TECHNICAL MEASURES FOR THE PROTECTION OF PERSONAL DATA COLLECTED THROUGH DIGITAL CHANNELS

TECHNICAL MEASURES FOR THE PROTECTION OF PERSONAL DATA COLLECTED THROUGH DIGITAL CHANNELS

Peru Inka Trips Travel Agency

Peru Inka Trips implements reasonable technical and organizational measures aimed at protecting personal data collected through its digital channels, striving to prevent its loss, alteration, disclosure, unauthorized access, or any other improper processing.

1. Security of Information Transmission

Digital channels used to collect personal information must incorporate secure communication mechanisms, including the use of encryption protocols such as HTTPS/TLS, where applicable.

These measures seek to protect information during its transmission between the user’s device and the systems used by Peru Inka Trips.

2. Access Control

Access to personal data is restricted to authorized personnel who require such information to perform their duties.

To this end, the following may be implemented:

• Individual usernames and passwords.

• Access restrictions based on staff roles and functions.

• Regular credential management and updates.

• Authentication and access control measures for systems.

• Revocation of access when a user no longer requires it.

3. Protection of Systems and Platforms

Peru Inka Trips adopts measures aimed at keeping systems, applications, and devices used to manage personal information protected, including, where applicable:

• Updating systems and applications.

• Protection against malicious software (malware).

• Secure configuration of equipment and services.

• Monitoring of unusual activities.

• Implementation of data backup mechanisms.

• Recovery measures in the event of technical incidents or failures.

4. Data Minimization and Management

Through digital forms and channels, efforts are made to request only the information necessary to handle inquiries, manage bookings, provide tourism services, process payments, issue receipts/invoices, and comply with corresponding obligations.

Personal data shall not be retained longer than necessary for the purposes for which it was collected, unless a legal obligation requires its retention.

5. Protection of Payment-Related Information

When commercial operations involve payments via cards or other electronic means, Peru Inka Trips may utilize specialized platforms or providers for payment processing.

Where applicable, sensitive financial data will be processed directly by such providers in accordance with their own security mechanisms, preventing Peru Inka Trips from storing complete payment card information that is not necessary to provide the service.

6. Backups and Recovery

Where applicable, backup mechanisms for necessary information will be established to ensure business continuity and facilitate recovery in the event of loss, damage, or system unavailability.

Data backups must include reasonable protection measures against unauthorized access.

7. Security Incident Management

Upon identifying an incident that may compromise personal data, Peru Inka Trips may adopt containment, investigation, and recovery measures aimed at mitigating its potential effects.

Where appropriate, the need to report the incident to competent authorities or to data subjects will be evaluated in accordance with applicable legislation.

8. Service Providers and Third Parties

When Peru Inka Trips utilizes technology providers, booking platforms, web hosting services, communication tools, or payment processing providers that may have access to personal data, it will strive to select services that feature appropriate security measures.

Access by such providers will be limited to the information necessary for the delivery of the contracted service, pursuant to applicable terms and conditions.

9. Review and Updates

Technical and organizational security measures will be reviewed periodically and may be updated based on technological advancements, identified risks, changes in utilized systems, and applicable legal obligations.