LGPD and Privacy for Brand Activations in Cidade Jardim and Pinheiros

The first step is to identify the purpose of each collection. A registration form for access control is different from a form requesting consent for promotional messages, and neither should automatically include every possible marketing field. Collect only what is necessary for the stated purpose, with a clear explanation in language guests can understand.

Brands, agencies, venues, ticketing providers, Wi-Fi suppliers, CRM platforms, and concierge teams may have different roles under the LGPD. Depending on the arrangement, the brand may determine the purpose and means of processing, while a supplier processes data on documented instructions. In some situations, two organizations can make independent decisions about a later use of the same information, creating a need for separate governance rather than a broad assumption that one party controls everything.

The legal basis also needs to match the activity. Consent may be appropriate for optional promotional communications, but consent should be specific, informed, demonstrable, and easy to withdraw. Other processing, such as necessary event administration, may rely on a different legal basis, subject to the brand’s privacy team and legal assessment.

Sensitive personal data requires additional care. Health information collected for a performance program, accessibility support, dietary restriction, or sports participation should not be requested casually or stored in an open spreadsheet. The ANPD guidance on processing agents and the data protection officer is a useful reference when assigning responsibilities.

Guests also need a practical way to exercise their rights, including access, correction, information about processing, and withdrawal of consent where applicable. The event team should know who receives a request, how it is escalated, and which party has authority to answer it. A QR code linking to a privacy notice is helpful, but it does not replace an accountable process.

Technology should be tested as part of the event rehearsal, not only by the marketing team after launch. Build a test record for each channel and use fictional data to verify what appears on the device, in the dashboard, in email notifications, and in the CRM or messaging account.

For Wi-Fi, clarify whether access requires an email, phone number, social login, or acceptance of terms. A network access requirement should not quietly become permission for advertising. The captive portal should explain the purpose, distinguish mandatory terms from optional marketing consent, and avoid preselected promotional boxes.

QR codes deserve the same scrutiny. Check the destination URL, mobile readability, form fields, privacy notice, consent timestamp, and confirmation page. If the code is printed on signage or a gift, decide how it will be disabled or redirected after the event so that an old campaign does not keep collecting data without a current purpose.

WhatsApp Business can be useful for concierge, confirmations, and follow-up, but the team must define whether the conversation is operational or promotional. Use approved business processes, identify the organization contacting the guest, preserve the relevant consent or legal basis, and offer a clear route to stop marketing messages.

Manual work is a frequent weak point. A host who copies names into a personal notebook, a photographer who stores a guest list on an unprotected phone, or a supplier who sends a spreadsheet through an informal channel can undermine otherwise strong platform controls. The briefing should prohibit shadow lists and specify the approved devices, accounts, and transfer methods.

A strong RFP asks bidders to respond to privacy requirements in a structured format. Request a data inventory, processing purpose, legal basis assumptions, categories of data, access list, storage location, retention period, subcontractors, incident process, and deletion method. This makes answers comparable without turning the selection into a vague security questionnaire.

A practical contract should identify the event, the approved processing purposes, the permitted data fields, and the instructions that apply to each supplier. It should also prohibit selling, enriching, matching, or reusing event data for unrelated purposes unless the brand authorizes a new assessment and communication plan.

A useful incident clause requires prompt notice after a supplier becomes aware of a suspected incident, along with the known facts, affected systems, categories of data, containment measures, and a contact for follow-up. It should require cooperation with investigation and regulatory or data subject communications, while avoiding an unrealistic promise that no incident can ever occur.

Include security commitments that fit the actual operation: individual accounts, password management, restricted exports, encrypted transfer where appropriate, approved devices, staff confidentiality, access revocation, and secure disposal. If a vendor relies on subcontractors or cloud services, the contract should require disclosure and flow-down obligations.

Retention language should be specific. For example, operational check-in data may be retained only for the period needed for event administration and documented follow-up, while marketing leads may require a separate retention rule tied to the brand’s CRM policy. The parties should agree on whether data is returned, deleted, anonymized, or preserved under a documented legal requirement.

The Grupo SH approach to receiving activations is to align operational teams before doors open, especially when the program includes concierge and guest management. For a Casa SAP-style corporate event or an activation supported by media production, the RFP should make clear which guest information is needed for access, which information is optional, and who controls any later outreach.

One common mistake is treating the venue as either fully responsible for compliance or completely outside the data operation. The correct answer depends on the actual activities, instructions, and decisions made by each party. Put the allocation in writing and revisit it when the activation changes scope.

Another mistake is combining event access with marketing consent. Guests should not be forced to accept promotional communication merely to enter an event unless a qualified legal assessment supports that design. Separate operational notices, optional communications, and any image or content permissions so the guest can understand each choice.

Do not postpone deletion until someone remembers it. The closeout owner should receive a list of active accounts, exports, temporary spreadsheets, printed lists, badges, test records, and vendor copies, then confirm what was deleted, returned, anonymized, or retained with a documented reason.

The ANPD materials on data protection and regulatory guidance can support the privacy team’s review of evolving interpretations and obligations. For a large corporate campaign, involve the brand’s legal, privacy, information security, and procurement teams early enough to adjust the activation without creating operational friction.

A concise closeout report should include the final data map, approved forms, consent evidence where applicable, incident record, supplier confirmations, unresolved requests, and retention decisions. This record is valuable for the next activation because it turns experience from Cidade Jardim or Pinheiros into a repeatable operating standard.