1. Personal Information We Collect

To properly provide our tourist services, we may request personal information that includes, but is not limited to:

• Identification Data: First name, last name, ID card, or passport number
• Contact Data: Address, phone number, email address, and emergency contacts
• Reservation and Contract Data: Information necessary for booking tourist packages including itineraries, tour preferences, and billing details
• Financial Data: Credit or debit card information (number, expiration date, and CVV) for purchase transactions, always processed in secure environments
• Health and Special Requirements: Any medical conditions, dietary restrictions, or accessibility needs relevant to tour participation

2. Purpose of Data Processing

MACHU PICCHU MYSTICAL TOURS, as the data controller, will use personal data for the following purposes:

• Contract Execution and Management: Ensure the development, compliance, and execution of the contracted tourist services
• Customer Service: Manage inquiries, requests, complaints, and provide post-sale support and follow-up
• Reservation and Payment Processes: Facilitate the booking of packages and secure payment transactions
• Safety and Health Compliance: Maintain records for health and safety requirements during tours
• Continuous Improvement: Analyze information to optimize our services and enhance customer experience

3. Data Retention

Personal data will be retained for as long as necessary to execute the contractual relationship and, where applicable, for the legally established periods required for compliance with tax, commercial, legal, and audit obligations in Peru. In general, we retain customer information for 7 years following the completion of your tour, unless local laws require longer retention. After the retention period expires, personal data will be securely deleted or anonymized.

4. Data Sharing and Third Parties

Your personal data may be shared with trusted third-party service providers only when necessary to fulfill your tour booking, including: hotels, transportation providers, guides, restaurants, and payment processors. These third parties are contractually obligated to maintain the confidentiality and security of your information. We do not sell, rent, or lease your personal information to marketing companies or other third parties. International transfers of data (if applicable) are protected by appropriate legal mechanisms such as standard contractual clauses.

5. Security Measures

MACHU PICCHU MYSTICAL TOURS implements comprehensive administrative, technical, and physical security measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. These measures include: SSL encryption for all data transmission on our website, secure payment processing through certified providers, restricted access to personal information limited to authorized personnel, regular security audits and vulnerability assessments, secure data storage with access controls, and employee training on data protection and confidentiality.

6. Your Rights and Consent

By accepting our services, you authorize the collection and processing of your personal data as described in this policy. You also have the following rights:

• Right of Access: Request and obtain confirmation of what personal data we hold about you
• Right of Rectification: Correct inaccurate or incomplete personal data we hold
• Right of Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right of Objection: Object to processing of your personal data for certain purposes
• Right to Restriction: Request restriction of processing while you challenge the accuracy or legality of data processing

7. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance user experience, analyze website traffic, and understand customer preferences. Cookies are small files stored on your device that help us remember your preferences and improve our services. You can control cookie settings through your browser settings. We use analytics tools to understand how visitors navigate our website, which helps us improve content and functionality. No personal identification is collected through cookies without your explicit consent.

8. Children and Minors

Our services are not directed to individuals under 18 years old without parental consent. We do not knowingly collect personal information from children without appropriate parental authorization. If we become aware that a minor has provided information without proper consent, we will take immediate steps to delete such information. Parents or guardians concerned about information collection involving minors should contact us immediately.

9. International Data Transfers

Personal information collected in Peru may be transferred to and processed in other countries as necessary to provide our services. When we transfer information internationally, we implement appropriate safeguards including standard contractual clauses approved by relevant authorities. By using our services, you consent to the transfer of your information as described in this policy. We ensure that all international transfers comply with Peruvian Law No. 29733 and applicable international data protection standards.

10. Third-Party Links

Our website may contain links to third-party websites including tour suppliers, hotels, travel partners, and service providers. We are not responsible for the privacy practices, content, or accuracy of these external sites. We encourage you to review the privacy policies of any third-party websites before providing personal information or making purchases through them. This Personal Data Protection Policy applies only to information collected through our website and services.

11. Policy Updates and Changes

We may update this Personal Data Protection Policy periodically to reflect changes in our practices, legal requirements, or new technologies. We will notify you of material changes by posting the updated policy on our website and updating the 'Last Updated' date at the top of this document. In some cases, we may also send you an email notification or require your explicit consent before implementing material changes. Your continued use of our services after updates constitutes acceptance of the revised policy.