Privacy Policy

PURPOSE OF THIS POLICY

The purpose of this policy is to inform how Wonderful Machu Picchu Reservation protects and handles the personal data of its customers, passengers, suppliers, tour operators, travel agencies, and collaborators, from the moment it is collected through various channels, whether physical or digital, for the duly communicated purposes.

BACKGROUND INFORMATION

Wonderful Machu Picchu Reservation is a company dedicated to providing services related to tourism, including individual and group travel, organization of excursions, accommodation, and other activities linked to the sector. To achieve this, it collects, uses, manages, transfers, stores, and processes information that may be associated with personal data of individuals in the course of its activities, such as name, ID number, phone number, email address, country of residence, among others, through various physical and digital formats.

Wonderful Machu Picchu, in compliance with Peruvian Law No. 29733 – Personal Data Protection Law, its Regulation No. 003-2013-JUS, and the General Data Protection Regulation (GDPR) (EU 2016/679), is committed to ensuring and adopting information security measures through best international practices, taking into account the confidentiality, integrity, and availability of the personal data provided.

DEFINITIONS

• Data Controller: The natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data; that is, Wonderful Machu Picchu Reservation will be responsible for the personal data obtained through its different collection channels.
• Personal Data: Any information relating to an identified or identifiable natural person (the user), such as name, ID number, passport, location data, or one or more elements of the physical, physiological, genetic, psychological, economic, cultural, or social identity of a person.
• Processing: Any operation or set of operations performed on personal data or sets of personal data, such as collection, registration, organization, modification, consultation, use, dissemination, access, limitation, erasure, or destruction of personal data.
• Right of Access: The user has the right to know what data is processed by Wonderful Machu Picchu Reservation and to obtain a copy of such data.
• Right of Rectification: The user’s right to update, rectify, and/or correct their personal data.
• Right of Opposition: The user’s right to oppose at any time the processing of their personal data by Wonderful Machu Picchu Reservation.
• Right to Deletion (“Right to be Forgotten”): The user’s right to request the deletion of their data from any document, file, or location where it is accessible.
• Right to Restrict Processing: The user has the right to demand the restriction of the processing of their data when any of the circumstances established in the legislation occur, such as unlawful processing of the data or when Wonderful Machu Picchu Reservation no longer requires them.
• Right to Data Portability: The user’s right to receive the personal data concerning them that they have provided to Wonderful Machu Picchu Reservation in a structured, commonly used, and machine-readable format and to transmit it to another data controller without hindrance.
• Right Not to Be Subjected to Automated Decisions: The user’s right not to be subjected to decisions based solely on automated processing, including profiling, that produce legal effects concerning them or significantly affect them similarly.

CONSENT AND LEGITIMACY OF PROCESSING

Wonderful Machu Picchu Reservation processes user data:

• When users expressly consent to the processing of their personal data for the purposes detailed in this document and/or;
• When processing is necessary for the execution of a contract for the provision of services and products in which the user is a party.

PERSONAL DATA PROCESSED AND SCOPE OF APPLICATION

This policy applies to personal data related to customers, passengers, suppliers, tour operators, travel agencies, and employees, provided by them voluntarily and with full awareness. The information collected and stored includes basic data entered in registration forms, contact forms, or similar; such as name, ID number, passport, gender, age, phone number, email address, country of residence, among others, necessary for the provision of tourist services of Wonderful Machu Picchu Reservation. Users will be able to see which data is essential for the correct provision of the service and which are ancillary before submitting their personal data.

The user is solely responsible for the veracity and accuracy of the data provided. Only those over 18 years of age and/or those with sufficient legal capacity can be users. Additionally, the user is solely responsible for the data provided by third parties and for ensuring that they have informed those third parties of this privacy policy and have obtained their express consent.

