1. PURPOSE

This Privacy and Personal Data Protection Policy establishes the criteria, principles, procedures, and measures adopted by "LUX ANDES CUSCO" (hereinafter, "THE AGENCY") to ensure the proper processing of personal data belonging to its clients, users, potential clients, providers, collaborators, and other individuals whose data may be processed in connection with its commercial and tourism activities.

THE AGENCY acknowledges that the protection of personal data constitutes a fundamental right, recognized under Article 2, item 6 of the Political Constitution of Peru, and commits to carrying out its processing while respecting the rights, principles, and guarantees established in Peruvian law.

This Policy is interpreted and applied in accordance with Peruvian legal provisions, such as Article 2, item 6 of the Political Constitution of Peru; Law No. 29733 (Personal Data Protection Law); its Regulations approved by Supreme Decree No. 016-2024-JUS; as well as directives, guidelines, criteria, and provisions issued by the National Authority for Personal Data Protection and other applicable standards governing personal data processing, e-commerce, contracting, electronic communications, and tourism service provision. In this framework, Law No. 29733 aims to guarantee the fundamental right to personal data protection, ensuring its processing is carried out in an appropriate manner and respectful of other fundamental rights.

Consequently, THE AGENCY guarantees that personal data will be collected, registered, organized, stored, used, communicated, retained, and, when applicable, erased in compliance with current personal data protection legislation, respecting the principles of legality, consent, purpose, proportionality, quality, security, recourse availability, adequate protection level, and other applicable principles.

This Policy applies to personal data collected through THE AGENCY'S website "LUX ANDES CUSCO", physical or digital forms, booking platforms, email, phone calls, WhatsApp, social networks, in-person assistance, and any other channel through which THE AGENCY collects or processes personal information.

2. DATA CONTROLLER

The Personal Data Controller is: Company Name: LUX ANDES CUSCO E.I.R.L., Tax ID (RUC): 20616590201, Legal Address: Urb. San Antonio 7- Cusco – Cusco-Peru, Phone Contact: +51 942728617, Contact Email: [email protected]; THE AGENCY determines the purposes and means of processing personal data under its responsibility and adopts the necessary measures to ensure that such processing is carried out in compliance with Peruvian law.

When THE AGENCY hires third parties to carry out specific activities involving personal data processing on its behalf, such third parties shall act, as applicable, in their capacity as data processors and must comply with obligations regarding confidentiality, security, and processing in accordance with the instructions, purposes, and conditions established by THE AGENCY and applicable legislation, prioritizing compliance with personal data protection pursuant to Law No. 29733 and its Regulations approved by Supreme Decree No. 016-2024-JUS.

3. GUIDING PRINCIPLES

The processing of personal data by THE AGENCY shall be carried out in accordance with the principles established in Law No. 29733, Personal Data Protection Law, and its Regulations, ensuring that information is processed in a lawful, responsible, and secure manner. In particular, the following principles shall be observed: legality, by which data shall be collected and processed in accordance with current legislation and through lawful means; consent, where applicable, ensuring that the data subject grants authorization freely, priorly, expressly, unequivocally, and knowingly; purpose, whereby data shall be used solely for specified, explicit, and legitimate purposes related to the services offered; proportionality, limiting collection and processing to data that are necessary, relevant, and adequate for the stated purposes; and security, through the adoption of technical, organizational, and legal measures aimed at protecting data against loss, alteration, unauthorized use, or access.

4. PERSONAL DATA WE COLLECT

For the provision of its tourism services, "LUX ANDES CUSCO" may collect and process only personal data that are adequate, relevant, and necessary for specified, explicit, and lawful purposes, in accordance with Law No. 29733, Personal Data Protection Law, its Regulations approved by Supreme Decree No. 016-2024-JUS, and other applicable regulations.

Identification and contact data may be processed, such as full name, national ID (DNI), passport number, nationality, date of birth, phone number, WhatsApp, and email address; as well as information linked to reservations, travel dates, number of passengers, itineraries, payments, ticket issuance, and payment receipts.

