Privacy Policy

Purpose of this policy

The purpose of this policy is to make public how PERU VIVA protects and processes personal data of customers, passengers, suppliers, tour operators, tourism operators and business partners, from the moment they are collected, through various channels (both physical and digital), with e.g. the purpose of correct communication.

Background information

PERU VIVA is a company whose business objective is to provide services related to individual and group travel, travel by air, sea or land, organized tours or excursions, accommodation and other activities directly related to the tourism sector.

For this purpose, it collects, uses, manages, transmits, stores and processes information that, in the course of its activities, may relate to data belonging to natural persons.

For example: name, ID, telephone number, email address, country of residence, etc.

in various physical and digital formats.

PERU VIVA complies with Peruvian Law No. 29733 on the Protection of Personal Data and its Regulations No. 003-2013-JUS and the General Data Protection Regulation GDPR (EU 2016/679) and is obliged to ensure and adopt the best international practices; .

Information security measures, taking into account the confidentiality, integrity and availability of personal data.

Definition

Responsible for the processing: is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data, that is, we process the personal data provided by PERU VIVA users and their companies, through its diversity; collection channels Responsible for the personal data.
Personal data: any information relating to an identified or identifiable natural person (user), such as a name, identification number, passport, location data or part of the physical, physiological, genetic, mental, economic, cultural or social or several elements of a person.
Processing: any operation or set of operations, whether or not automated, which is performed on personal data or on sets of personal data.

For example, the collection, registration, organization, modification, consultation, use, dissemination or any other form of access, verification or combination, restriction, erasure or destruction of personal data.

Right of access: Users have the right to know what data PERU VIVA processes and to obtain a copy of this data.
Right to rectification: Users have the right to update, rectify and/or correct their personal data.
Right to object: Users have the right to object at any time tothe processing of their personal data by PERU VIVA.
Right to erasure («right to be forgotten»): Users have the right to request that their data be erased from any record, document or accessible location.
Right to restriction of processing: Users have the right to request that the processing of their data be restricted when one of the circumstances specified by law arises, for example when the data is processed unlawfully or when we no longer need it.
Right to data portability: The user has the right to receive the personal data concerning him or her, which he or she has provided to us, in a structured, commonly used and machine-readable format and transmitted to another data controller without restriction.
Right not to be influenced by personal decisions: The User has the right not to be influenced by decisions based solely on automated processing (including profiling) which concern him/her legally or significantly affect him/her in a similar way.

Consent and lawfulness of processing

The processing of the User’s data:

If they explicitly consent to the processing of their personal data for the purposes described in this document and/or;
If the processing is necessary for the performance of a contract to which the User is a party for the provision of services and products.

Personal data processed and scope

This policy applies to the voluntary use of personal data freely provided by customers, passengers, suppliers, tour operators, tour operators and employees.

Understood. The information collected and stored includes basic information entered in registration forms, contact forms, etc. such as name, ID, passport, gender, age, telephone number, email address, country of residence, etc., collected through the various managed channels; information necessary for the provision of Viva Peru Tourism services. In any case, before sending personal data, the User will be able to see which data are essential for the proper provision of the service and which are of an auxiliary nature.

The user assumes full responsibility for the authenticity and accuracy of the information provided.

Only persons who are over 18 years of age and/or have sufficient legal capacity may become users.

Users are also fully responsible for the information provided by third parties and for understanding this privacy policy and obtaining their explicit consent.

Guiding Principles

When processing personal data, we will take into account the following principles.

Principle of Lawfulness: The processing of personal data is an activity regulated by Law No. 29733 and must comply with the provisions of the aforementioned law and other regulations governing this law. The collection of personal data by fraudulent, unfair or unlawful means is prohibited.
Consent principle: According to the consent principle, the processing of personal data is lawful if the personal data owner gives his free, prior, clear, informed and unambiguous consent.

