Política de Privacidad

DATA CONTROLLER	RUC	REGISTERED ADDRESS
ECS TRAVEL S.A.C. Commercial names: ECS Travel and ECS LATAM DMC	20504756115	Los Pinos 156, Office 502, Miraflores, Lima, Peru

1. Scope and Applicable Law

This Policy explains how ECS TRAVEL S.A.C. ("ECS Travel", "ECS LATAM", "we", "us" or "our") collects, uses, stores, shares, transfers and protects personal data in connection with its destination management, tailor-made travel, operational support, commercial and digital activities. It applies to travelers, clients, prospective clients, travel agencies, tour operators, corporate and educational clients, suppliers, guides, contractors, website users and persons who submit requests, complaints or claims.

ECS Travel processes personal data primarily under Peru's Constitution, Law No. 29733 - Personal Data Protection Law, and its Regulations approved by Supreme Decree No. 016-2024-JUS. Law No. 29571 and the Complaints Book rules also apply to data collected through complaints and claims. Foreign privacy laws, such as the EU or UK GDPR, Brazil's LGPD or other local laws, apply only when their territorial and material requirements are met.

2. Personal Data We Collect and Where It Comes From

We collect only data that is reasonably necessary for the stated purpose. Depending on the relationship and service, this may include:

CATEGORY	EXAMPLES
Identity and contact	Name, nationality, date of birth, ID or passport details, address, email, telephone, WhatsApp and emergency contacts.
Travel and service	Travel dates, itineraries, flights, accommodation, transfers, activities, rooming lists, preferences and service communications.
Sensitive travel needs	Allergies, dietary requirements, disability, accessibility, mobility, relevant health conditions and other information needed for safe service delivery.
Business and payment	Agency or company, job title, quotations, contracts, billing and tax data, payment status and transaction references.
Digital and complaint	Cookie identifiers, website activity, form submissions, communications, complaints, claims, supporting evidence and responses.

Data may be provided directly by the individual; by a travel agency, company, school, group organizer, parent or guardian acting on the traveler's behalf; by suppliers and destination partners; through our website forms, email, WhatsApp Business, LinkedIn or payment links; from permitted public or official sources; or automatically through approved website technologies. A person providing third-party data must be authorized to do so and must ensure that the individual has received the relevant privacy information.

Our website may collect information through Contact Us, Request a Tailor-Made Proposal, Schedule a Consultation and Complaints Book forms. These forms may request a name, agency or company, email, telephone or WhatsApp, country, nationality, travel dates and number of travelers, together with information voluntarily included in the message.

3. Why We Process Personal Data and the Legal Bases

We may process personal data for the following purposes:

• Travel services: Responding to inquiries, preparing proposals, confirming reservations, issuing documents, coordinating suppliers, providing on-the-ground and emergency support, managing changes, incidents and post-travel service.
• B2B and white-label operations: Working with agencies and tour operators, coordinating traveler information, protecting the agency's brand, managing contracts, service standards and operational reporting.
• Safety and personalization: Managing dietary, health, accessibility, mobility and other special requirements that are relevant to safe and appropriate travel.
• Commercial administration: Contracts, invoices, payments, accounting, tax, fraud prevention, audits, insurance, legal claims and regulatory compliance.
• Supplier: Selecting, contracting, paying and evaluating suppliers; local partners and independent contractors.
• Customer service, complaints and security: Handling customer service, complaints and claims, complying with the Complaints Book rules, protecting systems, preventing misuse and investigating incidents.
• Marketing and analytics: Maintaining authorized commercial contacts, sending news or promotions and using non-essential cookies or analytics only when consent or another lawful basis is available.

Legal bases. Processing is based, as applicable, on free, prior, express, informed and unequivocal consent; steps requested before entering into a contract; performance of a contract; compliance with legal obligations; the establishment, exercise or defense of rights; or another exception permitted by applicable law. Consent for sensitive data, marketing, identifiable images and non-essential cookies is requested separately when required and may be withdrawn for future processing.

4. Sensitive Data, Minors and Agency-Supplied Traveler Data

Sensitive information. Health, allergy, disability, mobility, dietary or other sensitive information is collected only when relevant to safe travel or requested services. Access is restricted and disclosure is limited to suppliers, medical providers, insurers or authorities that reasonably need the information. Travelers should provide only information that is necessary and current.

Minors. Data relating to minors must be provided or authorized by a parent, guardian or legally responsible person, unless applicable law permits otherwise. ECS Travel does not knowingly use children's data for behavioral advertising or unrelated marketing.

Agency responsibility. When a travel agency, tour operator, school, company or group organizer sends traveler data to ECS Travel, that organization must have a lawful basis to collect and disclose the information, provide the required notice and obtain any consent required for sensitive data or international transfers. ECS Travel will use the data only for agreed services, operational support and legal obligations.

5. Recipients, Service Providers and International Transfers

To deliver travel services and operate our business, necessary personal data may be disclosed to:

• Hotels, airlines, rail and transport providers, guides, attractions, restaurants, cruise or expedition operators and local destination partners;
• The contracting travel agency, tour operator, corporate or educational client, where required for the agreed service;
• Payment, banking, accounting, insurance, medical, emergency, legal and professional advisers;
• Technology providers used for hosting, email, storage, CRM, communications, analytics, advertising, cybersecurity and embedded media; and
• SUNAT, INDECOPI, immigration, police, courts, health authorities and other competent bodies when legally required.

