PRIVACY POLICY

In accordance with the Law of Data Protection (Act No.29733), its amending regulation (Legislative Decree No. 1353) and its Regulations (Supreme Decree No. 003-2013-JUS). Kantaya Association (in hereinafter referred to as “Kantaya”) informs the User of the portal kantayaperu.com (hereinafter referred to as the “Web Portal”) the following aspects related to the processing of their personal data:

1. About this Privacy Policy

1.1 This Privacy Policy (hereinafter referred to as the “Policy”) describes the conditions under which Kantaya will process the personal data that it gathers or obtains from the User who enters, uses and/or registers on the Web Portal and/or contract any of the Services provided therein by Kantaya.

1.2 In this sense, the User must carefully read this Policy and, only if he agrees with it, click on the “Privacy Policy” box shown on the registration screen. By accepting this Policy and clicking on such box, it will be understood that the User has given Kantaya their prior, informed, express and unequivocal consent in order to process their personal data.

1.3 It is necessary to enter, use or register the personal data on the Web Portal; or to contract any of the Services provided therein; Therefore, if they do not consent to their treatment, the User will not be able to register, or partially use the Web Portal or contract the Services provided in it.

2. Legal framework

2.1 This Policy is regulated by the following legal regulations:
a) Act No. 29733 (Act),
b) The Legislative Decree No 1353 that modifies the Act No. 29733.
c) Supreme Decree No. 003-2013-JUS, Regulations Law No. 29733 (Regulation) and,
d) Information Security Directive, approved by Board Resolution No. 019-2013-JUS/DGPDP (Security Directive).

3. General aspects of the treatment of the personal data of the Users

3.1 Users

3.1.1 This Policy applies to all Users of the Web Portal, it will be understood that “User” or “Users” are all those natural persons who enter, use, register, carry out transactions, interact or generate content in the Web Portal, as well as those people who contract any of the Services provided
3.1.2 This Policy does not apply to third-party websites, services, products or applications other than Kantaya, even if they have been linked; they can be accessed through the Web Portal and/or the Services contracted through it.

3.2 Information gathered

3.2.1 Kantaya may gather and process the following information:

a) Personal data
a. Full name, email address, DNI number, landline or cell phone number, home address and IP number.
b. User payment data to whom the Web Portal provides any Service which includes the type and number of credit/debit card, as well as the security code. The mentioned above will be provided directly by the User to the Web Portal payment gateway; Kantaya will never have access to this data.

b) Behavior in the Web Portal
i. Information about the activities carried out by the User on the Portal, such as the moment in which they access, view, publish and share content, among others.
ii. User URL
iii. Sections of the Web Portal most visited by the User
iv. IP addresses on which the User accesses the Web Portal
v. Browser and operating system of the computer on which the User accesses the Web Portal.

3.3 The application of the principles of the Law in the treatment of personal data.

3.3.1 The treatment of Personal Data and other information gathered will be carried out in accordance with the purposes and guidelines established in this Policy, as well as the following Principles, which will be used by Kantaya even as interpretive criteria to resolve issues that may arise regarding the processing of personal data of Users:

