The aim of this policy is to outline how Cusco Discovery safeguards and manages the personal data of customers, passengers, suppliers, tour operators, travel agencies, and collaborators, starting from the moment it is collected through various channels, whether physical or digital, for the purposes communicated clearly and transparently.

Cusco Discovery is a company dedicated to providing services related to individual and group travel, including air, sea, or land transportation, organizing trips or excursions, arranging accommodations, and other tourism-related activities. In the course of conducting these activities, the company collects, uses, manages, transfers, stores, and processes information, which may include data associated with individuals such as names, identification numbers, phone numbers, email addresses, and countries of residence, among others, using various physical and digital formats.

Cusco Discovery, in compliance with Peruvian Law No. 29733 – Personal Data Protection Law – and its Regulation No. 003-2013-JUS, as well as the General Data Protection Regulation GDPR (EU 2016/679), is committed to ensuring and implementing information security measures based on the best international practices. These measures are designed to safeguard the confidentiality, integrity, and availability of the personal data provided.

• Data Controller: The entity, whether a natural person or legal entity, that independently or jointly with others, determines the purposes and methods of processing personal data. In this context, Cusco Discovery assumes responsibility for the personal data obtained through its various collection channels and provided by users of Cusco Discovery, as well as affiliated companies.
• Personal Data: Any information relating to an identified or identifiable natural person (the user), including but not limited to name, identification document number, passport details, location data, or any other physical, physiological, genetic, psychological, economic, cultural, or social information pertaining to an individual.
• Processing: Any operation or series of operations carried out on personal data or sets of personal data, whether automated or not.

This includes activities such as gathering, recording, organizing, altering, accessing, utilizing, sharing, or any other method of interacting with, restricting, deleting, or disposing of personal data within Cusco Discovery’s data management processes.

• Data Access Right: Users have the right to know what data Cusco Discovery processes and to obtain a copy of such data.
• Data Rectification Right: Users have the right to update, rectify, and correct their personal data.
• Data Opposition Right: Users have the right to object to the processing of their personal data by Cusco Discovery at any time.
• Right to Erasure (“Right to be Forgotten”): Users have the right to request the deletion of their data from any document, file, or accessible location.
• Data Processing Limitation Right: Users have the right to request the limitation of data processing when certain circumstances established by legislation occur, such as unlawful data processing or when Cusco Discovery no longer requires the data.
• Data Portability Right: Users have the right to receive their personal data provided to Cusco Discovery in a structured, commonly used, and machine-readable format, and to transmit such data to another data controller.
• Right to Non-discrimination: Users have the right not to be subjected to decisions based solely on automated processing, including profiling, that have legal effects or significantly impact them in a similar manner.
• CONSENT AND LEGITIMACY OF PROCESSING

• When users provide explicit consent for the processing of their personal data as described in this document, and/or when processing is essential for fulfilling a contract for services and products in which the user is involved.
• PROCESSING OF PERSONAL DATA AND ITS SCOPE

This policy pertains to personal data concerning customers, passengers, suppliers, tour operators, travel agencies, and employees voluntarily provided by them in the exercise of their freedom and awareness. The information collected and stored includes basic data entered in registration forms, contact forms, or similar, such as name, identification document, passport details, gender, age, phone number, email address, country of residence, among others, gathered through various company-managed channels essential for providing tourist services by Cusco Discovery. Users will be informed of which data is necessary for service provision and which are supplementary before submitting their personal information.

Users are responsible for the accuracy and truthfulness of the provided data. Only individuals aged 18 or older and/or those with sufficient legal capacity may be users. Users are also accountable for data provided by third parties and ensuring they have been informed of this privacy policy and have obtained their explicit consent.

Cusco Discovery will adhere to the following principles when processing personal data.

