Privacy and Personal Data Protection Policies

INNER PACHA Tour Operator

Version: April 2026

1. INTRODUCTION AND SCOPE

INNER PACHA Tour Operator (hereinafter referred to as “the Company,” “we,” or “our”) is committed to protecting the privacy and personal data of our clients, suppliers, collaborators, and website visitors.

These Privacy and Personal Data Protection Policies have been prepared in accordance with:

• International American standards: Updated Principles on Privacy and Personal Data Protection of the Organization of American States (OAS); California Consumer Privacy Act (CCPA/CPRA); and the data protection laws of Argentina (Law 25.326), Brazil (LGPD), Colombia (Law 1581 of 2012), Peru, Chile, and other countries in the region.

• International European standards: General Data Protection Regulation (GDPR) (EU) 2016/679.

These policies apply to all personal information we collect, process, and store in the context of our business activities, including tour operations, reservations, commercial communications, and the use of our website.

2. KEY DEFINITIONS

For the purposes of these policies, the following terms shall be understood as:

3. GOVERNING PRINCIPLES

INNER PACHA Tour Operator adheres to the following principles recognized by the OAS and the GDPR:

4. PERSONAL DATA WE COLLECT

INNER PACHA Tour Operator collects the following categories of personal data:

4.1 Identification and contact data

• Full name (as it appears on the passport)

• Passport number and copy of passport data page

• Date of birth

• Nationality

• Email address

• Phone number (landline and/or mobile)

• Postal address

4.2 Travel and reservation data

• International and domestic flight information

• Accommodation and service preferences

• Reservation history and past travel records

• Emergency contact information

4.3 Payment data

• Credit/debit card information (partial or masked)

• Bank transfer details

• Transaction history

4.4 Medical data (sensitive)

• Information about pre-existing health conditions

• Special dietary requirements

• Accessibility or reduced mobility needs

• Vaccinations and medical certificates

4.5 Technical data (website)

• IP address

• Browser type and version

• Device used

• Cookies and tracking technologies (see Section 9)

5. LEGAL BASES FOR PROCESSING

In accordance with GDPR standards and Latin American laws, INNER PACHA Tour Operator processes your personal data based on the following legal grounds:

6. PURPOSES OF PROCESSING

INNER PACHA Tour Operator will process your personal data exclusively for the following purposes:

1. Reservation management and service contracting: Process your reservation, issue payment receipts, coordinate with suppliers (hotels, transportation, guides, restaurants), and manage any modifications or cancellations.

2. Customer service and communication: Respond to your inquiries, send confirmations, reminders, logistical information about the tour, and communications related to your trip.

3. Compliance with legal and regulatory obligations: Invoicing, registration with immigration and tourism authorities, compliance with travel regulations.

4. Security and risk prevention: Verify identity, prevent fraud, ensure safety during tours (including medical information for emergencies).

5. Service improvement: Statistical analysis, satisfaction assessment, development of new tourism products.

6. Marketing and commercial communications (only with express consent): Sending promotional offers, newsletters, information about new tours.

7. DATA SUBJECT RIGHTS

INNER PACHA Tour Operator guarantees data subjects the exercise of the following rights, recognized by both American and European standards:

To exercise any of these rights, the data subject must submit a written request through the channels indicated in Section 14 of these policies. INNER PACHA will respond to such requests within the deadlines established by applicable law (see table above).

8. CONSENT AND ITS WITHDRAWAL

8.1 Characteristics of consent

In accordance with American and European standards, consent must be:

• Freely given: Without coercion or undue pressure.

• Specific: For determined purposes.

• Informed: With clear knowledge of what data is processed and for what purpose.

• Unambiguous: Through a clear affirmative act or declaration (e.g., active checkbox, not pre-ticked boxes).

8.2 Withdrawal of consent

Data subjects have the right to withdraw their consent at any time, with the same ease with which it was given. Withdrawal will not have retroactive effect, meaning it will not affect the lawfulness of processing based on consent prior to its withdrawal.

To withdraw consent, the data subject must:

• Use the “unsubscribe” link in any commercial communication, or

• Submit a written request through the channels indicated in Section 14.

8.3 Processing of children’s and adolescents’ data

In all programs, the maximum age for a passenger to be considered a child is 11 years and 11 months. For the processing of data of minors, express consent from parents or legal guardians will be required.

9. COOKIES AND TRACKING TECHNOLOGIES

Our website uses cookies and similar technologies. In accordance with international standards, we classify cookies as follows:

When accessing our website, you will be presented with a cookie banner that allows you to:

• Accept all cookies.

