Privacy policy.

What we collect and why

• Quote requests (contact page). Name, email, phone, the adventure you are interested in, dates, group size, how you are arriving and your message. The form sends nothing to our server: it puts the message together and opens your WhatsApp or email app, and you decide whether to send it. We use this to reply and prepare your quote.
• Participant form. Name, date of birth, passport or ID number, age, nationality, profession, phone, email, address, height, weight, trip date, payment method, where you are staying in Chapada and an emergency contact. We use it to know who is on the trail, organise the trip (transport, lodging, meals) and act quickly if something happens.
• Health information (in the form). Fitness level, allergies, dietary restrictions, medication, health conditions and mobility difficulties. Brazilian law treats this as sensitive data: we only use it for your safety — adjusting pace and route, briefing your guide and informing rescue services in an emergency — and only with your consent, given in the form itself.
• Trip photos and videos. The terms in the form allow us to use your image and voice to promote Mamut. If you would rather not appear, just tell us and we will stop using them in future posts.
• Browsing. We use no analytics or advertising tools and set no tracking cookies of our own. The server logs technical data about each visit (IP address, date, time and page), as Brazilian internet law requires. Your light or dark theme preference is stored only in your browser.

Legal bases

We process personal data under Brazil’s General Data Protection Law (LGPD, Law 13,709/2018):

• quote requests and bookings: steps prior to and performance of the trip contract (art. 7, V);
• health data: your specific consent (art. 11, I) and, in an emergency, protecting your life and physical safety (art. 11, II, "e");
• access logs and booking records: compliance with legal obligations (art. 7, II) and the exercise of rights in legal proceedings (art. 7, VI);
• bot protection on forms: our legitimate interest in keeping the site secure (art. 7, IX).

Who we share it with

We never sell or rent personal data. We share only what is needed with:

• The people who run the trip with us. Guides, drivers and the homes and guesthouses on the route get your name and what they need to know to look after you — a dietary restriction, for example, or a health condition that matters on the trail.
• Services we use to work. Resend (sending the participant form by email), Google (reCAPTCHA, which tells people from bots on our forms), Meta (WhatsApp, when you choose to talk there), Notion (our internal booking records), our email provider and our website host.
• Authorities. When the law requires it or in an emergency — rescue services or a hospital, for example.

International transfers

Some of these services (Resend, Google, Meta and Notion) store data on servers outside Brazil, mainly in the United States. We choose providers that offer contractual data protection clauses, as article 33 of the LGPD provides.

How long we keep it

• Quote requests that did not become a booking: up to 12 months.
• Participant form and booking data: up to 5 years after the trip — the period for claims under the Brazilian Consumer Code.
• Website access logs: 6 months, as Brazilian internet law requires.

After that, the data is deleted or anonymised.

Security

The site only works over an encrypted connection (HTTPS), our forms are protected against bots and access to participant forms is limited to the team organising your trip. No system is infallible; if an incident could affect you, we will tell you and Brazil’s National Data Protection Authority (ANPD).

Your rights

At any time, you can ask for:

• confirmation that we process your data, and access to it;
• correction of incomplete, wrong or outdated data;
• anonymisation, blocking or deletion of data that is unnecessary or processed unlawfully;
• portability of your data to another provider;
• information on who we share it with;
• withdrawal of consent, including for health data and use of your image;
• objection to any processing you consider irregular.

Send your request by email or WhatsApp (above). We reply within 15 days. If you are not satisfied, you can also complain to the ANPD (gov.br/anpd).

Children and teenagers

Under-18s only take part with, or with the authorisation of, a parent or legal guardian, who fills in or approves the form and gives consent on their behalf.

Changes to this policy

When we change how we handle your data, we update this page and the date at the top. We also tell anyone with an active booking about important changes.