• Cusco Discovery will uphold the following principles in personal data processing:
• Principle of Legality: Personal data processing under Law 29733 is a regulated activity governed by legal provisions. Collection of personal data through fraudulent, unfair, or illegal means is prohibited.
• Principle of Consent: Processing of personal data is lawful when the data subject has freely, priorly, explicitly, informed, and unequivocally consented. Implicit consent or assumptions of unexpressed will are not accepted. Even consent through other statements must be express and clear.
• Principle of Purpose: Processing purposes must be clearly expressed without ambiguity. The objectives for processing personal data must be specific and aligned with the owner’s explicit goals. Professionals processing personal data are bound by confidentiality and limited to the purpose of their services.
• Principle of Quality: Processed personal data must be accurate, updated, necessary, pertinent, and adequate for the intended purpose. They must be stored securely and only for the required duration.
• Principle of Proportionality: Data processing should be appropriate, relevant, and not excessive in relation to the intended purposes.
• Security Principle: Data owners and controllers must implement technical, organizational, and legal measures to ensure data security. Security measures should be appropriate and proportionate to the data processing and type of personal data.
• Principle of Access to Resources: Data owners must have administrative or legal means to assert their rights when their personal data is mishandled.
• Principle of Adequate Protection: Cross-border data transfers must ensure an adequate level of protection equivalent to legal or international standards.
• PURPOSES OF PERSONAL DATA

Cusco Discovery will use the personal data provided by users for the following purposes.

• Cusco Discovery will adhere to the following principles in processing personal data:
• Fulfillment of Contracted Tourist Services and Products: Personal data will be used to provide the tourist services and products contracted by customers.
• Client Communication: Personal data will be used to maintain contact with clients (travel agencies, companies, and individuals) during the provision of contracted services and products.
• Coordination with Suppliers: Personal data will facilitate coordination with suppliers, travel agencies, cruise lines, and hotels involved in the provision of services.
• Information Provision: Personal data will be used to inform customers about the nature of the service, knowledge and compliance requirements during the service, including contractual terms, tax obligations, and internal company policies.
• Customer Support: Personal data will be used to address doubts, questions, and requests from customers.
• Value Added Tax (VAT) Justification: Personal data such as Passport and Andean Migration Card (TAM) information will be used to justify the liquidation of VAT for non-residents before the Tax Administration.
• Analysis of Travel Agency Expectations: Personal data will be analyzed to identify the expectations and preferences of travel agencies regarding tickets and services.

• The company will request personal information from its employees to comply with the requirements of the applicable labor regulations and/or for the development of human resources and talent management projects such as payroll registration, staff attendance, personnel selection, payment of commissions, among others.
• Security in the facilities through video surveillance.
• Compliance with the Anti-Money Laundering and Terrorist Financing Prevention Policy and procedures.

• To facilitate the processing of payments for the services and products requested.
• To communicate with you regarding the delivery of contracted services and products.
• Ensuring security on premises through video surveillance.

OWNERS’ RIGHTS

The individual whose personal data is held possesses the following rights:

• The rights of information, access, correction, deletion, objection, and impartial treatment of personal data can only be exercised by the owner of the personal data, following applicable rules of representation.
• Exercising one or more of these rights does not prevent exercising others, nor is it a prerequisite for exercising any of them.
• You have the right to know, update, and correct your personal data with CUSCO DISCOVERY or the appointed data controller. This right applies to data that is partial, inaccurate, incomplete, fragmented, misleading, or processed without authorization.
• You can request information from CUSCO DISCOVERY or the appointed data processor regarding the use of your personal data.
• You can revoke authorization and/or request deletion of data when the processing does not comply with legal principles, rights, and constitutional guarantees. Revocation and/or deletion will occur if the National Authority for the Protection of Personal Data determines that CUSCO DISCOVERY or the designated data processor has acted contrary to Law 29733 and the Constitution.
• You have free access, as defined in this document, to your processed personal data.

Owner Authorization:
CUSCO DISCOVERY requires prior and informed authorization from the data owner to carry out any processing of personal data. This authorization should be obtained through means that allow consultation at a later time, which could be through predetermined technical methods enabling automated consent, or through written or oral consent.

CUSCO DISCOVERY will implement procedures to request the data owner’s consent at the latest upon data collection. The owner will be informed about the personal data being collected and the specific purposes for which the data will be processed.