a) Principle of Legality, therefore, Kantaya will process personal data in accordance with the provisions of the Law and Regulations and, therefore, will not gather personal data by fraudulent, unfair or illegal means.
b) Consent Principle, therefore, for the treatment of personal data by Kantaya, the consent of the User who owns the personal data in question will always be mediated, except for applicable legal exceptions. In this sense, the User acknowledges and accepts that any processing of their personal data and other information that is necessary for the execution of the contractual relationship that links them with Kantaya, does not require their consent and only to be informed, as it is done in terms of this document.
c) Principle of finality, so Kantaya will only gather personal data for the explicit and lawful purposes previously detailed. It will not gather or process sensitive User data. The treatment of the personal data gathered will not be extended to other purposes that have not been unequivocally established in this Policy at the time of its collection, excluding cases of activities of historical, statistical or scientific value, when used a disassociation or anonymization procedure.
d) Principle of proportionality, , pany processing of personal data by Kantaya will be adequate, relevant and not excessive for the purpose for which they have been gathered.
e) Principle of quality, the personal data that will be processed by Kantaya must be true and accurate; and, as far as possible, such data will be updated, necessary, pertinent and adequate with respect to the purposes for which they are gathered. In this sense, the User declares that the personal data that they will provide to Kantaya are true, complete and exact, being responsible for the veracity, accuracy, validity, updating and authenticity of these. Kantaya will not be responsible for the veracity of the information provided by the User. Kantaya will not assume any responsibility for possible damages that this or other Users of the Web Portal may suffer caused by the use of such information. Notwithstanding this, the User authorizes Kantaya to verify the veracity of their personal data provided through publicly accessible sources or entities specialized in the provision and/or verification of such information.
f) Principle of securityKantaya will adopt the technical, organizational and legal measures necessary to guarantee the security of personal data, which are appropriate and in accordance with the treatment carried out and with the category of personal data in question.
g) Principle of access to resourcesAny User who owns personal data has the necessary administrative or jurisdictional means to claim and enforce their rights, in the event that they are denied that they are violated in their treatment.
h) Principle of adequate level of protection, whereby, for the cross-border flow of personal data, if carried out, Kantaya must guarantee a sufficient level of protection for the personal data to be processed or, at least, comparable to the provisions of the Law or international standards on the matter.

The User is informed that, by accepting this Policy and thus granting their consent, their personal data will be incorporated into a data bank called “Users” owned by the Kantaya Association, with RUC number (Taxpayer Single Registry) 20516447606 and address at Calle Ugarte and Moscoso No. 421 Dpto. 4D, San Isidro District, Province and Department of Lima, Peru.

3.4 Database register

3.4.1 The existence of the personal data bank called “Users” is in the process of being registered in the National Registry for the Protection of Personal Data.

3.5 The conservation of personal data.

3.5.1 The personal data provided will be kept by Kantaya as long as: (i) the contractual relationship with the User is maintained, (ii) as long as the User does not request the cancellation of their personal data, in accordance with the procedure established for that purpose; and even after that, Kantaya may keep certain personal data for as long as Kantaya maintains any legal or contractual obligation to keep it in order to comply with surviving obligations under its charge or responsibility. Likewise, Kantaya will maintain indefinitely the User’s personal data as long as they are duly dissociated or de-anonymized.

3.6 From Personal data gathering.

3.6.1 Kantaya gathers the User’s personal data, from the following shapes:

a) Personal data provided by the User himself through:
– The direct communication with Kantaya, either through: (i) The registration request, (ii) any communication of the User with Kantaya regarding the Web Portal, (iii) the communication or request for information and/or assistance from the User regarding any Service provided on the Portal or, (iv) contracting a Service through the Web Portal.
– Filling and sending voluntary online surveys that Kantaya can send or request to the User.

b) By means of automatic data gathering through Web Portal Cookies, or other data automatically assigned to the equipment from which the User accesses the Web Portal. To view the automatic data gathering policy, you must enter the following link: Cookies Policy

3.7 Purposes of the gathering and processing of personal data.

3.7.1 Kantaya will process the User’s personal data for the following purposes:

a) Allow them to enter and use the Web Portal.
b) Manage their registration request on the Web Portal and validate the veracity of the information .
c) Manage the contracting of a Service on the web Portal by the User and execute it in their favor.
d) Conduct customer surveys.
e) Respond to questions, queries, complaints or claims submitted.
f) Allow to improve the content and/or design of the Web Portal.
g) Carry out communications with the User to build loyalty.
h) Fulfil with legal and/or contractual obligations related to the use of the Web Portal and/or the contracting of a Service provided in it.
i) Carry out statistical, design and/or usability studies of the Web Portal, as well as audience measurement and configuration of personalized advertisements.
j) Send the User’s personal data to companies that provide services based on cloud infrastructure, in order to host, store, process and/or execute such data.
k) Send commercial emails related to the Web Portal and/or the Services. In any case, the User may notify his wish not to receive more emails by exercising his ARCO rights, in accordance with the procedure described below and sending a withdrawal request. It will also be included all the emails sent to the User, so that they can reverse their consent automatically through this.

3.7.2 On the other hand, the USER authorizes Kantaya to:

a. I authorize the sending of communications referring to advertising or promotions on topics of Kantaya’s own activities, donations, volunteering.

b. I authorize the sending of communications referring to advertising or promotions regarding the promotion of products for sale by Kantaya..