Consent that is not expressly expressed, such as one that requires inference or acceptance of an unexpressed will, will not be accepted. Even consent expressed in connection with other statements must be clear and unambiguous.

Purpose principle: According to the purpose principle, the purpose of processing personal data is considered to be specific if the purpose is clearly stated without any possibility of confusion and is objectively indicated.

The creation of a profile containing sensitive data is only justified if the purpose must be not only legitimate but also specific and consistent with the activities or objectives pursued by the profile owner.

Professionals who process personal data must respect professional confidentiality that goes beyond the limits of the purposes they serve.

Quality principle: Personal data processed must be true, accurate and as up-to-date as possible, necessary, relevant and sufficient to achieve the purpose for which the data were collected.

They must be stored in a secure manner and only for as long as is necessary for the treatment.

Proportionality principle: All processing of personal data must be adequate, relevant and not excessive in relation to the purposes for which the data were collected.
Security principle: Personal data owners and data controllers must take the necessary technical, organizational and legal measures to ensure the security of personal data.

Security measures must be adequate and proportionate to the processing to be carried out and the categories of personal data concerned.

Principle of availability of resources: Every personal data holder must have the necessary administrative or judicial means to claim and invoke his or her rights if the processing of personal data infringes them.
Principle of adequate protection: For cross-border flows of personal data, it is essential to ensure that the personal data processed are adequately protected or at least comply with the standard of protection set out in the relevant legislation or international standards.

Purpose of personal data

We will use the personal data provided by users for the following purposes

passenger

To meet the objectives of providing coordinated travel services and products.
To communicate with customers (travel agencies, companies and individuals) during the provision of coordinated services and products.
Facilitate coordination with suppliers, travel agencies, cruise lines and hotels.
Provide information to customers regarding the nature of the services and/or knowledge and compliance requirements during the service period, such as contract terms, tax compliance and/or other regulations that may include internal company policies.
Respond to concerns, questions and requests.
Provide justification for VAT payments to tax authorities using information such as passport and Andean Migration Card (TAM).
Analyze and determine travel agent preferences and desires regarding tickets and services.

Employees and Business Partners:

The Company will require its employees to provide personal information to comply with applicable labor market regulations and/or for human resource development and talent management projects, such as payroll, employee participation, recruitment, and commission payments.
Ensure facility security through video surveillance.
Policies and procedures to comply with Anti-Money Laundering and Counter-Terrorism Financing policie.

Travel industry operators and suppliers:

Ability to manage payments for requested services and products.
To communicate with you regarding the delivery of agreed services and products.
Ensure the security of the facility through video surveillance.

The personal data you provide will be stored in the database described in Appendix 2 of this document.

Ownership rights

The owner of personal data has the following rights:

Rights to information, access, correction, cancellation, objections and objective processing of personal data can only be exercised by the owner of the personal data, without prejudice to the rules of representation.
The exercise of one right or part of it does not exclude the possibility of exercising one or part of other rights, nor should it be understood as a prerequisite for the exercise of any of them.
Work with us to understand, update and correct your personal data
Make a reservation or contact the designated data controller.

In addition, this right may be exercised in relation to partial, inaccurate, incomplete, fragmentary, misleading data or data the processing of which is expressly prohibited or unauthorized.

Upon request, you will be informed about the use of your personal data by PERU VIVA or the designated data processor.
Withdraw consent and/or request the cancellation of data ifthe processing is incompatible with the principles, rights and constitutional and legal guarantees.

The revocation and/or cancellation will be carried out when the national supervisory authority for personal data protection establishes that the conduct of PERU VIVA or the person responsible for the processing is contrary to Law No. 29733 and the Constitution.

Free access to your processed personal data, subject to the conditions defined in this document.

Data Processing Conditions

Owner Authorization: For PERU VIVA to carry out any processing of personal data, the prior informed consent of the owner is required, and this consent must be obtained by any means that can be accessed later.

These mechanisms can be predetermined by technical means that facilitate the automatic execution of the holder, or they can be written or oral.