Personal data sourced from publicly accessible channels may be processed by CUSCO DISCOVERY , provided that such data is inherently public. In the event of significant changes to CUSCO DISCOVERY’s data processing policies regarding the identification of the responsible party and the purpose of personal data processing, which impact the content of the authorization, CUSCO DISCOVERY will notify data owners of these changes before or at the time of implementing the new policies. Additionally, CUSCO DISCOVERY will seek new authorization from the data owner if the changes relate to the purpose of data processing. Technical means may be employed to facilitate the communication of these changes and obtain authorization.

• Cases where authorization is not necessary:
• Information requested by a public or administrative entity in the course of its legal duties or by a court order.
• Publicly available data.
• Medical or health emergencies.
• Processing of data allowed by law for historical, statistical, or scientific purposes.
• Data from civil registries of individuals.
• Information provision

CUSCO DISCOVERY will provide the requested information to the owner in the same manner as the request was made.

• Requirement to inform the data subject

CUSCO DISCOVERY. When requesting authorization from the owner, it explicitly and clearly informs you of the following:

• The processing that your personal data will undergo and the purpose of this processing.
• The voluntary nature of responding to questions, particularly regarding sensitive data or data about children and adolescents.
• Your rights as the data owner.
• The identification, physical or electronic address, and telephone number of the data processor.
• Withdrawal of authorization and/or deletion of data:

Individuals can request at any time from CUSCO DISCOVERY the deletion of their personal data and/or the revocation of the authorization granted for processing such data, by submitting a formal request in accordance with the provisions of Law 29733 of 2011 and Regulation DS Nº 003-2013-JUS of 2013.

Requests for data deletion or authorization revocation will not be processed if the data owner has a contractual obligation to remain in the CUSCO DISCOVERY database.

• Recipients of the information:

Information regarding the personal data processed by CUSCO DISCOVERY may be disclosed to the following parties:

• To the data owners, their heirs, or their legal representatives.
• To public or administrative entities in the performance of their legal duties or by court order.
• To third parties authorized by the owner or by law.

Protection of Personal Data

CUSCO DISCOVERY adheres to the personal data protection measures mandated by law and has implemented appropriate measures based on current technical knowledge and best practices in information handling to safeguard against loss, misuse, alteration, unauthorized access, and theft of personal data provided by users.

The data owner or their representatives are entitled to address inquiries and/or lodge complaints with CUSCO DISCOVERY. Upon verifying your identity, you may write to the following address at any time to withdraw consent for personal data processing and/or to exercise your rights of access, information, rectification, objection, deletion, limitation, erasure, portability, and avoidance of individualized decisions. Please use the reference “PERSONAL DATA” when writing to CUSCO DISCOVERY at the following addresses:

• Physical or legal address: Av. Marques 227
• E-mail: [email protected]

CUSCO DISCOVERY will address the request and/or complaint using the same method by which it was submitted.

Those responsible for data processing or their successors in title have the right to access the personal information of the data subject stored in the CUSCO DISCOVERY database. CUSCO DISCOVERY will provide the requester with all relevant information from its databases pertaining to the identification of the data controller.

The data owner may access their personal data free of charge in cases of significant changes to CUSCO DISCOVERY’s data processing policies.

All requests will be processed using the same means through which they were submitted within a period of 5 working days from receipt. To exercise this right, the interested party or their representatives must submit the access form included in the annex to this policy.

The data subject or their successors who believe that information contained in a database should be corrected, deleted, or objected to, or if they suspect a violation of the obligations under Law 29733 of 2011, may submit a request to the data controller or the person responsible for processing at CUSCO DISCOVERY. To exercise these rights, the data owner or their representatives must use the appropriate form available in the annex to this policy.

If the application does not meet the specified requirements, the applicant must correct the deficiencies within five (5) days from receipt of the application. Failure to do so within this period will result in the request being considered as not submitted.

If the application contains insufficient or inaccurate information that hinders its processing, CUSCO DISCOVERY may request additional documentation from the data subject within seven (7) days of receiving the application to facilitate a response.

The data owner must provide any additional documents deemed necessary to support their request within ten (10) days from the day following receipt of the request. Failure to do so will result in the application being considered as not submitted.

