Vestibulum fringilla massa vel ipsum dignissim, vitae interdum urna posuere. Ut tincidunt, felis efficitur cursus pretium, augue quam fermentum sem, at vehicula augue arcu a leo. In dignissim pretium semper.
Vestibulum fringilla massa vel ipsum dignissim, vitae interdum urna posuere. Ut tincidunt, felis efficitur cursus pretium, augue quam fermentum sem, at vehicula augue arcu a leo. In dignissim pretium semper.
The goal of this policy is to explain how Incayza Ecotours protects and handles the personal data of its customers, passengers, suppliers, tour operators, travel agencies, and collaborators. This covers the entire process from data collection through various physical and digital channels, all for clearly communicated purposes.
Incayza Ecotours is a company dedicated to providing services related to individual and group travel via air, sea, or land, including the organization of trips, excursions, accommodation, and any other tourism-related activity. To achieve this, we collect, use, manage, transfer, store, and process information—which may include personal data of individuals—as part of our operations. This data can include, but is not limited to, name, ID, phone number, email address, and country of residence, collected through various physical and digital formats.
In compliance with Peruvian Law No. 29733 (Personal Data Protection Law) and its Regulation No. 003-2013-JUS, as well as the General Data Protection Regulation (GDPR – EU 2016/679), Incayza Ecotours commits to guaranteeing and implementing information security measures based on international best practices, ensuring the confidentiality, integrity, and availability of all provided personal data.
Data Controller: This refers to the natural or legal person who, alone or jointly with others, determines the purposes and means of personal data processing. In this case, Incayza Ecotours will be the controller for personal data obtained through its various collection channels and provided by users of Incayza Ecotours, as well as its associated companies.
Personal Data: Any information relating to an identified or identifiable natural person (the user), such as name, identity document number, passport, location data, or one or more physical, physiological, genetic, psychological, economic, cultural, or social characteristics of a person.
Processing: Any operation or set of operations performed on personal data or sets of personal data (whether automated or not), such as collection, recording, organization, modification, consultation, use, dissemination, or any other form of access, reconciliation or combination, restriction, erasure, or destruction of personal data.
Right of Access: Users have the right to know what data Incayza Ecotours processes about them and to obtain a copy of that data.
Right of Rectification: Users have the right to update, rectify, and/or correct their personal data.
Right of Opposition: Users have the right to object at any time to the processing of their personal data by Incayza Ecotours.
Right of Erasure (“Right to be Forgotten”): Users have the right to request the deletion of their data from any document, file, or location where it is accessible.
Right to Restriction of Processing: Users have the right to request the limitation of their data processing when specific circumstances established by law occur, such as unlawful data processing or when Incayza Ecotours no longer needs the data.
Right to Data Portability: Users have the right to receive their personal data, which they have provided to Incayza Ecotours, in a structured, commonly used, and machine-readable format, and to transmit it to another data controller without hindrance.
Right Not to Be Subjected to Automated Individual Decisions: Users have the right not to be subjected to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them.
Incayza Ecotours processes user data:
When users expressly consent to the processing of their personal data for the purposes detailed in this document; and/or
When the processing is necessary for the performance of a contract for the provision of services and products to which the user is a party.
This policy applies to personal data related to customers, passengers, suppliers, tour operators, travel agencies, and employees, provided by them freely, voluntarily, and knowingly. The information collected and stored includes basic data entered in registration forms, contact forms, or similar, such as name, identity document, passport, gender, age, phone number, email address, country of residence, among others. This data is collected through various channels managed by the company and is necessary for the provision of Incayza Ecotours‘s tourism services. In all cases, users will be informed which data is essential for the correct provision of the service and which is optional before submitting their personal data.
The user is solely responsible for the veracity and accuracy of the data provided. Only individuals over 18 years of age and/or those with sufficient legal capacity can be users. Furthermore, the user is solely responsible for data provided on behalf of third parties, and for ensuring that these third parties have been informed of this privacy policy and have given their express consent.
Incayza Ecotours will adhere to the following principles when processing personal data:
Principle of Legality: Personal data processing within the framework of Law 29733 is a regulated activity that must comply with the provisions of said law and other relevant regulations. The collection of personal data through fraudulent, unfair, or unlawful means is prohibited.