We will take the necessary steps to obtain the data subject’s consent to the processing, at the latest at the time of data collection, and will inform the data subject about the personal data that will be collected and any specific purposes.

Obtain consent to the processing.

PERU VIVA may process personal data found in publicly available sources if they are public.

If there are significant changes to the content of our data processing policy regarding the identity of the data controller and the purposes of personal data processing that affect authorized content, we will inform the owner of that content before or at the latest when the new policy changes are implemented, and if the changes concern the purposes of processing, a new authorization will also be obtained from the owner.

Technological means may be used to facilitate the notification of changes and authorizations.

Situations where authorization is not required
information required by state or administrative authorities in the exercise of their legal functions or by court decisions.
Public information.
Medical or health emergencies.
Processing of information for historical, statistical or scientific purposes, where permitted by law.
Information from personal registration.
Provide information

We will provide the information requested by the owner in the same manner as at the time of the request.

Obligation to inform registrants

When you request permission from the owner, it clearly and unambiguously informs you of the following:

The manner in which your personal data will be submitted for processing and the purposes of that processing.
When sensitive data or data about children and young people are involved, the answers to the questions asked are selective.
Your rights as the owner.
Identity, physical or electronic address and telephone number of the data controller.
Revoke authorization and/or delete data:

The owner may contact PERU VIVA at any time.

By submitting a request to delete your personal data and/or withdraw consent to the processing of such data in accordance with Law 29733 of 2011 and Regulation DS No. 003-2013-JUS 2013.

We do not process requests to delete data or withdraw consent while the data is in our database.

Persons who may provide information:

Information about the personal data processed by us may be provided by:

the owner, his heirs or his legal representatives.
State or administrative bodies, in the exercise of their legal functions or in accordance with court orders.
Third party authorized by the owner or by law.

Personal Data Security

We comply with the personal data protection measures required by law and take reasonable steps based on existing technical knowledge and good data storage and management practices to prevent the loss, misuse, manipulation, illegal entry and theft of personal data provided by users.

program

The owner or his representatives have the right to display PERU VIVA.

Inquiries and/or claims, after confirming your identity, you may at any time withdraw your consent to the processing of your personal data and/or exercise your rights of access, information, rectification, opposition by writing to the following address: , right to cancellation, right to restriction, right to be forgotten, portability and freedom from personal decisions, please write to us indicating «Personal Data» to this address

Email: info@PERUVIVA.COM

We will respond to requests and/or claims in the same way as we submitted them:

Request (visit/information)

The personal data of the controller in our database will be accessible to the controller or its successor, who will provide the applicant with all the information in its database relating to the identity of the controller.

In the event of significant changes to the PERU VIVA data processing policy, the Owner may consult his/her Personal Data free of charge.

All requests will be processed in the same manner as if they had been submitted within 5 business days of submission.

To exercise this right, the interested party or their authorized representative must submit the access form attached as an appendix to this policy.

Claims (requests/petitions)

The owner or his successor may submit a request to the owner of the personal database if he considers it necessary to correct, delete or object to the information contained in the database, or if he becomes aware of a possible breach of any of the obligations contained in Law No. 29733 of 2011 or of the person responsible for PERU VIVA.

In order to exercise these rights, the data owner or his successor must submit the appropriate form attached to this policy.

If the application does not meet the specified requirements, the applicant is obliged to remedy the deficiencies within five (5) days from the date of receipt of the application. If the correction is not made within the specified period, the request is considered not submitted.

If the information provided in the application is insufficient or incorrect to warrant attention, we may respond to the application by requesting additional documents from the personal ID holder within seven (7) days of receipt.

Within ten (10) days of receipt of the request, that is, from the date of receipt of the request, the personal data owner must attach additional documents that he considers relevant to substantiate his request.

Otherwise, the application will be considered not submitted.

