Privacy Policy

1. Who is responsible for your data

Atlantis Peru Travel, based in Trujillo, Peru, is the data controller. For any question about this policy or to exercise your rights, write to hello@atlantisperutravel.pe.

2. What we collect

We only collect what we need to answer you and to organise your trip:

• Enquiry data: name, email, country of residence, phone, travel dates, number of travellers and what you tell us about the trip you want.
• Booking data: passport details, date of birth, dietary and medical information relevant to the services booked, and billing details.
• Technical data: anonymised analytics about how the site is used — only if you accept cookies.

3. Why we can use it (legal basis)

Under the GDPR, each purpose has its own legal basis:

• Answering your enquiry and preparing a quotation: steps taken at your request prior to a contract (Art. 6.1.b).
• Organising and delivering your trip: performance of a contract (Art. 6.1.b).
• Sending passport and health details to airlines, hotels and operators: necessary for the contract, and for health data, your explicit consent (Art. 9.2.a).
• Analytics and marketing cookies: your consent, which you can withdraw at any time (Art. 6.1.a).
• Keeping accounting records: legal obligation (Art. 6.1.c).

4. Who we share it with

Only with the suppliers needed to deliver your trip — airlines, hotels, local operators, guides — and with our payment processor and accountant. We never sell your data, and we do not share it for third-party advertising.

Because your trip takes place in Peru, your data is transferred outside the European Economic Area. Those transfers are necessary for the performance of your contract with us (Art. 49.1.b GDPR).

5. How long we keep it

Enquiries that do not become bookings: 24 months, then deleted. Booking records: 10 years, as required by Peruvian tax and accounting rules. Analytics data: 14 months.

6. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, or send it to another provider in a portable format. You may also withdraw any consent you gave, without affecting processing already carried out.

We respond within 30 days. If you are not satisfied, you may complain to your national data protection authority in the EU or UK, or to Peru’s Autoridad Nacional de Protección de Datos Personales.

7. Cookies

Essential cookies keep the site working and do not require consent. Analytics and marketing cookies load only after you accept them in the banner. If you reject them, nothing is loaded and the site works exactly the same. You can change your choice by clearing this site’s data in your browser.

8. Security

Data travels over encrypted connections and is stored in access-controlled systems. If a breach occurs that is likely to put your rights at risk, we will notify the relevant authority within 72 hours and inform you directly where required.