Principle of Consent: In accordance with the principle of consent, personal data processing is lawful only when the owner of the personal data has given their free, prior, express, informed, and unambiguous consent. Forms of consent that are not directly expressed, such as those that presume or assume an unexpressed will, are not permitted. Even consent given alongside other declarations must be expressed explicitly and clearly.
Principle of Purpose: A purpose is considered determined when it has been clearly expressed, without possibility of confusion, and when the objective for which the personal data will be processed is objectively specified. For personal data banks containing sensitive data, their creation is justified only if their purpose, in addition to being legitimate, is specific and aligns with the explicit activities or objectives of the personal data bank’s owner. Professionals who process personal data are bound by professional secrecy, in addition to being limited by the purpose of their services.
Principle of Quality: Processed personal data must be truthful, accurate, and, as far as possible, updated, necessary, relevant, and adequate for the purpose for which they were collected. They must be stored in a way that guarantees their security and only for the time necessary for the purposes of processing.
Principle of Proportionality: All personal data processing must be adequate, relevant, and not excessive in relation to the purposes for which the data was collected.
Security Principle: The owner of the personal data bank and the data controller must implement the necessary technical, organizational, and legal measures to guarantee the security of personal data. These security measures must be adequate and proportionate to the processing to be carried out and to the category of personal data in question.
Principle of Availability of Resources: Every personal data owner must have the necessary administrative or judicial means to assert and demand their rights when they are violated by the processing of their personal data.
Principle of Adequate Protection: For the cross-border flow of personal data, an adequate level of protection for the personal data to be processed must be guaranteed, or at least a level comparable to that provided by law or international standards in this field.
Incayza Ecotours will use the personal data provided by users for the following purposes:
To fulfill the objective of providing the contracted tourist services and products.
To contact clients (travel agencies, companies, and individuals) during the provision of contracted services and products.
To facilitate coordination with suppliers, travel agencies, cruise lines, and hotels.
To provide customers with information about the nature of the service and/or knowledge and compliance requirements during the service (e.g., contractual terms, compliance with tax obligations, and/or other terms that may include internal company policies).
To respond to doubts, questions, and requests.
To justify the settlement of the Value Added Tax for Non-residents to the Tax Administration, using information such as Passport and Andean Migration Card (TAM), among others.
To analyze and identify the expectations and preferences of travel agencies regarding tickets and services.
The company will request personal information from its employees to comply with applicable labor regulations and/or for human resources and talent management projects such as payroll registration, staff attendance, personnel selection, commission payments, among others.
For security within facilities through video surveillance.
To comply with the policy and procedures of the Money Laundering and Terrorist Financing Prevention Policy.
To manage the payment for requested services and products.
To contact you regarding the provision of contracted services and products.
For security within facilities through video surveillance.
The personal data you provide will be stored in the databases described in Annex 2 of this document.
The owner of personal data has the following rights:
The rights of information, access, rectification, cancellation, opposition, and objective treatment of personal data can only be exercised by the owner of the personal data, without prejudice to representation rules.
The exercise of one or some of these rights does not preclude the possibility of exercising others, nor can it be understood as a prior condition for the exercise of any of them.
To know, update, and rectify your personal data with Incayza Ecotours or with the designated data controller. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or data whose processing is expressly prohibited or has not been authorized.
To be informed by Incayza Ecotours or by the designated data processor, upon request, about the use of your personal data.
To revoke authorization and/or request the cancellation of data when the processing does not comply with principles, rights, and constitutional and legal guarantees. The revocation and/or cancellation will be carried out when the National Authority for the Protection of Personal Data has determined that Incayza Ecotours or the designated data processor have acted contrary to Law 29733 and the Constitution.
To free access, under the conditions defined in this document, to your processed personal data.
For Incayza Ecotours to perform any personal data processing action, the prior and informed authorization of the owner is required. This authorization must be obtained through any consultable means (e.g., technical means facilitating automated manifestation, or written/oral consent).
Incayza Ecotours will adopt the necessary procedures to request, at the latest at the time of data collection, the consent of the Data Subject for data processing and will inform about the personal data that will be collected, as well as all specific purposes of the data processing for which consent is obtained.
