Learn about the ways we protect your personal data.
Personal Data Protection Policy
1. Introduction
This document contains the Privacy Policy of the company: INVERSIONES NACIONALES DE TURISMO S.A. (hereinafter referred to as INTURSA), which is in accordance with current regulations on the Protection of Personal Data (Law No. 29733 and Supreme Decree 003-2013-JUS). This Privacy Policy outlines the purposes of the information you provide us, who are responsible for processing it, the retention period in our Databases, the protection measures, and the means to exercise your rights as the holder of Personal Data.
2. Scope
This Policy applies to all personal data processing carried out by INTURSA and also applies to those individuals or companies to whom INTURSA assigns the processing of personal data for which it is responsible.
3. About the type of information collected
4. Purpose of Personal Information Processing
The purposes for processing the personal data that our clients enter in the different forms on the website are aimed at managing responses to their inquiries, requests, and addressing any other type of information they require through these.
The personal data that you provide us is used for the fulfillment of the following purposes:
To register personal data for statistical and historical purposes.
To address all requests and management derived from the contractual relationship with INTURSA;
To establish an effective means of communication to obtain a response to the quotes requested for any service you ask from the hotels owned by INTURSA;
To establish a means of communication to provide you with responses to management requests, complaints, and claims presented in the complaints book.
Now, if you expressly authorize it, INTURSA may use the information you provide us for the fulfillment of the following additional purposes:
To communicate information about promotions, benefits, contests, offers, and, in general, to advertise INTURSA's services;
To conduct satisfaction surveys, demand studies, effectiveness of means, among others, related to the activities of INTURSA.
5. About Access to Information
By this means, you authorize us to share and arrange the processing of your personal information with third parties (whether national or international companies) who provide us with services to improve our activities.
In these cases, INTURSA will ensure that the processing of your data is limited to the purposes previously authorized, that it remains confidential, and that appropriate security measures are implemented.
The details of these third parties with whom the information is shared at a national or international level (cross-border flow) are detailed in ANNEX I of this policy. Any variation of the personal data processors will be communicated to your email.
6. Personal Data Processing Deadline
The personal data processed by INTURSA will be stored for an indefinite period to fulfill the purposes set forth in this Policy, in accordance with the involved database or until you request its cancellation or deletion.
7. Confidentiality of Personal Data
The personal data provided by customers will be treated with complete confidentiality. INTURSA is committed to maintaining professional secrecy regarding this information and guarantees the duty to safeguard it by adopting all necessary security measures.
8. Personal Data Security
In compliance with current regulations, INTURSA has adopted appropriate legal, organizational, and technical security measures to ensure the safety of personal data, preventing its alteration, loss, improper treatment, or unauthorized access.
In this sense, INTURSA will only process personal data that is stored in repositories that meet the security conditions required by the Data Protection Regulations.
9. Regarding the exercise of rights as the holder of Personal Data
Web customers and users who have provided their personal data to INTURSA can contact the undersigned to exercise their rights to information, access, updating, inclusion, rectification, and deletion, to prevent the supply of their personal data, to oppose the processing or objective processing of the data, under the terms set forth in current Peruvian legislation.
To exercise these rights, you can do so by visiting www.intursa.com.pe/derechos-arco
10. Consent
By accepting this Privacy Policy, our customers and web users agree with all the aspects outlined in this document and authorize us to process their personal data for the purposes outlined in this document.
It is important to note that INTURSA does not require consent to process personal data obtained from publicly accessible sources, whether free or not; likewise, it may process personal data from non-public sources, provided that such sources have their consent to process and transfer such personal data.
11. Validity and Modification of the Privacy Policy
INTURSA reserves the right to modify its Privacy Policy in the event of any changes in the applicable legislation, doctrinal changes, case law, or for its own business criteria. INTURSA may make modifications and corrections to this Privacy Policy. If any changes are made to this Policy, the new text will be published on this same website. Please be sure to regularly check these terms to review any changes that may have occurred and how they may affect you.
ARCO Rights
1. Description
1.1 Objective:
The procedure aims to serve as a guide to handle requests submitted for the exercise of the rights of information, revocation, and ARCO rights by the holder of personal data, in order to comply with the requirements of the Personal Data Protection Law and its Regulations, thus avoiding infringements and sanctions from the National Authority for Personal Data Protection, which could affect the institutional image, the relationship with its clients, and the reputation of Inversiones Nacionales de Turismo S.A (hereinafter INTURSA).
1.2 Scope:
This document is applicable to all areas of INTURSA involved in the processing of personal data.
1.3 Definitions:
Personal Data Protection Responsible: Person or committee responsible for ensuring compliance with the processing of personal data for the purposes for which the personal data holder gave their consent. Furthermore, it is the one within INTURSA that requests and receives the necessary documentation to exercise the rights of the personal data holder and validate compliance with the requirements of the request. If necessary, they will also be responsible for formulating and sending additional documentation or correcting the request.
Personal Data Holder: Natural person to whom the personal data belongs.
Processing of Personal Data: Any operation or procedure related to personal data, automated or not, such as collection, registration, organization, storage, conservation, elaboration, modification, extraction, consultation, use, blocking, deletion, communication by transfer or by dissemination, or others that allow access, correlation, or interconnection of personal data.
