Privacy Policy and Personal Data Processing — X - TRAVEL PERU

1. Commitment to Privacy

At THE COMPANY SERVICES & TOURISM X (hereinafter, “X - TRAVEL PERU”), with RUC No. 20601549256, we are committed to protecting your privacy and securely processing your personal information. This Privacy Policy describes how we collect, use, store, share, and protect your personal data, in strict compliance with Peruvian Law No. 29733 (Personal Data Protection Law) and its regulations (Supreme Decree No. 003-2013-JUS).

By providing your personal data and contracting our services, you (hereinafter, “the Client”) accept the practices described in this policy.

2. Identity and Address of the Personal Data Controller

The owner and controller of the personal data bank where your information will be stored is:

Corporate Name: THE COMPANY SERVICES & TOURISM X

Address: Urb. Dolorespata, Jr. Paititi F 3ª 270, Santiago – Cusco, Peru

Contact email for privacy matters: info@xtravelperu.com

3. What Personal Data Do We Collect?

We collect only the information strictly necessary to provide our services:

Identification Data: Full name, ID/Passport number, nationality, date of birth, and gender.

Contact Data: Email address, phone number, and country of residence.

Payment and Billing Data: Information required to process payments and issue invoices (RUC, corporate name, etc.). We do not store sensitive credit/debit card data; this is handled directly by secure payment gateways.

Sensitive Data (Health): Allergies, medical conditions, dietary restrictions, requested only when essential for your safety (e.g., adventure treks) and handled with maximum confidentiality.

Travel Data: Dates, flight details, preferences, and other logistical data.

Technical Data: Information collected via cookies on our website www.xtravelperu.com to improve your user experience.

4. Purpose of Processing Your Personal Data

Your data is used for primary purposes (necessary to deliver the service, such as operating the tour) and secondary purposes (optional, such as marketing), as detailed in our Terms and Conditions. You may object to secondary purposes at any time.

5. Transfer of Personal Data to Third Parties

To deliver the contracted service, it is essential to share your information with direct service providers (hotels, airlines, train operators) and government entities (Ministry of Culture), ensuring they comply with the security standards required by Peruvian law.

6. Data Retention Period

Your data will be retained during the contractual relationship and subsequently blocked for the legal statute of limitations (mainly for tax reasons), before being securely deleted.

7. Exercising ARCO Rights

You can exercise your ARCO rights (Access, Rectification, Cancellation, and Opposition) by sending a formal request to info@xtravelperu.com, attaching a copy of your identity document.

8. Security Measures

X - TRAVEL PERU has implemented technical, organizational, and legal security measures to protect your data. Our website uses SSL encryption and we work with payment platforms that comply with the highest security standards (PCI DSS).

9. Protection Against Phishing and Social Engineering (Fraudulent Communications)

“Phishing” and “Social Engineering” are fraud attempts to steal your personal data through communications that appear official. For your protection:

Official Channels: X - TRAVEL PERU will NEVER request passwords, full credit card numbers, or sensitive banking data via unsecured email, WhatsApp, social networks, or other unofficial means.

Verification: Any communication related to payments or sensitive data will be conducted through our official emails (@xtravelperu.com) or our secure website. Be wary of requests from unknown senders or that raise doubts.

Client Responsibility: It is the Client’s responsibility to verify the authenticity of communications. X - TRAVEL PERU is not responsible for data loss or financial damages arising from information provided by the Client through fraudulent channels we do not control.

10. Security Breach Management (Hacking)

We recognize that no computer system is infallible. In the unlikely event that our systems suffer unauthorized access (hacking) compromising the security of your personal data, we commit to:

Protocol Activation: Activate our incident response protocol to contain the breach, assess its scope, and mitigate impact.

Notification to Affected Individuals: Notify affected Clients as soon as possible, in accordance with the timelines and requirements of Law No. 29733. The notice will describe the nature of the incident, the data that may have been compromised, and the measures being taken.

Report to the Authority: Inform the Peruvian National Authority for Personal Data Protection (ANPDP).

Recommendations: Provide affected Clients with recommendations to protect themselves from possible consequences (e.g., changing passwords for other services if reused).

11. Loss or Alteration of Reservations Due to Security Incidents

If a security breach (hacking) results in the alteration, corruption, or loss of critical reservation data (e.g., entry tickets, hotel confirmations), X - TRAVEL PERU will make all reasonable and commercially viable efforts to:

Restore information from our backups.

Work with providers to reissue tickets or confirmations.

Offer a viable alternative to the Client if restoring the original service is impossible.

The Agency’s responsibility in these cases will be managed under principles of due diligence and limited in accordance with our general Terms and Conditions.

12. Intellectual Property of Client-Provided Content

This clause refers to content voluntarily created and shared by the Client with the Agency (not personal data).

Definition: “Content” means testimonials, reviews, opinions, photos, or videos that the Client submits or publishes in relation to X - TRAVEL PERU’s services.

License: By sharing such content with the Agency, the Client grants X - TRAVEL PERU a non-exclusive, worldwide, perpetual, irrevocable, royalty-free license to use, reproduce, modify, adapt, and display that content on its marketing and promotion channels (website, social networks, brochures, etc.).

Warranty of Authorship: The Client declares to be the holder of the copyrights of such content and that its use by the Agency does not infringe third-party rights. This clause does not apply to images taken by the Agency during the tour (governed by the Terms and Conditions), but to the material the Client actively provides.

13. Changes to the Privacy Policy

We reserve the right to modify this Privacy Policy. Any changes will be communicated through our official website www.xtravelperu.com.

Last updated: September 22, 2025