GUIDING PRINCIPLES

Wonderful Machu Picchu Resrvation will adhere to the following principles in the processing of personal data:

• Principle of Legality: The processing of personal data is a regulated activity that must comply with the provisions of applicable laws. The collection of personal data through fraudulent, unfair, or illegal means is prohibited.
• Principle of Consent: The processing of personal data is lawful only when the data owner has given their free, prior, express, informed, and unequivocal consent. Implicit consent or assumptions of consent are not accepted. Consent must be expressed clearly and directly.
• Principle of Purpose: A purpose is considered determined when it is clearly expressed without ambiguity and objectively specified. In cases involving sensitive data, its collection must have a legitimate and specific purpose aligned with the explicit objectives of the data controller.
• Principle of Quality: The personal data processed must be true, accurate, up-to-date, necessary, relevant, and adequate for the purposes for which it was collected. Data should be stored securely and only for as long as necessary.
• Principle of Proportionality: All processing of personal data must be adequate, relevant, and not excessive in relation to its purposes.
• Security Principle: The data controller must implement necessary technical, organizational, and legal measures to ensure the security of personal data. These measures must be appropriate and proportional to the nature of the processing and the category of personal data involved.
• Principle of Availability of Resources: Data owners must have the necessary administrative or judicial means to assert and demand their rights in case of violations due to data processing.
• Principle of Adequate Protection: For cross-border transfers of personal data, an adequate level of protection must be ensured, comparable to that provided by applicable laws or international standards.

PURPOSES OF PERSONAL DATA

Wonderful Machu Picchu Reservation will use the personal data provided by users for the following purposes:

Passengers

• To provide contracted tourist services and products.
• To maintain contact with clients (travel agencies, companies, and individuals) during service provision.
• To facilitate coordination with suppliers, travel agencies, cruise lines, and hotels.
• To inform customers about the nature of the service and compliance requirements, such as contractual terms and tax obligations.
• To respond to inquiries, questions, and requests.
• To justify the liquidation of the Value Added Tax for Non-residents before tax authorities using data such as Passport and Andean Migration Card (TAM).
• To analyze and identify travel agencies’ expectations and preferences regarding tickets and services.

Workers and Collaborators

• To collect personal information from employees to comply with labor regulations and manage human resources projects (e.g., payroll, attendance, personnel selection, commission payments).
• For security in facilities through video surveillance.
• To comply with Money Laundering and Terrorist Financing Prevention policies.

Tour Operators and Suppliers

• To manage payments for requested services and products.
• To contact regarding the provision of contracted services and products.
• For security in facilities through video surveillance.

The personal data you provide will be stored in the databases described in Annex 2 of this document.

RIGHTS OF THE OWNERS

The owners of personal data have the following rights:

• The rights to information, access, rectification, cancellation, opposition, and objective treatment can only be exercised by the data owner, without prejudice to the rules of representation.
• Exercising one or more rights does not exclude the possibility of exercising others, nor does it serve as a prerequisite for any right.
• To know, update, and rectify personal data held by Wonder Full Machupicchu or the designated data processor. This right may be exercised against partial, inaccurate, incomplete, misleading data, or data whose processing is prohibited.
• To be informed by Wonder Full Machupicchu or the designated data processor about the use of personal data upon request.
• To revoke authorization and/or request the cancellation of data if the processing does not comply with principles, rights, and legal guarantees. Revocation or cancellation will occur if the National Authority for the Protection of Personal Data determines non-compliance with Law No. 29733 or the Constitution.
• To access processed personal data under the conditions defined in this document.

DATA PROCESSING CONDITIONS

Authorization of the Owner

To carry out any personal data processing actions, Wonderful Machu Picchu Reservation requires the prior and informed authorization of the data owner. This authorization can be obtained through any means that allows for future consultation. Methods may include technical means for automated consent or written/oral requests.

Wonderful Machu Picchu Reservation will implement procedures to request consent at the time of data collection, informing the owner about the specific personal data being collected and the purposes for which the data will be processed.

Personal data from publicly accessible sources may be processed as long as they are public by nature. If there are substantial changes in data processing policies that affect the content of the authorization, Wonderful Machu Picchu Reservation will communicate these changes to the owners and obtain new authorization if the changes relate to the purpose of the processing.

