This Privacy Notice The purpose of this Notice is to clearly and transparently inform data subjects about how their data is collected, used, shared, and protected in the digital environments of the Inhotim Institute ("Institute" or "Inhotim"), in accordance with the General Data Protection Law (Law No. 13.709/18), ensuring the protection of privacy and information security. 

The Inhotim Institute is committed to the continuous improvement of its privacy and security practices, in order to guarantee the appropriate, responsible and proportionate treatment of personal data, respecting the rights of data subjects as provided for in the legislation. By accessing and using our website or other digital channels, the data subject acknowledges and agrees to the conditions established in this Notice. 

What personal data can be collected? 

While you browse our digital environments, the following personal data may be collected and stored: 

1. Information provided directly by you: such as name, surname, email, phone number, CPF (Brazilian tax identification number), date of birth, postal code, and credit card information (for purchases), when filling out forms, making purchases, or registering for events/programs.
2. Information Collected Automatically: such as IP address, browser type and version, operating system, approximate geolocation information (city), as well as access and browsing data (logs, cookies, among others). 

Your personal data is used for:

 

Purpose of treatment	Legal base	Notes
Allow browsing and use of digital services.	Legitimate interest (Art. 7, IX)	Necessary for the website to function and for a better user experience.
Respond to requests and communications made through the website.	Contract execution (Art. 7, V)	Answering questions, providing support, and improving services.
Selling tickets, registering people for events, and selling items from the store.	Contract execution (Art. 7, V)	To facilitate the purchase of tickets, registration and participation in events, as well as the acquisition of products from the store.
Manage participation in the Friends of Inhotim program.	Contract execution (Art. 7, V)	Benefits administration, relationship management, and communication with program members.
Comply with legal and regulatory obligations	Compliance with a legal or regulatory obligation (Art. 7, II)	Compliance with applicable legal, regulatory, and tax requirements.
Sending newsletters and institutional communications.	Consent of the data subject (Art. 7, I)	Consent via form on the website; revocation possible at any time via the unsubscribe link.
To serve the legitimate interests of the Institute, while respecting the rights of the data subject.	Legitimate interest (Art. 7, IX)	Examples: fraud prevention, information security, monitoring, non-promotional communications, improvements, etc.

 

The Inhotim Institute uses legitimate interest as a legal basis only in situations where data processing is necessary to ensure the security of operations, fulfill requests from data subjects, prevent fraud, maintain website functionality, or continuously improve services, always respecting the rights, freedoms, and legitimate expectations of the data subject. 

Your personal data may be shared with: 

 

1. Technology service providers, such as website and email hosting providers;
2. Sympla platform, responsible for ticket sales (Sympla Privacy Policy);
3. Partner Evoé, responsible for managing the Friends of Inhotim program (Evoé Terms of Use);
4. RD Station platform, used for marketing and communication automation (RD Station Privacy Policy);
5. Shopify platform, used for managing online stores and online sales (Shopify Privacy Policy);
6. Digital marketing and advertising service providers, such as Facebook/Meta (Facebook Pixel) and Google (Google Adsense), receive browsing information for campaign measurement and ad personalization purposes, always with the consent of the data subject;
7. Other partners and authorities, whenever there is a legal obligation, contractual need, or to ensure the proper provision of services. 

 

4.1 Personal data of children and adolescents 

The processing of personal data of children and adolescents by the Inhotim Institute is carried out exclusively with specific and prominent consent, granted by at least one of the legal guardians, in accordance with Article 14 of the General Data Protection Law (LGPD). The personal data of minors is not used for marketing, advertising or profiling purposes, except when there is express legal authorization or consent from the guardians. 

Personal data will be stored only for the time necessary to fulfill the purposes stated in this Privacy Notice, in accordance with applicable legal, regulatory or contractual obligations, as well as any deletion request submitted by the data subject, when applicable. 

The retention period may vary depending on the nature of the data, the legal basis used for processing, and applicable regulatory requirements. Once the retention period has ended or the purpose has been achieved, personal data will be deleted or anonymized, except in cases where retention is authorized by the LGPD (Brazilian General Data Protection Law), such as for compliance with legal or regulatory obligations, the regular exercise of the Institute's rights, or defense in administrative and judicial proceedings. 

Some personal data collected by the Inhotim Institute may be transferred to and processed on servers located outside of Brazil, especially when using hosting services, cloud storage, ticket sales platforms (Sympla), and program management systems (Evoé), which may operate in other countries. 

These transfers occur to enable the provision of contracted services and comply with the requirements and safeguards set forth in the General Data Protection Law (LGPD), including specific contractual clauses and other guarantees required by law. The Inhotim Institute is in a process of continuous improvement of its information security and privacy practices, including the review of processing flows and protection measures applicable to data transferred internationally. 

If you have any questions about international data transfers, you can contact the Data Protection Officer (DPO) directly for further clarification. 

The Inhotim Institute website uses essential cookies, necessary for the proper functioning of the pages and secure browsing, as well as marketing/third-party cookies, used to personalize ads and measure interactions in digital campaigns. The use of marketing/third-party cookies depends on the user's consent. 

 

8.1 Types of cookies used 

 

Type of cookie	Description and purpose	Examples
Essenciais cookies	Necessary for the website to function. They allow navigation, correct page display, and access to secure areas.	Login, authentication, session
Marketing/third-party cookies	Used to personalize ads and measure interactions in digital campaigns. They depend on user consent.	Facebook Pixel, Google Adsense

 

8.2 Cookie Management 

You can manage or delete cookies at any time directly in your browser settings. Additionally, you can accept or reject marketing/third-party cookies (such as Facebook Pixel and Google Adsense) via the consent banner displayed when accessing the website. 

