PRIVACY AND PERSONAL DATA PROTECTION POLICY

“FOX AVENTURS”

1. PURPOSE

This Privacy and Personal Data Protection Policy sets forth the criteria, principles, procedures, and measures adopted by FOX AVENTURS (hereinafter, “THE AGENCY”) to ensure the proper processing of personal data belonging to its clients, users, prospective clients, vendors, team members, and any other individuals whose data is processed in connection with its commercial and tourism activities.

THE AGENCY recognizes that personal data protection is a fundamental right—established under Article 2, Section 6 of the Political Constitution of Peru—and is committed to processing all personal data in full compliance with the rights, principles, and guarantees set forth in the Peruvian legal framework.

This Policy shall be interpreted and applied in accordance with Peruvian law, including Article 2, Section 6 of the Political Constitution of Peru; Law No. 29733 (Personal Data Protection Law); its Regulations approved by Supreme Decree No. 016-2024-JUS; as well as the provisions, directives, guidelines, and criteria issued by the National Personal Data Protection Authority and any other applicable regulations governing personal data protection, e-commerce, contracting, electronic communications, and tourism services. Within this framework, Law No. 29733 aims to guarantee the fundamental right to personal data protection by ensuring that data processing is conducted appropriately and with full respect for other fundamental rights.

Accordingly, THE AGENCY guarantees that personal data will be collected, recorded, organized, stored, used, communicated, retained, and, where applicable, deleted in compliance with current personal data protection legislation, adhering to the principles of legality, consent, purpose, proportionality, quality, security, recourse, adequate level of protection, and all other applicable principles.

This Policy applies to personal data collected via THE AGENCY’s website (“FOX AVENTURS”), physical or digital forms, booking platforms, email, phone calls, WhatsApp, social media, in-person interactions, and any other channel through which THE AGENCY collects or processes personal information.

2. DATA CONTROLLER

The party responsible for processing personal data (Data Controller) is:

  • Legal Name: FOX AVENTURS

  • RUC (Tax ID): 20612671371

  • Address: Pasaje San Francisco No. 10, District, Province, and Department of Cusco, Peru

  • Contact Email: reservas@foxaventurs.com

THE AGENCY determines the purposes and means of processing personal data under its custody and adopts all necessary measures to ensure such processing complies with Peruvian regulations.

When THE AGENCY engages third parties to carry out specific activities that involve processing personal data on its behalf, these parties shall act as Data Processors. They must comply with confidentiality, security, and processing obligations according to the instructions, purposes, and conditions set by THE AGENCY and applicable law, prioritizing compliance with personal data protection under Law No. 29733 and its Regulations approved by Supreme Decree No. 016-2024-JUS.

3. GOVERNING PRINCIPLES

Personal data processing by THE AGENCY shall be carried out in accordance with the principles established in Law No. 29733 (Personal Data Protection Law) and its Regulations, ensuring information is handled lawfully, responsibly, and securely. Specifically, the following principles shall be observed:

  • Legality: Data will be collected and processed lawfully and in accordance with current regulations.

  • Consent: When required, ensuring the data subject grants authorization freely, prior to processing, explicitly, unequivocally, and on an informed basis.

  • Purpose: Data will be used solely for specified, explicit, and legitimate purposes related to the services offered.

  • Proportionality: Data collection and processing will be limited to what is necessary, relevant, and adequate for the informed purposes.

  • Security: Technical, organizational, and legal measures will be implemented to protect data against loss, alteration, misuse, or unauthorized access.

4. PERSONAL DATA WE COLLECT

To deliver its tourism services, “FOX AVENTURS” will only collect and process personal data that is adequate, relevant, and necessary for specified, explicit, and lawful purposes, in accordance with Law No. 29733, its Regulations approved by Supreme Decree No. 016-2024-JUS, and other applicable laws.

We may process identification and contact information, such as full name, national ID (DNI), passport details, nationality, date of birth, phone number, WhatsApp number, and email address. We also process information related to bookings, travel dates, number of passengers, itineraries, payments, ticket issuance, and receipts/invoices.

Additionally, through FOX AVENTURS’ website and digital channels, we may collect technical browsing data—such as IP address, browser type, operating system, pages visited, and data collected via cookies or similar technologies—in accordance with informed purposes and the applicable legal basis.

Regarding sensitive personal data, processing will strictly be limited to cases where it is necessary, relevant, and proportionate to a specified, explicit, and lawful purpose, and where a valid legal basis exists. Where applicable, consent must meet the requirements set forth in Law No. 29733 and its Regulations.

Under no circumstances will excessive or unnecessary personal data be collected relative to the purpose justifying its processing.

5. PURPOSE OF DATA PROCESSING

“FOX AVENTURS” will collect and process personal data for specified, explicit, and lawful purposes that have been disclosed to the data subject in advance, and only to the extent necessary to fulfill those purposes. Information obtained will not be used for purposes incompatible with those for which it was originally collected, unless authorized by law or with the required consent of the data subject.

Furthermore, “FOX AVENTURS” will take all necessary measures to ensure personal data is processed proportionally and securely, restricting its collection, use, storage, and retention to what is strictly necessary. To this end, technical, organizational, and legal safeguards will be applied to prevent loss, alteration, unauthorized access, misuse, or disclosure.

Personal data will only be communicated or transferred to third parties when backed by a legal basis, when necessary to fulfill contracted services, or to comply with a legal obligation.

