Privacy policies

In compliance with the Personal Data Protection Law (Law No. 29733), its amending regulation (Legislative Decree No. 1353), and its Regulation (Supreme Decree No. 003-2013-JUS), the Association Kantaya (hereinafter “Kantaya”) informs the User of the portal kantayaperu.com (hereinafter the “Portal”) of the following aspects related to the processing of their personal data:

1. About this Privacy Policy 1.1 This Privacy Policy (hereinafter, the “Policy”) describes the conditions under which Kantaya will process the personal data collected or obtained from the User who enters, uses, and/or registers on the Portal and/or contracts any of the Services offered therein by Kantaya. 1.2 In this regard, the User must carefully read this Policy and, only if they agree to it, click on the “Privacy Policy” checkbox on the registration screen. By accepting this Policy and clicking on said checkbox, it will be understood that the User has given Kantaya their prior, informed, express, and unequivocal consent to process their personal data.

1.3 Such personal data is necessary to be able to enter, use, or register on the Portal, or contract any of the Services offered therein; therefore, if the User does not consent to their processing, they will not be able to register, partially use the Portal, or contract the Services offered therein.

2. Legal Framework 2.1 This Policy is governed by the following legal norms:a) Law No. 29733 (Law),b) Legislative Decree No. 1353, which amends Law No. 29733,c) Supreme Decree No. 003-2013-JUS, Regulation of Law No. 29733 (Regulation), and,d) The Information Security Directive, approved by Directorial Resolution No. 019-2013-JUS/DGPDP (Security Directive).
3. General aspects of the processing of Users’ personal data

3.1 About the Users

3.1.1 This Policy applies to all Users of the Portal, and the terms “User” or “Users” shall be understood to mean all natural persons who enter, use, register, perform transactions, interact, or generate content within the Portal, as well as those persons who contract any of the Services offered therein.3.1.2 This Policy does not apply to third-party websites, services, products, or applications different from Kantaya, even if they have been linked or can be accessed through the Portal and/or the Services contracted through it.

3.2 About the collected information.

3.2.1 Kantaya may collect and process the following information: a) Personal Dataa. Names and surnames, email address, DNI (National ID) number, landline or cellphone number, address, and IP address.b. User’s payment data when contracting any Service offered on the Portal, including the type and number of credit/debit card, as well as the security code, which will be provided directly by the User to the payment gateway working with the Portal; Kantaya will never have access to this data. b) User’s Behavior on the Portali. Information about the activities carried out by the User on the Portal, such as the moment of access, viewing, publishing, and sharing of content, among others.ii. The URL from which the User comes.iii. Portal sections most visited by the User.iv. IP addresses from which the User accesses the Portal.v. Browser and operating system of the device from which the User accesses the Portal.

3.3 Application of the Principles of the Law in the Processing of Personal Data.

3.3.1 The processing of Personal Data and other collected information will be carried out in accordance with the purposes and guidelines established in this Policy, as well as the following Principles, which will be used by Kantaya even as interpretative criteria to resolve issues that may arise regarding the processing of Users’ personal data: a) Principle of legality, so Kantaya will process personal data in accordance with the provisions of the Law and the Regulation, and therefore will not collect personal data through fraudulent, unfair, or unlawful means.b) Principle of consent, so for the processing of personal data by Kantaya, the consent of the User who is the holder of the personal data in question will always be required, except for applicable legal exceptions. In this regard, the User acknowledges and accepts that any processing of their personal data and other information necessary for the execution of the contractual relationship with Kantaya does not require their consent but only requires to be informed, as stated in the terms of this document.c) Principle of purpose, so Kantaya will only collect personal data for the explicit and lawful purposes previously detailed, and will not collect or process sensitive data of the User; the processing of collected personal data will not extend to other purposes that have not been unequivocally established in this Policy at the time of their collection, excluding cases of activities of historical, statistical, or scientific value, when a dissociation or anonymization procedure is used.d) Principle of proportionality, so all processing of personal data carried out by Kantaya will be appropriate, relevant, and not excessive for the purpose for which they have been collected.e) Principle of quality, so the personal data to be processed by Kantaya must be truthful and accurate; and, as far as possible, such data will be updated, necessary, relevant, and appropriate regarding the purposes for which they are collected. In this sense, the User declares that the personal data provided to Kantaya are true, complete, and accurate, being responsible for the truthfulness, accuracy, validity, updating, and authenticity of this information. Kantaya will not be responsible for the truthfulness of the information provided by the User, and therefore will not assume any responsibility for possible damages or harms that the User or other Users of the Portal may suffer due to the use of such information. Notwithstanding this, the User authorizes Kantaya to verify the truthfulness of their personal data provided through sources of public access or entities specialized in the provision and/or verification of such information.f) Principle of security, so Kantaya will adopt the necessary technical, organizational, and legal measures to guarantee the security of personal data, which are appropriate and in accordance with the processing carried out and the category of personal data in question.g) Principle of recourse availability, so any User who is the holder of personal data has the necessary administrative or jurisdictional means to claim and enforce their rights, in the unlikely event that these are violated in their processing.h) Principle of adequate protection level, for which, for the transborder flow of personal data, if carried out, Kantaya must guarantee a sufficient level of protection for the personal data to be processed or, at least, equivalent to that provided by the Law or by international standards on the subject.

