Privacy Policy.

This Policy applies to all personal data processed by our restaurant — including guests who make reservations, event organisers, persons who contact us via WhatsApp or online form and website visitors. Walk-in guests without a reservation who do not provide dietary information and do not request an NF-e/NFC-e dine with us anonymously.

• Reservation data: Name, phone number, email, date, time and party size — collected when guests make a table reservation via WhatsApp or our online form.
• Dietary and allergen information (voluntary): Dietary restrictions and food allergies — including raw fish, shellfish, soy, gluten and sesame — provided voluntarily at reservation or on arrival for safe preparation of Japanese cuisine. See Section XII.
• Private event and group booking data: Name, company name (where applicable), CPF or CNPJ, event date and party size — for private events and group bookings.
• Billing data: Name and CPF or CNPJ for NF-e / NFC-e issuance — in compliance with SEFAZ-RS and ISS/Prefeitura de Santo Antônio da Patrulha requirements.
• Contact and communication data: Messages via WhatsApp, telephone or online form.
• Technical website data: IP address, browser type, pages visited and access times.

• SEFAZ-RS / Receita Federal: Tax data for NF-e / NFC-e issuance and applicable federal and state tax compliance.
• Prefeitura de Santo Antônio da Patrulha (ISS): For ISS/ISSQN obligations on restaurant activities.
• ANVISA / VISA-RS (Vigilância Sanitária): In the context of food safety inspections or regulatory compliance — only as legally required.
• PROCON-RS: When required in a consumer dispute mediation under the CDC.
• Legal authorities: When required by a competent judicial or administrative order.

Dietary and allergen information is shared only with kitchen staff for the specific visit and never externally.

Our restaurant operates exclusively in Santo Antônio da Patrulha, RS. Primary storage is in Brazil. Any technology platforms for communication or reservations that operate on international servers do so only under Art. 33 of the LGPD or recognised adequacy mechanisms.

• NF-e / NFC-e and fiscal records: Minimum 5 years under federal and state tax legislation (CTN, Art. 174; SEFAZ-RS).
• Restaurant meals — CDC perishable period: Restaurant food and beverages are perishable goods under CDC Art. 26, I — the 30-day complaint period applies. Relevant records retained up to 2 years for dispute purposes.
• Reservation and event data: Up to 1 year from reservation date, retained for seasonal booking analysis and any post-dining dispute within the CDC period.
• Allergen and dietary data: Retained only for the duration of the specific visit and discarded thereafter, unless the guest explicitly requests retention for future visits.
• Website analytics: Aggregated and anonymised after 12 months.

• Reservation and guest data accessible only to restaurant management and authorised front-of-house staff;
• Allergen and dietary information shared with kitchen team only for the specific visit — not retained in general guest databases without consent;
• Raw fish and sushi-grade ingredients stored and handled in compliance with ANVISA temperature and hygiene standards for raw fish handling;
• WhatsApp reservation communications handled with discretion;
• Encryption in transit (HTTPS) for website and digital communications;
• PCI-DSS certified payment terminals — card data never retained;
• As a Ltda, formal internal data handling protocols maintained;
• Incident response procedures and breach notification per LGPD Art. 48.

• Confirmation and Access (Art. 18, I–II): Confirm whether we hold your data and receive a copy.
• Correction (Art. 18, III): Request correction of inaccurate data.
• Anonymisation / Blocking / Deletion (Art. 18, IV): Request restriction or deletion — subject to fiscal NF-e retention obligations.
• Portability (Art. 18, V): Receive your data in a structured format.
• Deletion of consent-based data (Art. 18, VI): Request deletion of consent-based data, including any retained allergen information.
• Information on sharing (Art. 18, VII): Find out which entities your data has been shared with.
• Withdrawal of Consent (Art. 8º, §5º): Withdraw consent at any time.
• Complaint to the ANPD (Art. 18, §1º): Lodge a complaint at www.gov.br/anpd.

We respond within 15 business days.

Our website may use cookies for essential functionality and aggregated performance analysis. We do not use behavioural tracking cookies for advertising without prior consent. Preferences can be managed through browser settings.

Sushi House welcomes guests of all ages. We do not collect personal data from children under 13. For reservations that include children, the booking is attributed to the responsible adult. We never use guest data for marketing to minors.

Dietary restrictions and food allergies may relate to health conditions and may constitute health-related data under LGPD Art. 5º, II in certain contexts. At a Japanese restaurant, the most common clinically significant allergens are:

• Raw and cooked fish and shellfish (salmon, tuna, shrimp, crab, octopus, scallop) — present throughout the sushi menu;
• Soy (shoyu, soy sauce, miso, edamame, tofu) — present in most Japanese dishes;
• Sesame (sesame oil, sesame seeds, tahini) — frequently used in Japanese sauces and garnishes;
• Gluten / wheat (present in most soy sauces unless tamari is specified, and in some rolls and batters);
• Eggs (present in some sauces and preparations).

We comply with ANVISA's mandatory allergen declaration obligations under RDC 26/2015 and RDC 727/2022 for all menu items, and with ANVISA's specific raw fish handling and temperature control requirements for sushi and sashimi preparation.

This Policy may be updated to reflect changes in our activities, the LGPD, ANPD guidance, ANVISA regulations or applicable tax legislation. Material changes will be communicated via our website or via WhatsApp to active reservation contacts.

All privacy requests, questions and complaints should be directed to our Data Protection Officer (Encarregado — LGPD Art. 41):