Privacy policy
Last updated: August 14, 2026
This policy explains, plainly, what information we collect, what we use it for, who we share it with and how you can control it. We do not sell data to anyone and we do not use it for advertising.
1. Data controller
The controller is Iskay Andean Travel E.I.R.L, tax ID 10443534747, registered at Cusco, Cusco, Perú. For any matter concerning your personal data you can write to [email protected].
2. What we collect
While you browse, we collect technical data about the visit: page viewed, language, device and browser type, approximate country, referring site and an anonymised IP address (we strip the last portion, so it identifies a network rather than a person). We also store a random identifier in your browser, with no personal data attached to it.
When you book, we collect what a personal ticket requires: name and surname, country, document type and number, date of birth, email address and WhatsApp number. In some cases, a photograph of the identity document or student card, where the relevant discount requires it.
When you write in the site assistant or in the contact form, we store your name, your email address and the content of the messages.
We do not collect special categories of data (health, political views, religion, biometrics) and we do not profile your behaviour for advertising purposes.
3. Why we use it and on what legal basis
- To manage your booking and provide the service you requested: performance of the contract you ask us to enter into.
- To comply with legal and tax obligations arising from that contract.
- To understand how the site is used so we can improve it (which pages are visited, in which language, from which device), on the basis of our legitimate interest in providing a better service. This analytics is our own, aggregated, and is not used to identify you or for advertising.
- To answer your enquiries through the assistant, the form or WhatsApp.
4. How long we keep it
Browsing analytics data is deleted automatically after 90 days by a daily process. The anonymous browser identifier expires after one year.
Booking data is kept for the duration of the relationship and, afterwards, for the periods required by applicable legal, accounting and tax obligations. Document photographs are deleted by a daily process 90 days after the travel date, once they have served their verification purpose.
Assistant conversations are kept for 180 days from your last message and are then deleted automatically by a daily process. If an enquiry is still open with an advisor, it is kept until it is closed.
5. Who we share it with
We do not sell or transfer your data for commercial purposes. Only the providers strictly necessary to deliver the service are involved:
- The email provider, to send you your booking confirmation.
- An internal messaging service, to alert our team about a new booking or enquiry. It receives contact details, never documents or photographs.
- The artificial intelligence provider that powers the site assistant, to which the content of the conversation is transmitted in order to answer you.
- The payment gateway, once online payment is available and you choose to use it. Your card details are entered directly into the gateway: we never see or store them.
We may also disclose data to the competent authority where a rule requires it, for example for the personal issuance of entrance tickets.
6. International transfers
Some of these providers are located outside Peru and the European Union. Where that is the case, we require appropriate contractual safeguards and keep the information transmitted to a minimum. In the case of the assistant, please avoid sharing in the chat any data that is not needed for your enquiry.
7. Your rights
You may request access to your data, its rectification or erasure, the restriction of or objection to its processing, and data portability, by writing to [email protected] from the address used for the booking. We will reply within the periods set by law.
Depending on where you live, you are protected by the General Data Protection Regulation (EU), the Lei Geral de Proteção de Dados (Brazil) or Law 29733 on Personal Data Protection (Peru). In all cases you may complain to the supervisory authority of your country if you believe we have not handled your request properly.
Please note that we cannot delete booking data while a legal obligation requires us to keep it.
8. Security
The site is served entirely over an encrypted connection. Document photographs are held in private storage that is not reachable from the internet, and only authorised members of our team can access them.
9. Minors
This site is not aimed at minors. When a minor travels, their details are provided by the responsible adult, who accepts responsibility for the accuracy of the information given.
10. Changes to this policy
If we change the way we handle data, we will update this page and the last update date shown above.