Privacy policy
Vitrine do Pão Panificadora e Confeitaria LTDA · vitrinedopao.com · version written in October 2026
Who signs this policy
This policy belongs to VITRINE DO PAO PANIFICADORA E CONFEITARIA LTDA, registered under CNPJ 15.801.714/0001-76, with its counter on Rua Quinze de Novembro, São Judas district, Tatuí, state of São Paulo, Brazil, postal code 18276-010. For the purposes of Brazilian Law 13.709/2018, the General Personal Data Protection Law (LGPD), the bakery is the controller of the information described here: it decides why and how that data is used.
The text covers two situations: visiting this website and getting in touch by e-mail for orders, questions or event requests. In the physical shop, in the daily routine of the counter, the bakery asks for no personal data beyond what issuing an invoice requires.
What we ask from those who place orders
An order can only be prepared with some information, and the bakery asks only for what makes a difference to the batch and to collection:
- a name to identify the order at the counter;
- the e-mail address used in the conversation, to reply and confirm;
- the date and time of collection;
- what was ordered: product, quantity, flavours and, if any, the message written on the cake;
- a telephone number, only when the person chooses to give one, for last-minute notices about the order;
- invoice details, when the customer wants the invoice in their own name or in a company's name.
None of this is required to read the website. Anyone who only wants to know what is on the counter does not need to provide anything.
How that information moves around the bakery
Order data serves three purposes: preparing what was requested, handing it over at the counter to the right person and issuing the invoice. The e-mail conversation stays in the bakery's inbox, and the order is written into the oven schedule with the name and the collection date.
The bakery does not use this information to send advertising, does not build a mailing list from the addresses of people who ordered and does not combine this data with information obtained from third parties. An e-mail sent to arrange a party ends when the order is collected and the invoice is filed.
Legal basis: performance of the request made by the person themselves and compliance with the company's tax obligations. No processing described here depends on separate consent, because everything follows from the order the customer placed.
Delivery and payment partners
Collection takes place at the counter, so the bakery does not pass anyone's address to delivery services. When an order is paid by card or bank transfer, the transaction goes through the financial institution or the card terminal used at the counter, which handles payment data under its own rules; the bakery only sees the confirmation that the amount was paid.
Invoice data is transmitted to the state tax authority's system, as the law requires, and may be seen by the accounting firm that serves the company, within the contracted service. Apart from these cases, the bakery does not sell, assign or share customer information with other companies.
This website and your browser
This page is a set of fixed files. It has no form, no login area, installs no tracking cookies and runs no audience analytics scripts. The contact button opens the visitor's own e-mail program; the content of the message leaves from there, not from the website.
The server hosting the site records, like any server, the IP address, the date, the time and the page requested, for the sole purpose of keeping the service running and identifying faults. Those records are not matched to any name or order. Typefaces are loaded from Google's font service, which receives the browser's request in order to deliver the font files.
How long orders are kept
Order messages stay in the bakery's mailbox for up to twelve months after collection, long enough to settle any question about an order already delivered, and are deleted afterwards. The invoice and the accounting records are kept for the period that tax legislation determines, because the company is required to keep them.
A telephone number given for last-minute notices is discarded as soon as the order leaves the counter. Server logs are periodically overwritten by the hosting service itself.
Requests from data subjects and the officer's channel
Anyone whose data is handled by the bakery may ask, at any time, for confirmation that it exists, access to what is stored, correction of anything incomplete or wrong, deletion of what is no longer needed, information about whom it was shared with and portability, under article 18 of Law 13.709/2018. They may also ask the bakery to stop using a specific piece of data, subject to tax obligations.
The officer in charge of personal data can be reached at contato@vitrinedopao.com. Requests are answered within 15 business days. If the answer does not settle the matter, the person may take the question to the Brazilian National Data Protection Authority, the ANPD, at gov.br/anpd.
Version and updates
This is the first version of the policy, written in October 2026 together with the website. If the bakery starts taking orders through another channel or changes the way orders are stored, the text will be updated on this same page, with the new date at the top. What applies is always what is published here at the time of reading.