PERSONAL DATA PROTECTION POLICY
1. INTRODUCTION
ECOLUCERNA EXPERIENCE is a company in the tourism sector dedicated to the sale of tourist services nationwide through service intermediation. This includes: sale of transportation tickets, private transfers, lodging and food services, tourist packages, full days , travel consulting, tourism marketing consulting, guiding services in the Madre de Dios region, sale of foreign currency and other related services. ECOLUCERNA EXPERIENCE is obliged to comply with current Peruvian legislation regarding the protection of personal data, Law No. 29733 on the Protection of Personal Data and its complementary provisions.
Therefore, ECOLUCERNA EXPERIENCE is committed to:
- The collection and use of personal information.
- Ensure the quality and security of information.
- Respect people’s rights to information about themselves.
ECOLUCERNA EXPERIENCE is committed to the protection, management, and appropriate processing of the personal data to which it has access in the regular operation of its business. This commitment includes the review and continuous improvement of the organization’s processes to ensure adequate protection of said personal data and the guidelines established by ECOLUCERNA EXPERIENCE for the collection and processing of personal data to ensure respect for the rights of its owners and compliance with the current regulatory framework. The Policy may be supplemented with additional procedures, regulations, and/or guidelines that develop the provisions of this document, provided they are aligned with its guiding principles.
2. OBJECTIVE
The purpose of this document is to establish principles, uniform practices, and responsibilities regarding the processing of personal data in which ECOLUCERNA EXPERIENCE is involved.
3. SCOPE
This document applies to all ECOLUCERNA EXPERIENCE processes that will use clients’ personal data intended to be contained in the various ECOLUCERNA EXPERIENCE databases and to their processing.
This Policy must be familiar with and fully complied with by all ECOLUCERNA EXPERIENCE employees and suppliers. For the purposes of interpreting this Policy, the definitions contained in the Law, and in particular those included below, apply.
4. DEFINITIONS
- Prior: Must be obtained before collection.
- Free: It should not be forced or conditioned.
- Unequivocal and express: There should be no doubt about its manifestation and it must be recorded in some tangible medium. Personal database: An organized set of personal data, automated or not, regardless of the medium, whether physical, magnetic, digital, optical or other, created, regardless of the form or method of its creation, formation, storage, organization and access.
Personal data bank owner: A natural person, a private legal entity, or a public entity that determines the purpose and content of the personal data bank, its processing, and security measures. Personal data bank manager: Any natural person, private legal entity, or public entity that, alone or jointly with another entity, processes personal data on behalf of the personal data bank owner. Anonymization procedure : Processing of personal data that prevents identification or renders the personal data owner identifiable. The procedure is irreversible. Dissociation procedure: Processing of personal data that prevents identification or renders the personal data owner identifiable. The procedure is reversible.
5. COMPLIANCE RESPONSIBLES
ECOLUCERNA EXPERIENCE will assign and communicate the corresponding responsibilities to all staff and suppliers for compliance with this Policy.
The General Management department responsible for reviewing this Policy annually and making the necessary adjustments within ECOLUCERNA EXPERIENCE will be the General Management department. This department will also be responsible for answering any questions related to the application and scope of this Policy.
Notwithstanding the foregoing, all ECOLUCERNA EXPERIENCE employees, as well as all suppliers and third parties with whom ECOLUCERNA EXPERIENCE interacts in the course of its regular business and who have access to or process personal data, are subject to compliance with the Policy. Finally, no ECOLUCERNA EXPERIENCE employee may perform any actions or incur in omissions on behalf of the Company that constitute a breach of the Law.
6. CONFIDENTIALITY
This Policy will be for the internal and exclusive use of ECOLUCERNA EXPERIENCE and is therefore confidential. Any use other than that indicated is prohibited and must be expressly authorized in writing by General Management.
Personal data to which both ECOLUCERNA EXPERIENCE employees and related third parties have access or participate in its processing may not be processed or used in any way without the prior consent of the personal data owner, even after the termination of their relationship with ECOLUCERNA EXPERIENCE, except for the exceptions regulated by law.
In the case of employees who, due to the nature of their duties, have access to confidential and sensitive personal information, ECOLUCERNA EXPERIENCE will endeavor to develop specific training and awareness-raising activities. Those involved in the processing of personal data are required to maintain professional secrecy and confidentiality. This obligation will continue even after their relationship with ECOLUCERNA EXPERIENCE has ended.
7. PRINCIPLES
All ECOLUCERNA EXPERIENCE employees must comply with the principles established in the Law, which we detail below, on a permanent basis in the performance of their duties:
1. Legality. ECOLUCERNA EXPERIENCE will process personal data in accordance with the law. The collection of personal data through fraudulent, unfair, or unlawful means is prohibited.
2. Consent. ECOLUCERNA EXPERIENCE may not process personal data without the prior, express, unequivocal, and free consent of the data subject, as required, except for the exceptions provided by law.
3. Purpose: ECOLUCERNA EXPERIENCE will collect personal data, clearly indicating the purpose for which it is collected. This purpose must be specific, explicit, and lawful. The personal data processed may not be used for purposes other than or incompatible with those for which it was collected, unless the data subject consents. In this regard, ECOLUCERNA EXPERIENCE will implement measures to ensure:
• The collection, storage, and retention of personal data comply with the principles of proportionality and purpose.