The User is informed that, by accepting this Policy and thereby giving their consent, their personal data will be incorporated into a database called “Users” owned by the Kantaya Association, with RUC No. 20516447606 and address at Calle Ugarte y Moscoso Nro. 421 Dpto. 4D, District of San Isidro, Province and Department of Lima, Peru.

3.4 Registration of the database

3.4.1 The existence of the personal data database called “Users” is in the process of registration in the National Registry of Personal Data Protection.

3.5 Retention of personal data.

3.5.1 The provided personal data will be retained by Kantaya while: (i) the contractual relationship with the User is maintained, (ii) until the User requests the cancellation of their personal data, according to the procedure established for this purpose; and even after that, Kantaya may retain certain personal data for as long as Kantaya has any legal or contractual obligation to keep them in order to comply with obligations remaining under its charge or responsibility. Likewise, Kantaya may indefinitely maintain User’s personal data as long as they are duly dissociated or anonymized.

3.6 Collection of personal data

3.6.1 Kantaya collects the User’s personal data in the following ways: a) Personal data provided by the User themselves through:– Direct communication with Kantaya, either through: (i) The registration request, (ii) any communication from the User to Kantaya regarding the Portal, (iii) the communication or request for information and/or assistance from the User regarding any Service provided on the Portal, or (iv) the contracting of any Service through the Portal.– Filling out and submitting voluntary online surveys that Kantaya may send or request from the User. b) Through the automatic collection of data through Portal Cookies, or other data automatically assigned to the device from which the User accesses the Portal. To view the automatic data collection policy, you must go to the following link: Cookie Policies

3.7 Purposes of Collection and Processing of Personal Data.

3.7.1 Kantaya will process the User’s personal data for the following purposes: a) Allow the User to access and use the Portal.b) Manage the User’s registration request on the Portal and validate the truthfulness of the provided information.c) Manage the contracting of any Service on the Portal by the User and execute it on their behalf.d) Conduct surveys with clients.e) Respond to questions, inquiries, complaints, or claims.f) Allow for the improvement of the content and/or design of the Portal.g) Carry out communications with the User to build loyalty.h) Fulfill legal and/or contractual obligations related to the use of the Portal and/or the contracting of any Service provided on it.i) Conduct statistical, design, and/or usability studies of the Portal, as well as audience measurement and configuration of personalized advertisements.j) Send the User’s personal data to companies that provide cloud-based infrastructure services, in order to host, store, process, and/or execute such data.k) Send commercial emails related to the Portal and/or the Services. In any case, the User may notify their desire to no longer receive email messages by exercising their ARCO rights, according to the procedure described below and by sending a request for withdrawal. A link will also be included in all emails sent to the User, so that they can automatically revoke their consent through it.