According to the law, the maximum deadlines for responding to claims are as follows:

The right to know is valid for five (05) days from the date of submission of the relevant request.
The right of access is valid for twenty (20) days from the date on which the personal data owner submits the request.
The right to rectification, cancellation or objection, with a maximum response period of ten (10) days from the date of the relevant request from the personal data owner or the person responsible for the processing.

In addition to the time limits set for exercising the right to information, the relevant time limits for responding or exercising other rights may be extended only once and for no more than the same period, if the circumstances justify it.

The reasons for the extension must be communicated to the personal data subject within the extended time limit.

Program Requirements

The interested party or the legal successor may submit a claim to the national personal data protection supervisory authority only after having completed the negotiation or complaint procedure with us.

Data processing function

Ensure that interested parties can always fully and effectively exercise their rights to personal data protection.
Obtain and retain copies of relevant permits granted by the franchisee as required by law.
Promptly inform interested parties of the purpose of the collection and the rights available under the permit granted.
Take measures to ensure the security of information and prevent alteration, loss, unauthorized or fraudulent access, use or storage.
Take measures to ensure that the information provided to data controllers is true, complete, accurate, current, verifiable and understandable.
Update the information by immediately informing those responsible for processing the data about the previously provided data and taking other necessary measures to ensure that the information provided is up-to-date.
If the information is incorrect, the message must be corrected and the relevant information must be communicated to the data controller.
Where applicable, you must only provide the data controller with data that has previously been permitted to be processed by law.
Require that data controllers always respect the security and confidentiality of data subjects’ information.
Handle legal matters and claims.
Adopt an internal policy and procedure manual to ensure proper compliance with the law, especially regarding the handling of requests and complaints.
Notify the data controller when certain information is being discussed between interested parties, when a complaint has been filed and the process has not been completed.
Upon request, inform the relevant parties about the use of the data.
Notify the national personal data supervisory authority if the persons responsible for its processing violate the security policy and have allowed risks.
Comply with the instructions and requirements issued by the national supervisory authority in the field of personal data protection.

Obligations of the data controller

The persons responsible for data processing shall comply with the following obligations, without prejudice to other provisions of the law and other regulations governing their activities:

To ensure that interested parties always fully and effectively exercise their right to privacy.
To take measures to store information in accordance with the necessary security conditions to protect it from falsification, loss, inspection, use or unauthorized or fraudulent access.
Promptly update, correct or delete information in accordance with the provisions of this law.
Update information from the data controller within five (5) business days of receipt.
Handle the owner’s requests and complaints in accordance with the law.
Adopt an internal policy and procedure manual to ensure compliance with the law, in particular when responding to data subject questions and complaints.
Avoid disseminating information that the relevant parties object to and that the Norwegian Data Protection Authority has ordered blocked.
Only allow access to information to those who have the right to access it.
Notify the national personal data supervisory authority if the persons responsible for its processing violate the security policy and have allowed risks.
Comply with the instructions and requirements issued by the national supervisory authority in the field of personal data protection.
Ensure the security of databases containing personal data.
Observe confidentiality when processing personal data.

security measures

We take all reasonable technical, administrative and organizational precautions and measures to ensure the security of the Owner’s personal data, primarily aimed at preventing its alteration, loss and unauthorized processing or access.

Security measures are used to ensure the preservation, confidentiality, integrity and availability of data.

PERU VIVA’s security principles are based on information security policies that are based on best practices and existing security standards and comply with applicable regulations.

These policies are strictly adhered to by direct and indirect employees working for PERU VIVA

Data retention

We will retain the user’s personal data for various periods depending on the purpose of the processing, as long as the contractual relationship between us and the user for the provision of goods and services is in force and/or as long as the user does not request the deletion of personal data from PERU VIVA.

Users also understand and agree that we are required by law to retain certain personal data and in accordance with the terms of the law.

Policy Changes

PERU VIVA Center may review and update this policy in accordance with news or statutory and legal requirements and/or business needs.

Therefore, users are advised to review this policy periodically and/or each time they visit the Company’s website.