• The adequate protection of personal data in compliance with appropriate technical and legal security measures. It should be noted that ECOLUCERNA EXPERIENCE may not disclose personal data unless ordered by a reasoned court order or with the authorization of the data subject, subject to the safeguards provided by law. Likewise, ECOLUCERNA EXPERIENCE may not refuse to provide a public entity with information containing personal data, provided that such request is made in strict compliance with the powers assigned to said entities by current legislation.
1. Proportionality. Any processing of personal data carried out by ECOLUCERNA EXPERIENCE must be adequate, relevant, and not excessive for the purpose for which it was collected.
2. Quality. The personal data processed by ECOLUCERNA EXPERIENCE must be truthful, accurate, and, to the extent possible, up-to-date, necessary, relevant, and appropriate for the purpose for which it was collected. It must be stored in a manner that guarantees its security and only for the time necessary to fulfill the purpose of the processing, respecting the applicable legal retention periods for documents and information.
3. Security. ECOLUCERNA EXPERIENCE and the third parties it entrusts with the processing of personal data must adopt the necessary and appropriate technical, organizational, and legal measures to guarantee the security of personal data against various risks, such as accidental loss or destruction due to accident, unauthorized access, covert use, or infection by malware or computer viruses. These measures will be established, communicated, and, if necessary, updated by ECOLUCERNA EXPERIENCE.
4. Adequate level of protection. If ECOLUCERNA EXPERIENCE makes international transfers of personal data, it must guarantee an adequate level of protection for the personal data being processed, or at least comparable to that provided by law.
5. Rights of personal data subjects. ECOLUCERNA EXPERIENCE will have a simple and free procedure for addressing the rights of personal data subjects contemplated in the Law:
- Information
- Access
- Update
- Inclusion
- Rectification
- Deletion
- Prevent the supply
- Opposition
- Objective treatment.
Therefore, ECOLUCERNA EXPERIENCE:
- It will take the necessary measures to inform the owner of the personal data about the rights conferred by the Law.
- It will adopt measures that allow the owner of the personal data to keep them updated.
- It will comply with the obligation to promptly address requests and inquiries related to the rights of personal data subjects mentioned above within the legal framework. The following guidelines will apply to the processes for addressing the rights of personal data subjects.
- The deletion or rectification of personal data will not be permitted when this affects the rights or legitimate interests of Inversiones Turísticas Costa del Sur SAC, its shareholders, employees, directors, or third parties, or when there is a legal obligation to retain personal data.
- Inversiones Turísticas Costa del Sur SAC may reject certain requests when the disclosure of personal data could compromise or hinder ongoing judicial or administrative proceedings.
8. TRANSFERS OF PERSONAL DATA
The personal data processed by ECOLUCERNA EXPERIENCE may only be transferred or assigned to third parties for the purposes related to the legitimate interests of the assignor and assignee, and with the prior, express, free, unequivocal, and informed consent of the data subject. Such consent will not be required in the cases permitted by law.
9. COLLECTION OF SENSITIVE DATA
ECOLUCERNA EXPERIENCE will only collect personal and/or sensitive data when strictly necessary and in compliance with the principles of purpose and proportionality. When the collection and processing of such data is derived from compliance with a legal obligation, ECOLUCERNA EXPERIENCE will inform the data subject of this situation prior to collection.
10. DISCLOSURE OF PERSONAL DATA
ECOLUCERNA EXPERIENCE will not disclose personal data to third parties except when:
- It is necessary for the purpose for which the personal data was collected, such as in the provision of services through third parties and suppliers.
- The owner of the personal data is informed before disclosure or at the time of collection of the personal data.
- The owner of the personal data gives his or her prior and express consent.
- Consent is not required by law.
- The personal data is required by public entities within the scope of their legal powers and responsibilities.
- The personal data is necessary to satisfy the legitimate requirements of any company interested in acquiring any of ECOLUCERNA EXPERIENCE’s operations, with the prior consent of its owner.
- Access to personal data is by auditors, lawyers and other professionals obliged to maintain professional secrecy.
11. ELIMINATION OF PERSONAL DATA
Once the processing of personal data has been completed and the principle of purpose has been met, and provided there is no legal mandate or reason justifying retaining the personal data, ECOLUCERNA EXPERIENCE will delete the data from its records. Alternatively, ECOLUCERNA EXPERIENCE may apply dissociation processes or equivalent procedures when, for commercial, statistical, or market analysis reasons, the convenience of retaining such data is justified. ECOLUCERNA EXPERIENCE will promptly define the respective procedures necessary for the deletion of personal data.
Any employee who violates the provisions set forth in this Policy will be considered a serious offense and subject to disciplinary action. ECOLUCERNA EXPERIENCE will take the disciplinary measures it deems appropriate in cases of noncompliance by employees with the obligations stipulated herein.
12. DISSEMINATION AND COMPLIANCE WITH THE POLICY
ECOLUCERNA EXPERIENCE will seek to:
- That the provisions of this Policy are complied with;
- Make this Policy known, observed and respected by each employee
- Publish this Policy in easily accessible locations
- Enter into confidentiality obligations with employees, users, contractors and third parties who access personal data included in the databases.