3.7.2 Furthermore, the USER authorizes Kantaya to: a. Authorize the sending of communications related to advertising or promotions on topics related to Kantaya’s activities, donations, volunteering. b. Authorize the sending of communications related to advertising or promotions regarding the promotion of products for sale by Kantaya. 3.7.3 The User’s personal data will only be used for limited purposes, as described above. In this sense, once the personal data has been provided by the User, Kantaya will not use, sell, transfer, assign, or share them, except in the ways expressly established in the previously described purposes. 3.7.4 The User expressly states that this Policy and its acceptance are the sufficient and suitable mechanisms to inform them of all the aforementioned purposes. 3.7.5 If the User does not accept the additional processing(s) of their personal data, this will not affect the use of the Portal, their registration process on it, or the contracting of any Service. 3.8 Transfers and Recipients of Personal Data. 3.8.1 Kantaya will transfer the User’s personal data nationally to: a. SUNAT, with address at Av. Garcilaso de la Vega N° 1472, Cercado District, Province and Department of Lima, for the purpose of issuing the corresponding payment receipt for the Service contracted by the User through the Portal. b. In case the User makes any voluntary publication (which may include their personal data) on the Portal, such information may be viewed by other Users and/or third parties without any restriction. In this sense, Kantaya will share such information published by the User (including potentially their personal data) with said Users or third parties, and therefore Kantaya will not be responsible for the information published directly and voluntarily by the User, to the extent that it is beyond its control. 3.8.2 Kantaya contracts cloud services (cloud computing) through: Hostgator, located in the United States of America. 3.8.3 Kantaya will transmit or disclose personal data to third parties outside the Republic of Peru, except for legal obligation. 3.8.4 Similarly, Kantaya will not transmit or disclose the User’s personal data or information provided by the User to third parties who do not have the right to know it, except in those cases where it is legally required by virtue of an order or police, administrative, or judicial requirement, in which case Kantaya will comply with such requirements and requests in accordance with applicable laws.

4. Exercise of Access, Rectification, Cancellation, and Opposition of Data Rights – ARCO Rights.

4.1 Any User has the right to access the personal data that Kantaya holds about them as the Responsible for the corresponding database. They also have the right to know the characteristics of their processing, rectify them if they are inaccurate or incomplete, request their deletion or cancellation if they consider them unnecessary for the previously stated purposes, or oppose their processing for specific purposes.

4.2 Likewise, any User may, at any time, revoke the consent expressly granted to Kantaya to use their personal data, as well as limit such use or disclosure; but the User must bear in mind that, depending on the data in question, it could happen that they may no longer be able to fully or partially use the Portal or any particular Service, which will be promptly informed.

4.3 Any User may at any time and free of charge exercise the aforementioned rights regarding their personal data provided or collected by Kantaya. For this purpose, Kantaya will attend to and respond to the requests received in accordance with the following legally applicable deadlines, which will be counted from the day following the submission of the request in writing:

• a) For the exercise of the right to information, within a maximum period of eight (08) days.
• b) For the exercise of the right of access, within a maximum period of twenty (20) days.
• c) For the exercise of other rights (such as rectification, cancellation, or opposition), within a maximum period of ten (10) days.

4.4 The request must be made in writing addressed to the Kantaya Association through one of the following means:

• a. In physical form, to the following address: Calle Ugarte y Moscoso Nro. 421 Dpto. 4D, San Isidro District, Province and Department of Lima, Peru; or,
• b. Electronically to the email: [email protected]

4.5 For this purpose, in the communication sent to Kantaya, the User must properly identify themselves, describe the facts that give rise to the exercise of the right, specify the right they wish to exercise, and provide their address; additionally, they must attach a copy of their identification document or equivalent, as well as any relevant documents they consider necessary.

4.6 If the communication is found to be incorrect or incomplete, Kantaya will have a period of up to seven (07) calendar days, counted from the day following the receipt of the request, to request its correction and/or additional documentation that may be relevant to process it; after which the User will have up to ten (10) calendar days, counted from the receipt of the request, to correct or provide the requested documentation.

4.7 If the aforementioned ten (10) days have elapsed without the User responding to the request for correction, Kantaya will consider that the User has withdrawn their request.

4.8 Once the complete request is received, a legend will be included in the place where the information is stored that says “data or information blocked due to pending request” and the reason for it, within a period not exceeding two (2) business days. This legend will be maintained until the request is resolved.

4.9 Except for the response period established for the exercise of the right to information, the deadlines corresponding to the response or attention to the other rights may be extended only once, and for an equal period, at most, provided that the circumstances justify it. The justification for the extension of the deadline will be communicated within the period to be extended.