Personal data found in publicly accessible sources may be processed by Incayza Ecotours to the extent that they are public data by nature. In the event of substantial changes in the content of Incayza Ecotours‘s data processing policies concerning the identification of the controller and the purpose of personal data processing, which affect the content of the authorization, Incayza Ecotours will communicate these changes to the data subjects before or at the latest at the time of implementing the new policies. We will also obtain a new authorization from the data subject if the change pertains to the purpose of the processing. Technical means may be used for communicating changes and obtaining authorization.
Information required by a public or administrative body in the exercise of its legal functions or by judicial decision.
Public data.
Medical or health emergencies.
Treatment of information permitted by law for historical, statistical, or scientific purposes.
Data from the civil registry of persons.
Information requested by the owner will be provided by Incayza Ecotours in the same manner in which the request was made.
At the time of requesting authorization from the owner, Incayza Ecotours will clearly and expressly inform you of the following:
The processing your personal data will undergo and the purpose of said processing.
The optional nature of the answer to questions asked, particularly for sensitive data or data of children and adolescents.
The rights you have as the owner.
The identification, physical or electronic address, and telephone number of the data controller.
Data subjects may, at any time, request Incayza Ecotours to delete their personal data and/or revoke the authorization granted for its processing, by submitting a request in accordance with Law 29733 of 2011 and its Regulation DS Nº 003-2013-JUS of 2013.
A request for data deletion or revocation of authorization will not be processed if the owner has a contractual obligation to remain in the Incayza Ecotours database.
nformation about personal data processed by Incayza Ecotours can be provided to the following individuals:
To the owners, their heirs, or their legal representatives.
To public or administrative bodies in the exercise of their legal functions or by court order.
To third parties authorized by the owner or by law.
Incayza Ecotours adheres to personal data protection measures required by law and has adopted reasonably necessary measures, based on current technical knowledge and good information custody and management practices, to prevent the loss, misuse, alteration, illegitimate intrusion, and theft of personal data provided by users.
The application of security measures aims to guarantee the conservation, confidentiality, integrity, and availability of the data.
Incayza Ecotours‘s security guidelines are based on Incayza Ecotours‘s information security policies, which have been prepared in accordance with best practices, existing security standards, and compliance with current regulations.
These policies are strictly respected by all direct and indirect employees who work at Incayza Ecotours.
The owner or their assignees have the right to submit inquiries and/or claims to Incayza Ecotours, after verifying their identity, by writing to the following address. You can also, at any time, withdraw your consent to the processing of personal data and/or exercise your rights of access, information, rectification, opposition, cancellation, limitation, right to be forgotten, portability, and not being subject to individualized decisions, by writing to Incayza Ecotours “PERSONAL DATA” at the following addresses:
Physical/Legal Address: Cusco 123
Email: info@incayzaecotours.com
Incayza Ecotours will respond to the request and/or claim in the same manner in which it was made.
Those responsible for the processing or their successors in title may consult the personal information of the person responsible for the treatment contained in the Incayza Ecotours database. Incayza Ecotours will provide the applicant with all information contained in its databases related to the identification of the data subject.
The owner may consult their personal data free of charge when there are substantial changes in Incayza Ecotours‘s data processing policies.
All requests will be processed by the same means they were submitted within 5 working days from their submission. To exercise this right, the interested party or their assignees must submit the access form, which is included in the annex to this policy.
The Data Subject or their successors who believe that the information contained in a database must be rectified, canceled, or opposed, or who notice an alleged violation of any duties contained in Law 29733 of 2011, may submit a request to the Owner of the Personal Data Bank or the data processor at Incayza Ecotours. To comply with these rights, the Data Subject or their assignees must submit the respective form, found in the annex to this policy.
If the application does not meet the established requirements, the applicant is obligated, within five (5) days from receipt of the application, to correct the defects. If this period elapses without the correction being made, the request will be deemed not submitted.
In the event that the information provided in the application is insufficient or erroneous in a way that prevents its attention, Incayza Ecotours may request, within a period of seven (7) days from receipt of the application, additional documentation from the owner of the personal data to respond to it.
Within ten (10) days after receipt of the request (from the day following its receipt), the owner of the personal data must attach any additional documents they consider pertinent to substantiate their request. Otherwise, the application will be considered not submitted.
The maximum terms to respond to claims, in accordance with the provisions of the law, are as follows:
The right to information is five (5) days from the day following the submission of the corresponding request.
The right of access is twenty (20) days from the day following the submission of the request by the owner of the personal data.