3.7.3 The User’s personal data will only be used for limited purposes, such as those set out above. In this sense, once the personal data has been provided by the User, Kantaya will not use, sell, transfer, assign or share it, except in the ways expressly established for the purposes previously described..

3.7.4 The User expressly states that this Policy and its acceptance is the sufficient and suitable mechanism to inform them of all the aforementioned purposes..

3.7.5 If the User does not accept the additional treatment(s) of their personal data, this will not affect the use of the Web Portal, their registration process in it, or the contracting of any Service.

3.8 Transfers and recipients of personal data.

3.8.1 Kantaya gathers the User’s personal data, from the following shapes:

a. SUNAT, address: Av. Garcilazo de la Vega N°1472, Lima Cercado district, province and department of Lima. In order to issue the corresponding payment receipt for the payment of a Service contracted by the User through the Web Portal.

b. In the event that the User makes any publication (which may include their personal data) on the Web Portal on a voluntary basis, such information may be viewed by other Users and/or third parties without any restriction. In this sense, Kantaya will share such information published by the User (eventually including their personal data) to such Users or third parties, for which Kantaya will not be responsible for the information published directly and voluntarily by the User, to the extent that it is is out of your scope of control.

3.8.2 Kantaya contracts cloud services (cloud computing) through: HostGator, whose geographic location is in the United States of America.

3.8.3 Kantaya will transmit or reveal personal data to third parties outside the Republic of Peru, except legal obligation.

3.8.4 Likewise, Kantaya will not transmit or reveal the personal data or information provided by the User to third party who do not have the right to know it, except in those cases in which it is legally required by virtue of a police, administrative or judicial order or requirement, in which case Kantaya will abide by such requirements and orders in accordance with applicable laws.

4. Exercise of the rights of access, access, rectification, cancellation and opposition of the data – ARCO Rights.

4.1 Any User has the right to access the personal data that Kantaya possesses about themselves as Responsible for the corresponding database. The User also have the right to know the characteristics of their treatment, rectify them if they are inaccurate or incomplete; request that they be deleted or canceled as they are considered unnecessary for the previously stated purposes or oppose their treatment for specific purposes.

4.2 Likewise, any User may, at any time, reverse the consent expressly granted to Kantaya to use their personal data, as well as limit such use or disclosure of these; but the User must bear in mind that, depending on the data in question, it could happen that he or she can no longer use the Web Portal or any particular Service in whole or in part, facts that will be promptly informed.

4.3 Any User may at any time and free of charge exercise the rights previously described with respect to their personal data provided or gathered by Kantaya. For this purpose, Kantaya will attend and respond to the requests received in accordance with the following legally applicable deadlines, which will be counted from the day following the submission of the request in writing:

a) The exercise of the information right, within a maximum period of eight (08) days.
b) The exercise of information access, within a maximum period of eight (20) days.
c) The exercise of other rights (such as rectification, cancellation or opposition), within a maximum period of ten (10) days.

4.4 The request will be made in writing addressed to the Kantaya Association in one of the following ways:

a. In physical form, to the following address: Calle Ugarte y Moscoso No. 421 Dpto. 4D, San Isidro District, Province and Department of Lima, Peru. Or,
b. By email to the mail: donacion@kantayaperu.com

4.5 For this, in the communication sent to Kantaya, the User must properly identify himself, describe the facts that give rise to the exercise of the right, the right in question that he wishes to exercise and his address; In addition, the user must attach a copy of their identity document or equivalent, as well as the documents that they consider pertinent.

4.6 If your communication is erroneous or incomplete, Kantaya will have a period of up to seven (07) calendar days, counted from the day following receipt of the request, to request the correction of the same and/or the additional documentation that is pertinent to end of processing it; then the User will have up to ten (10) calendar days, counted from the receipt of the request, to correct or submit the requested documentation.

4.7 After the ten (10) days indicated above without absolution of the request made, Kantaya will understand that the User has desisted from his request.

4.8 Once the complete application has been received, a legend that says “data or information blocked due to a request in process” and the reason for it will be included in the place where the information rests, within a term not exceeding two (2) business days. This legend will be kept until the request is resolved.