Our current technology environment includes GoDaddy and WordPress for website hosting and operation; Microsoft 365, Outlook and OneDrive; Google Workspace, Gmail and Google Drive; HubSpot for CRM and contact management; Google Analytics, Google Ads, Meta Pixel and embedded YouTube content; and Culqi for payment processing. Providers may change as our operations evolve, but any replacement provider must be used under appropriate confidentiality, security and data-protection terms.

Because ECS Travel coordinates international itineraries and uses global technology providers, data may be transferred outside Peru, principally to the United States and, when required for a trip, to Ecuador, Chile, Argentina, Bolivia and Brazil. Cross-border transfers are limited to what is necessary and are carried out using an adequate level of protection, contractual safeguards, documented instructions or another mechanism permitted by Law No. 29733 and its Regulations.

6. Payments and Automated Processing

Culqi/Izipay processes complete payment-card details under its own security and privacy terms. ECS Travel does not receive or store complete card numbers; it receives only the payment status, token, transaction reference or other limited confirmation needed to manage the booking, accounting and fraud-prevention process.

ECS Travel does not make decisions about accepting clients, confirming reservations or setting prices solely through automated processing or artificial intelligence. Culqi may apply automated antifraud rules to payment attempts under Culqi's own terms and controls.

7. Website, Cookies, Analytics, Marketing and Images

Our website uses essential technologies required for security, forms and basic operation. Subject to applicable consent requirements, it may also use:

CATEGORY	CURRENT TOOLS AND PURPOSE
Essential	WordPress and hosting technologies needed to operate and secure the website and deliver requested functions.
Analytics	Google Analytics, used to understand website traffic and performance.
Advertising	Google Ads and Meta Pixel, used to measure campaigns and, where authorized, support advertising.
Embedded media	YouTube, used to display video content and which may set third-party identifiers or cookies.

Non-essential analytics, advertising and embedded-media technologies must not be activated before the required notice and consent. Website users must be able to accept, reject or manage non-essential preferences through the consent banner. Consent may be changed or withdrawn later. Browser settings may also be used to control cookies, although disabling essential technologies may affect website functions.

ECS Travel currently maintains authorized agency and prospect contacts but does not routinely send newsletters. Any future promotional communication will be sent only where permitted and will include an unsubscribe method. Service messages relating to an inquiry, booking, payment or trip are not marketing communications.

ECS Travel does not routinely take or publish identifiable passenger photographs, videos or testimonials. If an identifiable image or testimonial is requested for public use, a separate written authorization will be obtained. Withdrawal applies to future use, subject to material already lawfully published and any applicable contractual or legal limitation.

8. Retention

Personal data is retained only for the time reasonably necessary for the relevant purpose, contract, consent or legal obligation. The standard periods below may be extended where required by law, an audit, a complaint, a dispute, insurance or the defense of rights:

INFORMATION	STANDARD RETENTION PERIOD
Inquiries that do not become bookings	2 years from the last meaningful contact.
Booking and travel files	2 years after completion of the trip.
Invoices and tax records	For the period required by applicable tax and accounting law.
Passport copies	Up to 90 days after the trip, unless a legal, operational or dispute-related need requires longer retention.
Health, dietary, accessibility and mobility data	Up to 90 days after the trip, unless an incident, claim or legal obligation requires longer retention.
Complaints Book records	For the legally required period.
Privacy / ARCO requests and responses	5 years.
Authorized marketing contacts	Until consent is withdrawn, the person objects, or 2 years of inactivity.
Supplier and partner records	For the commercial relationship plus 5 years, subject to legal requirements.

At the end of the applicable period, data is deleted, anonymized or blocked from routine use, unless continued retention is required by law or for the defense of rights.

9. Security and Personal-Data Incidents

ECS Travel applies safeguards proportionate to its size and processing activities, including individual passwords, password-protected computers, updated antivirus protection, backups, limited access to traveler files, confidentiality obligations with personnel and relevant suppliers, and basic privacy and cybersecurity training. No system is completely risk-free, but we maintain reasonable measures to protect confidentiality, integrity and availability.

Suspected loss, unauthorized access, accidental disclosure or other personal-data incidents are assessed, contained and documented. Where required by the Peruvian Regulations, ECS Travel will notify the National Authority for Personal Data Protection within forty-eight (48) hours after becoming aware of a qualifying breach and will inform affected individuals when legally required.

10. Your Rights and How to Exercise Them

Subject to legal conditions and exceptions, individuals may request information, access, rectification or updating, erasure or cancellation, objection, withdrawal of consent, restriction or blocking, portability where applicable, and human review of a decision based solely on automated processing.

REQUEST	CURRENT PERUVIAN RESPONSE PERIOD
Information	8 business days.
Access	20 business days.
Rectification, erasure/cancellation, objection and other applicable rights	10 business days.

Requests may be sent to info@ecslatam.com or delivered to ECS TRAVEL S.A.C., Los Pinos 156, Office 502, Miraflores, Lima, Peru, with the reference "PERSONAL DATA REQUEST". The request should include the applicant's name, the right being exercised, the data or processing involved, a clear description of the request and the preferred response channel. ECS Travel may request reasonable proof of identity or representation and may ask the applicant to correct an incomplete request within the legally permitted period.

Privacy requests are coordinated by the Operations area. If an individual considers that a request has not been adequately addressed or that their rights have been infringed, they may seek protection before Peru's National Authority for Personal Data Protection through the official channels of the Ministry of Justice and Human Rights.

11. Policy Updates and Contact

This Policy may be updated to reflect legal, operational, technological or security changes. The current version and effective date will be published on our website. A new consent will be requested before personal data is used for a new purpose when consent is legally required.