For rights of rectification, cancellation, or opposition, the maximum response period by the owner of the personal data bank or the person responsible for the treatment will be ten (10) days from the day following the presentation of the corresponding request.
With the exception of the term established for the exercise of the right to information, the terms corresponding to the response or attention of the other rights may be extended only once, and for a maximum of an equal period, provided that circumstances justify it. The justification for the extension of the term must be communicated to the owner of the personal data within the term to be extended.
The interested party or the assignee may only file a claim with the National Authority for the Protection of Personal Data after having exhausted the consultation or claim procedure with Incayza Ecotours.
Guarantee the interested party, at all times, the full and effective exercise of the right of habeas data.
Request and keep, in accordance with the law, a copy of the respective authorization granted by the Concessionaire.
Duly inform the interested party of the purpose of the collection and the rights that assist them by virtue of the authorization granted.
Take steps to keep the information in a secure condition to prevent tampering, loss, unauthorized or fraudulent access, use or access.
Take steps to ensure that the information provided to the data controller is true, complete, accurate, up-to-date, verifiable, and understandable.
Update the information, promptly communicating to the person responsible for the treatment any news regarding the data previously provided and adopt other necessary measures to guarantee the updating of the information that has been provided.
Rectify the information when it is incorrect and communicate the relevant information to the data controller.
Provide the Data Controller, where appropriate, only the data whose Treatment is previously authorized in accordance with the provisions of the Law.
Require the data controller to respect the security and confidentiality of the data subject’s information at all times.
Address queries and claims made in accordance with the law.
Adopt a manual of internal policies and procedures to guarantee proper compliance with this law and, in particular, for the management of queries and complaints.
Inform the data controller when certain information is being discussed by the interested party, once the claim has been submitted and the corresponding process has not been completed.
Inform, at the request of the interested party, of the use made of their data.
Inform the National Authority for the Protection of Personal Data when there are breaches of security policies and risks in the administration of the information of those responsible for treatment.
Comply with the instructions and requirements issued by the National Authority for the Protection of Personal Data.
Those responsible for data processing are required to comply with the following obligations, without prejudice to other provisions of the law and other regulations governing their activity:
Guarantee the interested party, at all times, the full and effective exercise of the right of habeas data.
Take measures to keep the information in the necessary security conditions to prevent its falsification, loss, consultation, use, or unauthorized or fraudulent access.
Update, rectify, or delete the data in a timely manner, in accordance with the provisions of this law.
Update the information provided by the data controllers within five (5) business days of receipt.
Address the requests and claims of the owners in accordance with the law.
Adopt an internal policy and procedures manual to ensure compliance with the law and, in particular, to respond to questions and claims from data subjects.
Refrain from disseminating information contested by the interested party and whose blocking has been ordered by the National Authority for the Protection of Personal Data.
Allow access to information only to those who can access it.
Inform the National Authority for the Protection of Personal Data when there are breaches of security policies and risks in the administration of the information of those responsible for treatment.
Comply with the instructions and requirements issued by the National Authority for the Protection of Personal Data.
Guarantee the security of databases containing personal data.
Respect confidentiality in the processing of personal data.
Incayza Ecotours adopts all reasonable precautions and measures of a technical, administrative, and organizational nature to guarantee the security of the Holders’ personal data, primarily aimed at preventing its alteration, loss, and unauthorized treatment or access.
The application of security measures aims to guarantee the conservation, confidentiality, integrity, and availability of the data.
Incayza Ecotours‘s security guidelines are based on Incayza Ecotours‘s information security policies, which have been prepared in accordance with the best practices and existing security standards and in compliance with current regulations.
These policies are strictly respected by all direct and indirect employees who work at Incayza Ecotours.
Incayza Ecotours will keep users’ personal data for different periods depending on the purpose of the processing. Thus, the data will be retained while a contractual relationship for the supply of products and services between Incayza Ecotours and the users is in force, and/or while users do not request the cancellation of personal data from Incayza Ecotours. Likewise, users understand and accept that some personal data must be kept by Incayza Ecotours by virtue of legal provisions and according to the terms established by law.
Incayza Ecotours may modify and update this policy based on new developments or legislative and jurisprudential requirements and/or the needs of the company.
Therefore, it is recommended that users consult this policy regularly and/or each time they access Incayza Ecotours‘s website.