6. CONSEQUENCES OF REFUSING TO PROVIDE PERSONAL DATA

Providing certain personal data may be necessary for contracting, managing, and properly delivering the tourism services offered by “FOX AVENTURS”. If a data subject refuses to provide information essential to complete a reservation, issue tickets, manage a booked service, or fulfill a legal obligation, THE AGENCY may be fully or partially unable to provide or manage the requested service. This circumstance will be communicated to the data subject in a timely manner.

Likewise, when specific data is required to verify identity, coordinate booked services, issue travel documentation, or handle requests directly tied to service delivery, failure to supply this information may prevent service execution. In such cases, THE AGENCY will clearly inform the data subject in advance about the need for the data and the consequences of withholding it.

On the other hand, refusing to provide personal data requested purely for optional purposes will not, on its own, affect the booking or delivery of the main service. In all cases, requested information must be directly relevant, adequate, non-excessive, and proportionate to its underlying purpose, in accordance with national regulations.

7. CONSENT

Personal data processing is grounded on the free, prior, informed, explicit, and unequivocal consent of the DATA SUBJECT.

In digital forms or web platforms, consent is granted by explicitly accepting this Privacy Policy through checkboxes or affirmative actions within contact or booking forms. When users provide data in person, via phone call, email, social media, or WhatsApp, consent is deemed granted provided they were previously informed of this Policy and voluntarily provided their personal details.

8. THIRD-PARTY TRANSFERS AND DATA PROCESSORS

“FOX AVENTURS” does not sell, market, rent, or lease users’ personal data. However, when necessary to contract, manage, and properly deliver tourism services, it may share specific personal data with third parties directly involved in service execution—such as hotels and accommodations, transport companies, tour operators, guides, railway operators, and other tourism service providers.

Additionally, personal data may be shared with public entities or competent authorities whenever required by a legal obligation, an official mandate, or when necessary to issue named tickets, registrations, permits, or other procedures directly tied to contracted services.

Furthermore, “FOX AVENTURS” may use technology vendors who assist with payment processing, electronic invoicing, web hosting, storage, and data management. In these instances, such third parties must process personal data strictly for authorized purposes and in compliance with the instructions, security conditions, and obligations mandated by Law No. 29733, its Regulations, and related standards.

In all cases, data transfers or disclosures will be restricted to information that is adequate, relevant, and necessary for the intended purpose. THE AGENCY will strive to ensure third-party recipients implement adequate measures to protect confidentiality and security, preventing data from being used for unauthorized purposes.

9. CROSS-BORDER DATA FLOWS

When technical services used by “FOX AVENTURS” involve storing, accessing, or processing personal data outside Peruvian territory, such cross-border data flows shall comply with the conditions, guarantees, and requirements set forth in Law No. 29733, its Regulations, and related legislation.

This may occur, among other scenarios, when THE AGENCY utilizes web hosting services, cloud storage, management platforms, or other digital tools whose servers or infrastructure are located abroad.

In these instances, “FOX AVENTURS” will adopt necessary measures to guarantee personal data maintains an adequate level of protection and security, providing the data subject with relevant information regarding cross-border flows whenever required by current law.

10. DATA RETENTION AND SECURITY

Personal data will be retained only as long as necessary to fulfill the purpose for which it was collected, or for the timeframes established by applicable law.

“FOX AVENTURS” will implement technical, organizational, and legal measures designed to prevent unauthorized access, loss, alteration, disclosure, or misuse of personal data.

11. SECURITY MEASURES

“FOX AVENTURS” will adopt and implement reasonable and adequate technical, organizational, and legal security measures tailored to the nature of the data processed and its associated risks, preventing loss, alteration, unauthorized access, use, or disclosure.

To achieve this, THE AGENCY may implement security mechanisms such as SSL certificates on its website, access controls to information, protective safeguards for physical and digital documents, and internal security and confidentiality policies.

These measures will be reviewed as needed and updated in response to evolving risks, processing characteristics, and obligations under national law.

12. EXERCISING ARCO RIGHTS

Data subjects may exercise their rights of Access, Rectification, Cancellation, and Opposition (ARCO Rights) regarding their personal information, as well as any other rights recognized by applicable data protection regulations.

To exercise these rights, the data subject must submit a request via email to reservas@foxaventurs.com, using the subject line: “ARCO REQUEST – [Name of Data Subject]”. The request must contain sufficient details to identify the data subject, clearly specify the right being exercised, and, where applicable, include proof of identity or legal representation.

FOX AVENTURS will process and address all requests in accordance with the requirements, conditions, and timelines mandated by current legislation, taking all necessary steps to safeguard the data subject’s rights.

13. COOKIES POLICY AND EXTERNAL LINKS

The “FOX AVENTURS” website may use first-party and third-party cookies to ensure proper website functionality, enhance the browsing experience, and gather statistical usage data. Users can manage or configure cookie settings through their web browser preferences.

The website may also contain links to third-party websites, platforms, or services. “FOX AVENTURS” is not responsible for the privacy policies, content, terms of use, or data practices of these external third parties. Users are encouraged to review third-party privacy policies before providing any personal information.

14. MODIFICATIONS AND EFFECTIVE DATE

“FOX AVENTURS” reserves the right to modify, update, or supplement this Privacy Policy whenever necessary to align with changes in applicable law, updates to internal procedures, the introduction of new services, or the adoption of new technologies impacting data processing.

Any modifications will be brought to the user’s attention via publication on the official “FOX AVENTURS” website, indicating the date of the latest update. Modified versions become effective immediately upon publication, unless applicable laws mandate a different effective date or require additional measures.

Modifications will not impair rights guaranteed to data subjects, nor will they permit data handling contrary to stated purposes and conditions. FOX AVENTURS remains bound at all times to adhere to current personal data protection laws.