Skip to content

Privacy policy

Last updated: September 2026

1. Who is responsible for your data

GRUPO CENTRAL TRAVEL BUSINESS HOLDING SAC, tax ID (RUC) 20615399966, with registered address at Terminal Terrestre Espinar, Oficina 02, 2.º nivel, Espinar, Cusco, Perú, owns the personal data bank and is responsible for its processing. For anything related to your data, write to gerencia@centraltravel.pe.

2. What data we collect, and through which channel

When you book a tour: first and last name, email, country of residence and, optionally, phone number, passport or ID number and comments about your trip.

When you request a flight or bus quote from the search box: the route, dates and passenger count you type. These are sent to WhatsApp together with your phone number, which is what allows us to reply.

When you file a complaint in the Complaints Book: the data Peruvian law requires for that record — name, ID document, address, email and, if the consumer is a minor, the guardian’s details.

We never collect or store payment card data. Payment is processed entirely on PayPal’s servers; we only receive a transaction identifier and the payer’s email.

3. Which data is mandatory

To book, first name, last name, email and country of residence are mandatory: without them we cannot issue the confirmation or identify you on the day of the tour. Phone, ID and comments are optional.

For the Complaints Book, every field marked as mandatory is required by Supreme Decree No. 011-2011-PCM: without them the complaint cannot be registered.

4. What we use it for

Managing and confirming your booking, quote or complaint.

Sending you the purchase confirmation and practical tour information.

Contacting you about itinerary changes, weather conditions or incidents.

Meeting the legal, accounting and tax obligations that apply in Peru.

We do not use your data for advertising, nor do we share it for that purpose.

5. Legal basis

Processing is based on your consent — given by ticking the corresponding box before booking or filing a complaint — and on the performance of the service contract you request, under Peruvian Law No. 29733 on Personal Data Protection and its regulations approved by Supreme Decree No. 016-2024-JUS.

6. Who we share it with, and which countries it travels to

Some of the services we rely on operate outside Peru. That is a cross-border data transfer which the law requires us to disclose:

PayPal (United States), to process the booking payment.

Mailjet (European Union), to send confirmation emails.

WhatsApp, by Meta Platforms (United States), when you message us or send a quote request from the site.

Within Peru, we share with the guides and drivers assigned to your tour only the data needed to provide the service.

All these providers process data on our behalf under their own privacy policies. We do not sell or share your data with third parties for advertising.

7. How long we keep it

Booking data is kept for the period required by Peruvian accounting and tax rules, and in any case while any liability may arise from the service, including possible disputes with the payment gateway.

Complaints Book records are kept for the minimum period set by the Consumer Protection and Defence Code, since they are the evidence in an INDECOPI inspection.

8. Your rights and how to exercise them

You have the right to access, rectify, delete and object to the processing of your data. You can exercise them free of charge by writing to gerencia@centraltravel.pe with your full name and, if you have one, your booking code.

Response times under Law No. 29733: twenty working days for access, and ten working days for rectification, deletion and objection.

If you believe we have not handled your request, you may file a complaint with Peru’s National Authority for Personal Data Protection at www.gob.pe/anpd.

9. How we protect your data

The site runs entirely over HTTPS with a valid certificate. The database is not exposed to the internet, gateway credentials are stored encrypted, and admin access is password-protected with lockout after repeated failed attempts.

Online purchases take place on PayPal’s platform, which complies with the card industry security standard (PCI DSS). No card data passes through our servers.

10. Cookies

This site uses no advertising or third-party tracking cookies for profiling. Only the technical cookies strictly necessary for the site and the admin panel are used.

Commitment against child exploitation

“Protégeme, Responsible Tourism” poster: in this travel agency we do not promote or permit the sexual exploitation of girls, children and teenagers, under Peruvian Law No. 29408. Report it on lines 1818 and 100.