Personal Data Receiving Responsible: This refers to any natural or legal person under private law, including branches, subsidiaries, affiliates, or similar; or public entities, that receives the data in the case of international transfer, whether as a holder or responsible for the personal data bank, or as a third party.
Third Party: Any natural person, legal entity under private law, or public entity, different from the holder of personal data, the holder or manager of the personal data bank, and the responsible for processing, including those who process the data under the direct authority of any of them.
Blocking: A measure by which the manager of the personal data bank prevents third parties from accessing the data. Data subject to a blocking process cannot be processed during the period in which a request for update, inclusion, rectification, or deletion is being processed, in accordance with the provisions of the third paragraph of Article 20 of the Law. It is also imposed as a prior step to cancellation for the time necessary to determine possible responsibilities related to the treatments, during the legal statute of limitations or as provided contractually.
Personal Data Bank Manager: Any natural person or legal entity under private law or public entity that alone or acting together with another person performs the processing of personal data on behalf of the holder of the personal data bank.
Days: Business days.
1.4 Right to Information, Revocation, and ARCO Rights:
This document describes the process for addressing the rights of information, revocation, and ARCO of the holders of personal data, which are defined as follows:
Information: Right of the personal data holder to be informed about the purpose for which their personal data is being processed, as well as the recipients of the same and the database where their personal data is stored.
Revocation: Right of the personal data holder to revoke their consent partially or totally regarding the processing of their personal data at any time, without prior justification and without retroactive effects.
Access: Right of the personal data holder to obtain information related to their personal data, as well as all conditions and generalities of the processing of the same.
Rectification: Right of the personal data holder to have their data modified if it is found to be inaccurate, erroneous, or false.
Cancellation: Right of the personal data holder to request the deletion or cancellation of their personal data when they consider that it is not being processed in accordance with the Law and its Regulations.
Opposition: Right of the personal data holder to request the cessation of processing when they have not given their consent for the collection of their personal data, based on any founded and legitimate cause related to a specific personal situation.
2. Procedure for exercising the rights of personal data holders
2.1 Receipt of the request:
The receipt of the request for the exercise of the rights of personal data holders may be carried out through the following channels:
In person at the INTURSA offices, the holder of personal data may request the "Form for exercising the right to information, revocation, and ARCO rights – Annex 1," to begin the presentation of the request to exercise their rights. The holder of personal data must complete the required personal data in the form and sign the document as a demonstration of their agreement with the recorded data.
As a fee for receiving the document, a copy of the form must be provided to the data holder.
Through the INTURSA website, the holder of personal data may download the "Form for exercising the right to information, revocation, and ARCO rights – Annex 1" to begin the presentation of the request to exercise their rights. The holder of personal data must complete the required personal data in the form and sign the document in agreement with the recorded data, subsequently sending the document to the email indicated on the website. The sent email must be forwarded to the "Data Protection Officer" to evidence the receipt of the request to exercise the rights of the personal data holder.
Additionally, in both channels, once the form for exercising their rights is completed, the holder of personal data must verify their identity by presenting a copy of their identity document and, in the case of a legal representative, must present a document that certifies such power along with their ID, handing a copy of the documents to the request assistance staff.
2.2 Registration of the request:
The data protection officer must fill out a register (which must be kept up to date) of the requests for information, revocation, and ARCO rights that allows for adequate control of the requests presented either in person or via email, assigning a correlative control code to the request.
2.3 Management of the request
The attention and management of requests at ABC will be carried out according to the activities described in the Flowchart – "Process for attending to requests for information rights, revocation, and ARCO rights."
3. Deadline for attending to your request
The response time for closing the request will depend on the rights exercised by the owner of the personal data according to the following table:
Information
5 business days
8 business days
Access
15 business days
20 business days
Correction, Cancellation, and Opposition
7 business days
10 business days
Except for the established deadline for exercising the right to information, the deadlines for responding to or addressing the right may be extended only once for an equal period, at most, provided that the circumstances justify the extension of the deadline. The justification for the extension will be notified to the holder of personal data within the period intended to be extended.
3.1 Deadline for rectifying the request
All submitted requests must be received, and a record of their receipt must be kept. The request must contain at least the following information:
Full name of the holder of the personal data and proof of this, as well as that of their legal representatives, if applicable.
Specific request that gives rise to the application.
Address, or an electronic address, for the purpose of related notifications.
Date of the request and signature of the applicant.
Documents supporting the request, if applicable.
If the request does not contain the aforementioned data, within a period of five (5) days, counted from the day after the request is received, observations for non-compliance that cannot be remedied ex officio will be formulated, inviting the holder to rectify them within a maximum period of five (5) days. After the mentioned period has elapsed without the rectification occurring, the request will be considered as not presented.
3.2 Request for additional information
If the information provided in the request is insufficient or incorrect to the extent that it does not allow for its attention, INTURSA may require, within seven (7) days following the receipt of the request, additional documentation from the holder of the personal data to address it. Within ten (10) days of receiving the request, counted from the day after its receipt, the holder of personal data will provide the additional documentation they deem appropriate to support their request. Otherwise, the request will be deemed not presented.
3.3 Situations to consider
While holders of personal data can exercise any of the rights mentioned in section 1.4, it should be taken into account that responses to such requests must be duly substantiated, especially for those cases where requests are denied due to restrictions provided in any specific regulations applicable to the company. For example, labor restrictions, National Police of Peru, among others.
You can download your ARCO Rights request here.