The maximum timeframes for responding to claims, as stipulated by law, are as follows:

• The deadline for providing information is five (5) days from the day following the submission of the request.
• The deadline for granting access is twenty (20) days from the day following the submission of the request by the data owner.
• For requests regarding rectification, cancellation, or objection, the maximum response time from the data controller or the person responsible for processing will be ten (10) days from the day following the submission of the request.

Except for the deadline set for providing information, the deadlines for responding to or addressing other rights may be extended only once, for a maximum period equal to the original deadline, if justified by circumstances. The reason for extending the deadline must be communicated to the data subject within the extended timeframe.

The individual or their representative may only lodge a complaint with the National Authority for the Protection of Personal Data after completing the consultation or complaint process with CUSCO DISCOVERY.

• Ensure that individuals have the full and effective exercise of their right to privacy at all times.
• Request and retain, as required by law, a copy of the authorization granted by the data subject.
• Thoroughly inform individuals of the purpose of data collection and their rights under the granted authorization.
• Take measures to maintain information securely to prevent alteration, loss, unauthorized access, or misuse.
• Ensure that information provided to the data controller is accurate, complete, up-to-date, verifiable, and comprehensible.
• Update information promptly and inform the data controller of any changes to previously provided data.
• Correct inaccurate information and notify the data controller accordingly.
• Only provide the data controller with data that has been previously authorized for processing under the law.
• Require the data controller to uphold the security and confidentiality of individuals’ information at all times.
• Address inquiries and complaints in accordance with legal requirements.
• Develop an internal policy and procedures manual to ensure compliance with the law, particularly for managing inquiries and complaints.
• Inform the data controller when information is under discussion by the data subject after a claim has been submitted and processed.
• Inform individuals, upon request, of the use of their data.
• Report breaches of security policies and risks in data management to the National Authority for the Protection of Personal Data.
• Comply with instructions and requirements issued by the National Authority for the Protection of Personal Data.

Entities responsible for data processing must fulfill the following obligations, in addition to complying with other legal provisions and regulations governing their activities:

• Ensure that individuals have the unrestricted and effective ability to exercise their right to data protection at all times.
• Implement measures to maintain data in secure conditions to prevent falsification, loss, unauthorized access, or misuse.
• Promptly update, rectify, or delete data as required by law.
• Update information received from data controllers within five (5) business days of receipt.
• Handle requests and complaints from data subjects in accordance with legal requirements.
• Establish an internal policy and procedures manual to ensure compliance with the law, particularly concerning inquiries and complaints from data subjects.
• Refrain from disclosing information that has been contested by the data subject and ordered to be blocked by the National Authority for the Protection of Personal Data.
• Grant access to information only to authorized individuals.
• Notify the National Authority for the Protection of Personal Data of any security breaches or risks related to the management of information by data processors.
• Adhere to the instructions and requirements issued by the National Authority for the Protection of Personal Data.
• Ensure the security of databases containing personal data.
• Maintain confidentiality in the processing of personal data.

CUSCO DISCOVERY implements all reasonable technical, administrative, and organizational precautions and measures to ensure the security of personal data belonging to data subjects, particularly aimed at preventing alteration, loss, and unauthorized processing or access.

The application of security measures is designed to ensure the preservation, confidentiality, integrity, and availability of data.

CUSCO DISCOVERY’s security protocols are derived from its information security policies, which are developed in line with best practices, existing security standards, and compliance with current regulations.

These policies are strictly adhered to by both direct and indirect employees of CUSCO DISCOVERY.

CUSCO DISCOVERY will retain user personal data for varying durations based on the purpose of processing. Data will be retained during the existence of a contractual relationship for the provision of products and services between CUSCO DISCOVERY and users, and/or until users request the deletion of their personal data from CUSCO DISCOVERY. Additionally, users acknowledge and agree that certain personal data must be retained by CUSCO DISCOVERY in accordance with legal provisions and timelines established by law.

CUSCO DISCOVERY reserves the right to revise and update this policy in response to new developments or changes in legislative and judicial requirements, as well as the company’s needs.

Therefore, it is advisable for users to review this policy periodically and/or each time they visit the company’s website.