Cases in Which Authorization is Not Required

Authorization is not required for:

• Information requested by public or administrative bodies exercising their legal functions or by judicial order.
• Public data.
• Medical or health emergencies.
• Information permitted by law for historical, statistical, or scientific purposes.
• Data from the civil registry.

Provision of Information

The information requested by the owner will be provided by Wonderful Machu Picchu Reservation in the same manner in which the request was made.

Obligation to Inform the Registrant

At the time of requesting authorization, Wonderful Machu Picchu Resrvation will inform the owner clearly and expressly about:

• The treatment to which their personal data will be submitted and its purpose.
• The optional nature of answers, especially regarding sensitive data or data of minors.
• The rights they possess as data owners.
• The identification and contact information of the data controller.

Revocation of Authorization and/or Deletion of Data

Owners may request the deletion of their personal data or revoke authorization at any time by submitting a request in accordance with Law No. 29733 and its regulations. Requests will not be processed if the owner has contractual obligations requiring their data to remain in the database.

People to Whom Information Can Be Provided

Information about personal data processed by Wonderful Machu Picchu Reservation may be provided to:

• The owners, their heirs, or legal representatives.
• Public or administrative bodies in the exercise of their legal functions or by court order.
• Third parties authorized by the owner or by law.

SECURITY OF PERSONAL DATA

Wonderful Machu Picchu Reservation complies with the required personal data protection measures and has adopted reasonable measures based on current technical knowledge and best practices to prevent loss, misuse, alteration, illegitimate access, and theft of personal data.

PROCEDURES

The owner or their assignees may present inquiries or claims by verifying their identity and writing to:

Call: +51936633360
Email: booking@wonderfulmachupicchu.com
Email: info@wonderfulmachupicchu.com

Wonderful Machu Picchu Reservation will respond in the same manner as the request was made:

Inquiries (Access/Information)

Data owners may consult their personal information contained in the Wonderful Machu Picchu Reservation database. They can request all information related to their identification.

Owners may consult their personal data free of charge if there are substantial changes in data processing policies.

All requests will be processed within 5 working days from their submission. To exercise this right, the interested party must submit the access form included in the annex to this policy.

Claims (Requests/Petitions)

If owners believe their data needs to be rectified, canceled, or opposed, they can submit a request to the data controller. The request form is available in the annex to this policy.

If the application is incomplete, the applicant must correct it within 5 days. If not, the request will be deemed not submitted.

Within 10 days of receipt, the owner must attach additional documents to substantiate their request. Failure to do so will result in the application being considered not submitted.

The maximum response times are as follows:

• Right to information: 5 days from submission.
• Right of access: 20 days from submission.
• Rights of rectification, cancellation, or opposition: 10 days from submission.

Extensions for responses may occur only once and must be communicated within the original time frame.

Procedure Requirement

A claim may be filed with the National Authority for the Protection of Personal Data only after exhausting the consultation or claim procedure with Wonderful Machu Picchu Reservation.

OBLIGATIONS OF THE DATA PROCESSING RESPONSIBLE

Wonderful Machu Picchu Reservation is required to:

• Guarantee the full exercise of the right of habeas data.
• Maintain necessary security measures to prevent falsification, loss, unauthorized access, and use of personal data.
• Update, rectify, or delete data in a timely manner.
• Address requests and claims according to the law.
• Adopt internal policies and procedures to ensure compliance with legal obligations.
• Inform the National Authority of any breaches of security policies.

SECURITY MEASURES

Wonderful Machu Picchu Reservation adopts reasonable technical, administrative, and organizational measures to ensure the security of personal data, aiming to maintain confidentiality, integrity, and availability.

DATA RETENTION

Personal data will be retained based on the purpose of the processing. Data will be kept while a contractual relationship exists or until the user requests cancellation. Users accept that some data must be retained due to legal requirements.

CHANGES IN POLICY

Wonderful Machu Picchu Reservation may modify this policy based on new developments or legal requirements. Users are encouraged to review this policy regularly, especially when accessing the company’s website.