4.10 If any User considers that they have not been attended to in the exercise of their rights, they may file a complaint with the National Authority for Personal Data Protection, by addressing the Office of the Ministry of Justice and Human Rights located at Calle Scipión Llona N° 350, Miraflores District, Province and Department of Lima, Peru.

5. Assignment of Contractual Position on the Ownership of the Database and/or Data Processing Delegation to a Third Party.
   5.1 In the event that, in the future, Kantaya transfers the ownership of the database named “Usuarios” and/or delegates its processing to a third party, by accepting this Policy, the User also anticipates, prior, express, informed, and unequivocally accepts such action. Kantaya’s obligation is to inform the identity and address of the new owner or processor of the personal database in question, as well as their applicable obligations and/or limitations, to the corresponding Users at least thirty (30) calendar days in advance of the effective date of the change. During this period, the User who does not agree with the upcoming change may express their disagreement and request the cancellation of their personal data from Kantaya, according to the procedure described previously for this purpose.

5.2 In the event that the User does not object to the informed change and does not initiate a request for the cancellation of their personal data due to this change, it will be understood that they agree to the informed change, taking full effect from the effective date.

5.3 In the specific case of the assignment of the contractual position regarding the ownership of the database, after the informed change takes effect, Kantaya will no longer have any responsibility regarding any events that occur from the date of the assignment. The new owner and, therefore, the responsible party for the database will assume each and every one of the obligations established in this Policy regarding the treatment, safeguarding, and conservation of the previously detailed information, as well as all the applicable obligations in that capacity.

6. Security and Protection Measures
   6.1 In order to prevent loss, misuse, alteration, unauthorized access, and/or theft of the personal data or information provided by the User, Kantaya has adopted the levels of security and protection of personal data legally required and has installed all the technical means and measures at its disposal for this purpose; all of this, in accordance with the provisions of the Law, its Regulation, and the Security Directive.

6.2 In this regard, Kantaya has implemented and uses industry standards for the protection of the confidentiality of its Users’ personal data, and declares to employ various security measures to prevent unauthorized access. However, no security measure is one hundred percent impregnable, so Kantaya is not responsible for illegal interceptions or violations of its computer systems or databases by unauthorized persons, as well as the improper use of personal data obtained in violation of its security systems, in breach of applicable laws, or any illegal or illegitimate action that reasonably escapes its control, and therefore cannot be attributed to it, as well as the due diligence with which Kantaya acts.

6.3 Likewise, Kantaya will not be responsible for any possible damages or harm that any User may suffer as a result of the actions described above or others caused by third parties and over which Kantaya has no control or that could not be prevented by applying due diligence.

7. Changes to this Privacy Policy
   7.1 Kantaya reserves the right to modify this Policy in the future. The use and processing of personal data will be governed by the Policy in force at the time of its collection and its subsequent changes or modifications.

7.2 If Kantaya makes changes to this Policy, it will notify the User through a notice on the Portal itself and/or by sending an email for this purpose, and such notification will take place before the effective implementation of the changes to be made.

7.3 The User will be bound and subject to the changes made in this Policy if, after receiving the corresponding change notification, they continue to use the Portal and/or the Services after such changes come into effect; unless they expressly and in writing state otherwise, for which they must initiate the request for the cancellation of their personal data from Kantaya, according to the procedure described previously for this purpose.

8. Contact Information for Data Protection Matters
   8.1 The USER can contact Kantaya for any matter related to their personal data through:

Our address: Calle Ugarte y Moscoso Nro. 421 Dpto. 4D, Distrito de San Isidro, Provincia y Departamento de Lima, Perú.
Our email: [email protected]

9. Effective Date and Period of Validity
   9.1 This Policy comes into effect as of January 15, 2021, and will be valid until it is expressly modified by Kantaya, or until the Portal is definitively discontinued.

BY CHECKING THE PRIVACY POLICY BOX ON THE REGISTRATION SCREEN, THE USER STATES THAT THEY HAVE READ THIS TEXT AND ACCEPT IT IN THE VERSION PUBLISHED ON THE DATE OF THEIR REGISTRATION ON THE PORTAL.

Date of last update: January 15, 2021