Kada Travel
Privacy Policy
Last updated: 3 October 2026
At Kada Travel we design private, tailor-made journeys, and that requires getting to know you. This policy explains, without fine print, what data we process, why, who we share it with, where it is stored, how long we keep it and how you can exercise your rights. It is governed by Peru's Personal Data Protection Law (Law No. 29733) and its Regulation; if you live in the European Union, we also take the General Data Protection Regulation (GDPR) into account.
1. Data controller
Multiservicios Kada E.I.R.L. (trading as Kada Travel), Peruvian tax ID (RUC) 20612829579, registered at Calle Arica 280, Miraflores, Lima, Perú. Contact for any privacy matter: info@kadatravel.com.
2. What data we process
We only process the data each purpose requires:
- Trip request (the “Start Planning” form): name, email, phone, country, travel style, destinations of interest, dates or approximate month, number of travellers, hotel category, length of stay, budget range, any celebration and the message you write. While you fill in the form, your answers are saved provisionally so they are not lost; if you leave it unfinished, our team may see them in order to offer help.
- Downloadable travel guide and newsletter: your email address, language and, if you tick the corresponding box, the record of your consent (date, wording accepted and IP address).
- Booking and travel: traveller details needed for hotels, transport, entry tickets and permits — such as full name, nationality, date of birth and a copy of the passport — and the travel documents.
- Complaints Book (Libro de Reclamaciones): the data required by Peruvian consumer-protection rules (name, identity document, address, contact details, details of the complaint) and the IP address it was filed from.
- Communications: the emails and messages we exchange with you, including WhatsApp if you contact us that way.
- Technical data: IP address and browser type (needed for site security and spam protection), technical error information and, only if you accept it, browsing data for analytics (pages visited, where the visit came from, campaign).
3. Health and other sensitive data
Dietary requirements, allergies, reduced mobility or other health conditions are processed only if you choose to share them so we can adapt your journey, and solely for that purpose. By providing them you give us your express consent to process them and to share them with the hotel, restaurant or supplier who needs to accommodate them. You may leave them out or ask us to delete them at any time.
4. Why we use it and on what legal basis
- Answering your request and designing your journey proposal — at your request, as a step prior to a possible contract.
- Managing your booking, coordinating suppliers and looking after you before, during and after the journey — performance of the contract.
- Meeting legal obligations: accounting, tax and consumer protection (including the Complaints Book) — legal obligation.
- Protecting the site against fraud and spam, and detecting and fixing technical errors — legitimate interest in the security and proper functioning of the service.
- Organising requests internally: an automatic score (based on budget and completeness) helps us prioritise them and assign them to a travel designer. It produces no decisions with legal effects on you and is always reviewed by a person — legitimate interest.
- Sending you a short series of emails about the trip request you made — legitimate interest; every email lets you unsubscribe with one click.
- Sending you our letter and journey ideas (newsletter) — your consent, which you can withdraw at any time.
- Site analytics with Google Analytics and, if you allow it, Google's advertising features — your consent through the cookie notice.
5. Who we share it with
We never sell or rent your data. We share it only as far as necessary with:
- Suppliers of your journey: hotels, transport companies, guides, airlines, restaurants and local operators, each receiving only the data it needs to provide its service.
- Technology providers processing data on our behalf: Hostinger (server and database, United Kingdom); Cloudflare (Turnstile spam protection and encrypted backups); Resend and Titan (email delivery); Cloudinary (images and travel documents); Sentry (error diagnostics); Google (Google Analytics, with your consent, and Gemini, see section 8); DeepL (translation of proposals).
- Public authorities, where the law requires it.
6. International transfers
Some of these providers are outside Peru: the server is located in the United Kingdom; Resend, Cloudinary, Sentry, Google and Cloudflare process data in the United States, and DeepL in the European Union. In every case we work with providers offering contractual data-protection safeguards, as provided by Law No. 29733 for cross-border transfers of personal data.
7. How long we keep it
- Requests that do not become a journey: 3 years from the last activity, after which they are deleted automatically.
- Clients with a booking: for the duration of the relationship and, afterwards, for the periods required by Peruvian tax and accounting rules.
- Newsletter: until you unsubscribe.
- Complaints Book: for the period required by consumer-protection rules.
- Backups: up to 30 days; deleted data disappears from them as they rotate.
8. Use of artificial intelligence
We use artificial-intelligence tools to support the drafting and translation of content and of itinerary drafts. We make no automated decisions about you, and everything we send you is reviewed by a member of our team. Details are in our Artificial Intelligence Use Policy.
9. Your rights
You may at any time exercise your rights of information, access, rectification, erasure and objection — and, if you live in the European Union, also restriction and portability — by writing to info@kadatravel.com with the subject “Data protection”. We will reply within the time limits set by Law No. 29733 and its Regulation. You can withdraw your consent whenever you wish: through the unsubscribe link in every email or via “Cookie preferences” at the foot of every page.
If you believe we have not respected your rights, you may lodge a complaint with Peru's National Authority for Personal Data Protection (Ministry of Justice and Human Rights) or, if you live in the European Union, with the data-protection authority of your country.
10. Security
All communication with the site is encrypted (HTTPS). Internal access to your data is limited by role and logged; passwords are stored encrypted; travel documents such as passports are served only through temporary links, and backups are stored encrypted. No system is infallible, but we review these measures regularly.
11. Minors
Our services are intended for adults. Data about travelling minors is processed only when provided by their parent or guardian, and solely to organise the journey.
12. Changes to this policy
If we change this policy, we will update the date at the top and, where the change is significant, point it out on the site. Where processing depends on your consent, we will ask for it again if its purpose changes.