• Reject all non-essential cookies.

• Configure your cookie preferences.

You can modify your cookie preferences at any time through your browser settings or through our privacy preference center.

10. DATA SECURITY

INNER PACHA Tour Operator implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with international standards:

Technical measures:

• Encryption of data in transit (TLS/SSL) and at rest.

• Firewalls and intrusion detection systems.

• Role-based access control and multi-factor authentication.

• Encrypted backups and secure storage.

• Antivirus and antimalware protection.

Organizational measures:

• Information security policies.

• Periodic staff training on data protection.

• Data breach management procedures.

• Data Protection Impact Assessments (DPIAs) for high-risk processing.

Data breach management:
In the event of a personal data breach, INNER PACHA will:

1. Document it internally.

2. Notify the competent supervisory authority within 72 hours of becoming aware of the breach (where required by applicable law).

3. Notify affected data subjects without undue delay when the breach poses a high risk to their rights and freedoms.

11. INTERNATIONAL DATA TRANSFERS

Given the nature of our services (international tours, clients worldwide, suppliers in multiple countries), INNER PACHA Tour Operator may carry out international transfers of personal data.

11.1 Applicable safeguards

To ensure an adequate level of protection, INNER PACHA implements the following safeguards as applicable:

• Adequacy decisions: Where the recipient country has been recognized by the European Commission or by Latin American authorities as providing an adequate level of protection (e.g., Argentina has EU adequacy status).

• Standard Contractual Clauses (SCCs): For transfers to countries without an adequacy decision, we will use the Standard Contractual Clauses approved by the European Commission.

• Explicit consent: For specific transfers where the above safeguards do not apply, we will request the data subject’s explicit consent.

11.2 Recipients of international transfers

Your personal data may be transferred to:

• Tourism service providers (hotels, airlines, ground transportation operators, local guides) located in Peru and other countries.

• Payment processors and financial institutions.

• Technology service providers (booking platforms, cloud storage, CRM).

12. DATA RETENTION

INNER PACHA Tour Operator will retain your personal data only for as long as necessary to fulfill the purposes for which they were collected, including compliance with legal, tax, and accounting obligations.

After these periods, data will be securely deleted or irreversibly anonymized.

13. DATA CONTROLLER AND DATA PROTECTION OFFICER

14. EXERCISE OF RIGHTS AND SUBMISSION OF CLAIMS

14.1 Channel to exercise your rights

Data subjects may exercise their rights of access, rectification, erasure, restriction, portability, and objection through:

• Web form: Available on our website in the “Privacy” / “Exercise of ARCO rights” section.

• Email: privacy@innerpacha.com (subject: “Exercise of ARCO rights”)

• Postal mail: [Complete address], Attn: Data Protection

14.2 Required information

To process your request, you must provide:

• Full name and a copy of your identification document (to verify identity).

• Clear description of the right you wish to exercise.

• Contact information to receive a response.

• In case of request by a third party (representative), a power of attorney or sufficient accreditation.

14.3 Response deadlines

INNER PACHA will respond to all requests within the deadlines established by the legislation applicable to each jurisdiction:

14.4 Claims to supervisory authorities

If the data subject considers that the processing of their personal data violates applicable law, they have the right to lodge a complaint with the relevant supervisory authority:

• Peru: National Authority for Personal Data Protection (ANPDP)

• Argentina: Agency for Access to Public Information (AAIP)

• Brazil: National Data Protection Authority (ANPD)

• Colombia: Superintendence of Industry and Commerce (SIC)

• EU: Supervisory authority of the Member State where they habitually reside or work.

15. UPDATES TO THESE POLICIES

INNER PACHA Tour Operator reserves the right to update or modify these Privacy Policies at any time to reflect changes in our practices, in applicable law, or in international standards.

When we make material changes, we will notify affected data subjects by:

• A prominent notice on our website.

• Email (when we have their address and it is relevant).

• Any other means required by applicable law.

The date of the last update is indicated at the beginning of this document (Version: April 2026). We recommend that you periodically review these policies.

16. ACCEPTANCE OF THE PRIVACY POLICIES

By making a reservation, using our website, providing us with your personal data, or accepting our General Terms and Conditions, you declare that you have read, understood, and accepted these Privacy and Personal Data Protection Policies.

INNER PACHA Tour Operator
Travel agency accredited – GERCETUR
Limited liability corporation