Likewise, through the website and digital channels of LUX ANDES CUSCO, technical browsing data may be collected, such as IP address, browser type, operating system, visited pages, and data obtained via cookies or similar technologies, in accordance with the communicated purposes and applicable legal basis.

Regarding sensitive personal data, its processing shall be limited to cases where it is necessary, relevant, and proportionate for a specified, explicit, and lawful purpose, provided there is a valid legal basis for doing so. Where applicable, consent must comply with the requirements established in Law No. 29733 and its Regulations.

Under no circumstances shall excessive or unnecessary personal data be collected relative to the purpose justifying its processing.

5. PURPOSE OF DATA PROCESSING

“LUX ANDES CUSCO” "LUX ANDES CUSCO" will collect and process personal data for specified, explicit, and lawful purposes, previously communicated to the data subject, and solely to the extent necessary to fulfill such purposes. The information obtained will not be used for purposes incompatible with those that motivated its collection, unless legally authorized or upon receiving the data subject's consent when required.

Asimismo, “Likewise, "LUX ANDES CUSCO" will adopt the necessary measures to ensure that the processing of personal data is carried out in a proportionate and secure manner, limiting its collection, use, storage, and retention to what is strictly necessary. To this end, it will apply technical, organizational, and legal measures designed to prevent its loss, alteration, unauthorized access, use, or disclosure.

The communication or transfer of personal data to third parties shall only take place when there is a supporting legal basis, when it is necessary for the provision of the contracted services, or when complying with a legal obligation.

6. CONSEQUENCES OF REFUSING TO PROVIDE PERSONAL DATA

Providing certain personal data may be necessary for the contracting, management, and proper provision of the tourism services offered by "LUX ANDES CUSCO". In cases where the data subject refuses to provide information essential to make a reservation, issue tickets, manage a contracted service, or comply with a legal obligation, THE AGENCY may be unable, in whole or in part, to provide or manage the corresponding service, a circumstance that will be promptly communicated to the data subject.

Likewise, when specific data is required to verify the identity of the data subject, coordinate contracted services, issue corresponding documentation, or fulfill requests directly linked to service provision, failure to supply it may prevent the execution of requested services. In such events, THE AGENCY will clearly inform the data subject in advance about the necessity of providing such data and the potential consequences of refusal.

On the other hand, refusal to provide personal data intended exclusively for optional purposes shall not, in itself, condition the contracting or provision of the main service. In any case, requested information must be directly related to the purpose motivating its processing and be adequate, relevant, and not excessive, in accordance with the national regulatory framework.

7. CONSENT

The processing of personal data is carried out based on the free, prior, informed, express, and unequivocal consent of the DATA SUBJECT In digital channels or web platforms, consent is manifested through express acceptance of this Privacy Policy via checkboxes or affirmative actions within contact or booking forms. When the user provides data via in-person service, phone calls, email, social networks, or WhatsApp, it shall be understood that consent has been granted upon having been previously informed about this policy and voluntarily submitting personal information.

8. TRANSFER TO THIRD PARTIES AND DATA PROCESSORS

"LUX ANDES CUSCO" does not sell, commercialize, rent, or lease the personal data of its users. However, when necessary for the contracting, management, and proper provision of tourism services, it may transfer certain personal data to third parties directly involved in its execution, such as lodging establishments, transport companies, tour operators, guides, railway companies, and other service or tourism activity providers.

Likewise, personal data may be communicated to public entities or competent authorities when such communication is based on a legal obligation, an order from a competent authority, or is necessary for issuing named tickets, registrations, authorizations, or other procedures directly linked to the contracted services.

Similarly, "LUX ANDES CUSCO" may engage technology service providers involved in managing payment services, electronic invoicing, web hosting, storage, and information management and processing. In these cases, such third parties must process personal data solely for the corresponding purposes and in accordance with instructions, security conditions, and obligations set forth in Law No. 29733 (Personal Data Protection Law), its Regulations, and other applicable rules.

