Privacy policies

PERSONAL DATA PROTECTION POLICY
KOKOA HOTELS VICHAYITO – CUSCO | AT & G HOTELES S.A.C. AND MACHU PICCHU ADVENTURE S.A.C.

AT & G HOTELES S.A.C., Tax ID (RUC) No. 20604858900, with address at Km 1211+350 Nro. Sn Vichayito (Antigua Panamericana Norte), Piura Talara Los Órganos, operating commercially under the name Kokoa Hotel Vichayito, and MACHU PICCHU ADVENTURE S.A.C. Tax ID (RUC) No. 20450697029, with address at Calle Tecsecocha Nro. 490 Int. B-1, Urb. Centro Histórico (Continuación calle Tigre), Cusco Cusco Cusco, operating commercially under the name Kokoa Hotel Cusco (hereinafter, “KOKOA HOTELS”), are responsible for the processing of the personal data collected in connection with their hotel, commercial, administrative and customer service activities, within the framework of the civil-law relationship maintained with you in your capacity as CLIENT. Accordingly, we state the following:

This Policy is intended to clearly and transparently inform how KOKOA HOTELS collects, uses, retains, communicates and protects the personal data of guests, clients, prospective clients, visitors, users of its customer service channels and, where applicable, suppliers and other natural persons connected with its operations.

Personal data is processed in accordance with Law No. 29733, the Personal Data Protection Law; its Regulations, approved by Supreme Decree No. 016-2024-JUS; and any other applicable rules, directives and provisions issued by the National Authority for Personal Data Protection.

Depending on your relationship with KOKOA HOTELS and the services requested, we may process, among others, the following data:

Identification and contact data: first and last names, DNI, passport, foreign resident card, nationality. date of birth, address, email address and telephone number.
Reservation and accommodation data: check-in and check-out dates, room, number of accompanying persons, service preferences, consumption, special requests and records associated with the provision of hotel services.
Billing and payment data: information necessary to issue payment receipts and manage payments, refunds or consumption. KOKOA HOTELS shall not retain complete card data when processing is carried out directly by a financial institution or payment gateway.
Data arising from communications: inquiries, complaints, requests, surveys, messages and other interactions carried out through our customer service channels.
Images obtained through video surveillance systems, where the establishment has such systems, exclusively for security, access control and the protection of persons and property.
Sensitive data only when strictly necessary, where there is a legitimate purpose and the applicable legal requirements for its processing are met.

KOKOA HOTELS may process personal data for the following purposes, as applicable (without limitation):

Manage reservations, guest records, check-in, check-out, accommodation, consumption and other contracted services.
Handle requests, inquiries, complaints, refunds and service requirements.
Issue payment receipts and comply with accounting, tax, immigration, administrative or any other obligations required by applicable regulations.
Coordinate supplementary services requested by the guest when this involves the participation of external service providers.
Manage the security of guests, visitors, employees, property and facilities.
Carry out internal controls, audits, fraud prevention, risk management, regulatory compliance and the defense of the company’s legitimate rights and interests, within the limits permitted by law.
Prepare statistics, indicators and internal reports, seeking to use anonymized or dissociated information whenever possible.
Send promotions, advertising, surveys or commercial communications only where prior consent has been obtained and where such consent is legally required.

Where required, KOKOA HOTELS will obtain the data subject’s free, prior, express, informed and unequivocal consent before processing personal data. In the cases permitted by Law No. 29733, processing may be carried out without consent where necessary to perform a contractual relationship, comply with a legal obligation, or where another exception expressly provided for by applicable regulations applies.

Consent for advertising or commercial prospecting purposes will be independent from the contracting of hotel services and may be withdrawn by the data subject at any time, without retroactive effect.

KOKOA HOTELS will not request sensitive data unless it is strictly necessary for a legitimate purpose, for example, to properly address a guest’s special requirements related to accessibility, security or assistance, and always subject to the enhanced consent, confidentiality and security conditions established by applicable regulations.

Personal data may be processed by authorized KOKOA HOTELS personnel and by service providers that provide services necessary for operations, such as reservation systems, technology hosting, billing, payment methods, messaging, IT support, security, accounting or supplementary services. Such third parties must process the data solely for the purposes entrusted to them and subject to confidentiality and security obligations.

Where national transfers or cross-border flows of personal data are necessary, KOKOA HOTELS will adopt the measures and safeguards required by Peruvian law. Likewise, information may be disclosed to public entities or administrative, judicial, police or regulatory authorities where there is a legal obligation, a competent order or a duly supported request.

Personal data will be retained only for the time necessary to fulfill the purposes that justified its collection and, thereafter, for the periods required by legal, contractual, tax, accounting, defense against claims or other applicable obligations. Once such periods have elapsed, the information will be deleted, blocked, anonymized or otherwise processed as required by law.

KOKOA HOTELS will implement reasonable organizational, technical and legal measures designed to protect personal data against loss, alteration, unauthorized access, disclosure, improper processing or destruction. Access to data must be limited to personnel and service providers who require it to perform their duties and who are subject to confidentiality obligations.

In the event of a security incident involving personal data, KOKOA HOTELS will act in accordance with the procedures and notification obligations established by applicable regulations.

The data subject may exercise, under the terms provided by applicable law, the rights of information, access, updating, inclusion, rectification, erasure or cancellation, objection, portability where applicable, as well as withdraw consent granted for specific processing activities.

To exercise these rights, the data subject may submit a request addressed to AT & G HOTELES S.A.C. through the following channels, which must be completed by the company before publication of this Policy:

Address: Km 1211+350 Nro. Sn Vichayito (Antigua Panamericana Norte), Piura.
Email for personal data protection matters: contacto@kokoahotel.com
Request for the exercise of rights, duly completed and signed. The form can be downloaded here.

To exercise these rights, the data subject may submit a request addressed to MACHU PICCHU ADVENTURE S.A.C. through the following channels, which must be completed by the company before publication of this Policy:

Address: Calle Tecsecocha Nro. 490 Int. B-1, Urb. Centro Histórico (Continuación calle Tigre), Cusco.
Email for personal data protection matters: contacto@kokoahotelcusco.com
Request for the exercise of rights, duly completed and signed. The form can be downloaded here.

The request must allow the data subject to be identified and specify the right the data subject wishes to exercise. KOKOA HOTELS may request only the information strictly necessary to verify identity and process the request within the time limits and procedures established by applicable regulations.

Without prejudice to the foregoing, the data subject may contact the National Authority for Personal Data Protection if the data subject considers that his or her rights have not been properly addressed.

Where hotel services involve personal data of minors, KOKOA HOTELS will seek to process only the information necessary for the provision of the service, security, registration or compliance with legal obligations, observing the special protection and representation rules that may apply.

At establishments equipped with video surveillance cameras, images will be processed exclusively for security, access control, incident prevention and the protection of persons and property. KOKOA HOTELS will display the corresponding informational notices and retain the images only for the period permitted or necessary under applicable regulations.

KOKOA HOTELS may amend or update this Policy whenever necessary due to regulatory, operational or technological changes or changes to the services offered. The current version will be made available through the physical or digital means determined by the company.

This Policy is for informational purposes and, where appropriate, must be supplemented by consent clauses, privacy notices, registration forms, video surveillance notices and any other specific documents required depending on the purpose and channel through which personal data is collected.