects may request, where applicable:

  • confirmation of whether processing takes place;

  • access to personal data;

  • correction of incomplete, inaccurate or outdated data;

  • anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data;

  • portability, subject to regulations and commercial and industrial confidentiality;

  • deletion of data processed on the basis of consent, subject to legal grounds for retention;

  • information about public and private entities with which data has been shared;

  • information about the possibility of withholding consent and the consequences of doing so;

  • withdrawal of consent;

  • objection to processing carried out without consent in the event of non-compliance with the LGPD;

  • review of decisions based solely on automated processing that affect their interests, where such decisions occur;

  • submission of a petition to the National Data Protection Authority or consumer protection bodies.

To protect the data subject and prevent improper access, Memphis Turismo may request reasonable information to confirm the identity or authority of the person submitting a request. Requests will be handled free of charge, within the timeframes and limits established by law.

Some requests may not be met in full where retention or processing is necessary to comply with a legal obligation, perform the contract, prevent fraud, protect third parties or lawfully exercise rights. In such cases, the appropriate explanation will be provided to the applicant.

14. How to exercise your rights and contact us about privacy

Requests, enquiries or complaints relating to personal data may be sent to:

  • Email: atendimento@memphisturismo.com.br — subject: “Privacy and Personal Data”

  • WhatsApp: (11) 96586-1927

  • Telephone numbers: (11) 2361-5409 and (11) 2361-5414

  • Address: Avenida Francisco Matarazzo, 1752, suites 306 and 307, Água Branca, São Paulo — SP, postal code 05001-200 — in-person service by appointment.

This is the channel made available by Memphis Turismo for communications from data subjects. If the company formally appoints a personal data protection officer, their identity and contact details will be clearly disclosed on this page.

15. Relationship with the Terms and Conditions

The general rules for booking and the provision of tourism services are available in the Terms and Conditions. If there is any question about data processing for a particular booking, the data subject may also consult the individual contract, proposal, travel documents and specific notices presented when data was collected.

16. Updates to this Policy

This Policy may be updated to reflect legal, regulatory, technological or operational changes. The current version will always be available on this page, showing the date of the most recent update.

Significant changes requiring new consent will be presented to the data subject through appropriate channels before the corresponding processing takes place.