Legal

Privacy Policy

How we collect, use and protect your personal data.

Last updated: 25 September 2026

At peruways.com, we respect your privacy and are committed to protecting the personal data you share with us. This Privacy Policy explains how we collect, use, store, and protect your data when you book tickets, transportation, or tour packages through our platform.

1. Who we are

Peruways ("we", "us", "our") operates this website as a booking platform for authorized, official Machu Picchu entrance tickets and train tickets in Peru.

For the purposes of this policy and applicable data protection law, Peruways is the data controller of the personal data we collect from you.

2. Data we collect

We collect personal data when you book a ticket, contact us, or use our website. Specifically:

  • Identification data: full name, passport number, nationality, date of birth.
  • Contact data: email address, phone number, country of residence.
  • Booking data: travel dates, train class, circuit chosen, group composition.
  • Payment data: payment method, last 4 digits of card, billing address (full card numbers are processed by our payment gateway and not stored by us).
  • Technical data: IP address, browser, device type, pages visited.
  • Communications: emails, WhatsApp messages, chat records relating to your booking.

3. How we use your data

We use your personal data only for purposes that are necessary to:

  • Process your booking and issue e-tickets.
  • Submit the passenger information required by the ticket-issuing operators to complete your booking.
  • Send you booking confirmations, e-tickets and pre-travel reminders.
  • Provide customer support before, during and after your trip.
  • Comply with applicable legal and tax obligations.
  • Improve our website and services (in aggregated, anonymized form).

Legal basis for processing (where GDPR applies): performance of the booking contract, compliance with legal obligations, and our legitimate interest in providing and improving the service. Marketing communications are based on your explicit consent, which you can withdraw at any time.

4. Sharing with third parties

We share your personal data only with:

  • Ticket-issuing operators - the third-party operators of trains, Machu Picchu entrance, and any bus or transfer services you book, in order to issue your tickets and confirm your booking.
  • Payment processors - to securely process your card payment.
  • Email and CRM providers - to send transactional emails, booking confirmations, and pre-travel reminders.
  • Hosting and infrastructure providers - to store data and operate our website securely.
  • Analytics providers - to understand aggregated site usage (subject to your cookie preferences).

We do not sell your data and we do not share it with marketing third parties without your explicit consent.

5. Payment data

Card payments are processed by our PCI-DSS compliant payment gateway via SSL-encrypted, 3D-Secure 2 verified channels. We never store your full card number. We may retain a tokenized reference for refunds and dispute resolution.

6. Cookies and tracking

Our website uses cookies for:

  • Strictly necessary: session management, language preference, cart contents.
  • Analytics: to understand site usage in aggregate (e.g. Google Analytics).
  • Marketing: only with your consent via our cookie banner (e.g. Meta Pixel, Google Ads).

You can manage cookie preferences via the cookie banner or your browser settings.

7. Data retention

We retain personal data for as long as necessary to fulfill the purposes described above:

  • Booking records: for the period required by applicable tax and commercial law (typically 5 years after the trip).
  • Communications: up to 3 years after the last interaction.
  • Marketing preferences: until you withdraw your consent.
  • Cookies and analytics data: as configured by our cookie banner and the specific provider.

8. Your rights

Depending on your location and applicable data protection law (including the EU GDPR, UK Data Protection Act, and other regional regulations), you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of data we no longer need to retain.
  • Object to or restrict processing.
  • Receive your data in a portable format.
  • Withdraw consent at any time (without affecting prior lawful processing).
  • Lodge a complaint with the competent data protection authority in your country of residence.

To exercise any of these rights, contact us via our contact form.

9. Security

We protect your data with industry-standard measures: SSL/TLS encryption in transit, encrypted databases, role-based access controls, regular backups, and security audits. No system is 100% secure - in the event of a personal data breach affecting your data, we will notify you and the relevant authority in accordance with applicable law (within 72 hours where required by GDPR).

10. International data transfers

Some of our service providers (email, hosting, analytics, payment processing) operate in different countries. We only transfer data to providers that offer adequate protection - either through EU Standard Contractual Clauses, binding corporate rules, jurisdictions recognized as adequate by the European Commission, or equivalent legal safeguards.

11. Minors

We do not knowingly collect personal data from anyone under 16 except as part of a booking made by their parent or legal guardian. If you believe a minor has provided personal data without parental consent, contact us and we will delete the record.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated by email to active customers where feasible.

13. Contact

For privacy-related questions or to exercise your rights:

By using peruways.com, you acknowledge that you have read, understood, and agreed to this Privacy Policy.