The Inhotim Institute respects user privacy and observes the provisions of the General Data Protection Law (LGPD) in the processing of information obtained through cookies. For more information, please see our [Cookie Policy]. 

The Inhotim Institute website uses essential cookies, necessary for the proper functioning of the pages and secure browsing, as well as marketing/third-party cookies, used to personalize ads and measure interactions in digital campaigns. The use of marketing/third-party cookies depends on the user's consent. 

 

8.1 Types of cookies used 

 

Type of cookie	Description and purpose	Examples
Essenciais cookies	Necessary for the website to function. They allow navigation, correct page display, and access to secure areas.	Login, authentication, session
Marketing/third-party cookies	Used to personalize ads and measure interactions in digital campaigns. They depend on user consent.	Facebook Pixel, Google Adsense

 

8.2 Cookie Management 

You can manage or delete cookies at any time directly in your browser settings. Additionally, you can accept or reject marketing/third-party cookies (such as Facebook Pixel and Google Adsense) via the consent banner displayed when accessing the website. 

The Inhotim Institute respects the privacy of its users and observes the provisions of the General Data Protection Law (LGPD) in the processing of information obtained through cookies. For more information, please consult our [link to privacy policy/policy]. Cookies Policy. 

According to the General Data Protection Law (Law 13.709/18), you may exercise, at any time and free of charge, the following rights in relation to your personal data processed by the Inhotim Institute.  

All rights can be exercised free of charge through the following channel: integridade@inhotim.org.br. For institutional communications (e.g., newsletters), use the link The unsubscribe option is available in the emails themselves. 

 

Holder's right	Description
Confirmation of the existence of treatment.	Request confirmation as to whether or not your personal data is being processed.
data access	Request access to personal data processed by the Institute.
Correction of incomplete, inaccurate or outdated data	Correct or update personal data.
Anonymization, blocking, or deletion of unnecessary, excessive, or irregular data.	Request the correction or deletion of data that is not in compliance with the LGPD (Brazilian General Data Protection Law).
Data portability to another provider.	Request the transfer of data to another provider, when applicable.
Deletion of data processed with consent	Request the deletion of your data, except if it is retained due to a legal obligation.
Information about data sharing	Obtain information about third parties with whom the data may be shared.
Information about the possibility of not providing consent and the consequences.	To be informed about the consequences of choosing not to provide consent.
Review of automated decisions	To request a review of decisions made solely on the basis of automated processing of personal data and to obtain information on the criteria and procedures used, where applicable.
Revocation of consent	Revoke previously given consent; for newsletters, use the unsubscribe link available in the emails.

 

Your request will be evaluated and answered within the legal deadlines, taking into account any applicable legal or regulatory restrictions. Some requests may be limited due to legal obligations or the legitimate interest of the Institute, in accordance with the LGPD (Brazilian General Data Protection Law). If it is not possible to fulfill your request, you will be informed clearly and transparently of the reasons. 

 If, after analysis by the Inhotim Institute, you believe that your request has not been adequately addressed, you may file a complaint directly with them. National Data Protection Agency (ANPD). 

The Inhotim Institute maintains institutional profiles on the following platforms: 

1. Facebook;
2. IInstagram;
3. Twitter/X;
4. YouTube;
5. LinkedIn;
6. TikTok

The processing of personal data on these platforms is carried out in accordance with the respective privacy policies and terms of use of each social network, and is the sole responsibility of the companies providing these services. 

We recommend that you carefully read the privacy rules and policies of each platform before interacting with Instituto Inhotim content in those environments. 

By accessing and using the Inhotim Institute website, the user agrees to observe the following rules, responsibilities, and limitations: 

 

Appearance	Rule applied
Intellectual property	All content, trademarks, and elements of this website belong to the Inhotim Institute. Any unauthorized use may result in civil and/or criminal liability.
User Responsibilities	Use the site ethically and responsibly; be accountable for your actions; repair any damages resulting from non-compliance with these terms, the law, or violations of rights; ensure that any content submitted does not infringe the rights of third parties.
Limitations of liability	The Inhotim Institute is not responsible for acts, omissions, or damages caused by the user or third parties, technical failures, system unavailability, or any malicious programs resulting from internet browsing.
Measures to be taken in case of non-compliance.	In the event of a violation of these Terms of Use, the Institute may, at its discretion: suspend or limit access to the website, terminate user accounts, or take other legal and administrative measures to ensure compliance with these Terms and the law.

If you have any questions, requests, or complaints related to the processing of personal data or this Privacy Notice, you can contact the Data Protection Officer (DPO) of the Inhotim Institute directly: 

Name: Eduardo Felipe Abreu da Rocha 

Email: integrity@inhotim.org.br 

For other institutional or operational matters, please access the channel. "Contact Us" Available on the website. Our team is ready to assist you. 

This Privacy Notice may be changed or updated at any time by the Inhotim Institute, aiming to improve transparency and compliance with current legislation. 

We recommend that you consult this Notice periodically to stay informed about any changes. In the event of significant changes, especially those involving new authorizations or the processing of personal data for different purposes, the Inhotim Institute will notify data subjects through the website or available contact channels. 

Brumadinho, October 06, 2025.