In all cases, the communication or transfer of personal data shall be limited to information that is adequate, relevant, and necessary for the underlying purpose, with THE AGENCY striving to ensure that third parties participating in processing adopt the necessary measures to safeguard information confidentiality and security, preventing its use for purposes other than those justifying its transfer.

9. CROSS-BORDER DATA FLOW

When the technological services used by "LUX ANDES CUSCO" involve the storage, access, or processing of personal data outside Peruvian territory, such cross-border data flow shall be carried out in accordance with the conditions, guarantees, and other requirements set forth in Law No. 29733 (Personal Data Protection Law), its Regulations, and all applicable legislation.

This situation may arise, among other cases, when THE AGENCY uses web hosting services, cloud storage, management platforms, or other technological tools whose servers or infrastructure are located abroad.

In such cases, "LUX ANDES CUSCO" will adopt the necessary measures to ensure that personal data maintains an adequate level of protection and security, and will provide the data subject with the relevant information regarding cross-border data flows when required under applicable law.

10. RETENTION AND SECURITY

Data shall be retained only for the period necessary to fulfill the purpose for which it was collected or for the timeframes established by law.

LUX ANDES CUSCO" will implement technical, organizational, and legal measures aimed at preventing unauthorized access, loss, alteration, disclosure, or misuse of personal data.

11. SECURITY MEASURES

"LUX ANDES CUSCO" will adopt and implement reasonable and appropriate technical, organizational, and legal measures, according to the nature of the personal data processed and the risks associated with its processing, in order to prevent its loss, alteration, unauthorized access, use, or disclosure.

For this purpose, THE AGENCY may implement security mechanisms such as SSL certificates on its website, information access controls, protection measures for physical and digital documents, as well as internal security and confidentiality policies.

These measures shall be reviewed as necessary and adapted to evolving risks, processing characteristics, and obligations established by national law.

12. EXERCISE OF ARCO RIGHTS

The personal data subject may exercise their rights of Access, Rectification, Cancellation, and Opposition (ARCO) regarding the processing of their personal information, as well as all other rights recognized under applicable data protection legislation.

To exercise these rights, the data subject must submit a request via email to [email protected][email protected], placing in the subject line "ARCO REQUEST – [Name of Data Subject]". The request must contain sufficient information to identify the data subject, clearly specify the right intended to be exercised, and, where applicable, verify identity or legal representation.

LUX ANDES CUSCO will process and fulfill requests in accordance with the requirements, conditions, and deadlines established by current legislation, adopting the necessary measures to guarantee proper care and protection of the data subject's rights.

13. COOKIE POLICY AND EXTERNAL LINKS

The "LUX ANDES CUSCO" website may use first-party and third-party cookies to ensure its proper functioning, improve the browsing experience, and obtain statistical information regarding platform usage. Users may manage or configure cookies through their browser options according to their preferences.

Additionally, the website may contain links to third-party pages, platforms, or services. "LUX ANDES CUSCO" shall not be responsible for the privacy policies, content, terms of use, or personal data processing practices applied by such third parties; users are therefore recommended to review their respective policies before providing personal information.

14. AMENDMENTS AND EFFECTIVE DATE

LUX ANDES CUSCO" may modify, update, or supplement this Privacy Policy whenever necessary to adapt it to changes in applicable legislation, updates to internal procedures, the introduction of new services, or the implementation of new technologies that may impact personal data processing.

Any modification shall be made known to users by publishing it on the official "LUX ANDES CUSCO" website, indicating the date of its last update. The modified version shall take effect upon publication, unless applicable regulations establish a different date or require additional measures

Modifications shall not affect the rights granted to personal data subjects, nor may they imply processing contrary to the informed purposes and conditions. LUX ANDES CUSCO must at all times observe the regulations in force regarding personal data protection.