4.9 Except for the response period established for the exercise of the information right, the corresponding periods for the response or attention of the other rights may be extended only once, and for an equal period, at most, as long as the circumstances justify it. The justification for the extension of the term will be communicated to you within the term to be extended.

4.10 In case any User considers that they have not been attended to in the exercise of their rights, they can file a claim with the National Authority for the Protection of Personal Data, by contacting the Intake Desk of the Ministry of Justice and Human Rights located at Calle Scipión Llona N ° 350, Miraflores District, Lima Province and Department, Peru.

5. The assignment of contractual status on the ownership of the data bank and/or commissioning of personal data processing to a third party.

5.1 If in the future, Kantaya transfers ownership of the database called “Users” and/or entrusts its treatment to a third party, by accepting this Policy, the User also accepts in advance, prior, express, informed and unequivocal such fact leaving the obligation of Kantaya to inform the identity and address of the new owner or person in charge of the treatment of the personal data bank in question, as well as its obligations and/or applicable limitations, to the corresponding Users with an anticipation of at least thirty (30 ) calendar days to the effective date on which the change operates. During this period, the User who does not agree with the change to be made, may express their disagreement with it and request the cancellation of their personal data to Kantaya, in accordance with the procedure previously described for this purpose.

5.2 In case the User does not express his objection regarding the reported change and does not initiate a request to cancel his personal data due to such fact, it will be understood that he agrees with the informed change, taking full effect from the date on which it operates effectively.

5.3 In the specific case of the assignment of contractual status regarding the ownership of the data bank, after the reported change operates, Kantaya will no longer have any responsibility with respect to any event that occurs from the date of the transfer. The new owner and, therefore, person in charge of the data bank will assume all and each obligations established in this Policy regarding the treatment, safeguarding and conservation of the previously detailed information; as well as all the obligations applicable to such quality.

6. Security and protection measures

6.1 In order to avoid the loss, misuse, alteration, unauthorized access and/or theft of personal data or information provided by the User, Kantaya has adopted the levels of security and protection of personal data legally required, and has installed all the means and technical measures at its disposal for this purpose; all this, in accordance with the provisions of the Law, its Regulations and the Security Directive.

6.2 In this sense, Kantaya has implemented and uses the industry standards regarding the protection of the confidentiality of the personal data of its Users, and declares to employ various security measures to prevent unauthorized access. However, no security measure is one hundred percent impregnable, so Kantaya is not responsible for illegal interceptions or violation of its computer systems or databases by unauthorized persons, as well as the improper use of personal data obtained in violation of its security systems; in violation of applicable laws, or any illegal or illegitimate action that reasonably escapes its control. Therefore is not attributable to it, as well as the due of Kantaya diligence.

6.3 Likewise, Kantaya will not be responsible for possible damages that any User may suffer as a result of the actions previously described or others caused by third party and over which Kantaya has no control or that could not have been avoided by applying due diligence.

7. Changes to this Privacy Policy

7.1 Kantaya reserves the right to modify this Policy in the future. The use and treatment of personal data will be ruled by the Policy in force at the time of its gathering and its subsequent changes or modifications.

7.2 If Kantaya makes changes to this Policy, it will be notified to the User by means of a notice on the Web Portal itself and/or by sending an email to that effect. That notification will be sent before the effective implementation of the changes to be made.

7.3 The User will be bound by and subject to the changes made in this Policy if, after receiving the corresponding change notification, they continue to use the Web Portal and/or the Services after those changes become effective. Unless they expressly state otherwise in writing; they must initiate the request to cancel their personal data to Kantaya, in accordance with the procedure previously described for this purpose.

8. Contact details regarding data protection

8.1 The USER can contact Kantaya for any matter regarding their personal data through:

a) Our address: Calle Ugarte y Moscoso No. 421 Dpto. 4D, San Isidro District, Province and Department.
b) Our e-mail: donacion@kantayaperu.com

9. Entry into force and Term

9.1 This Policy come into force from January 15th 2021 and it will be in force until they are expressly modified by Kantaya, and/or until the Web Portal is permanently withdrawn.

BY MARKING PRIVACY POLICY BOX ON THE REGISTRATION SCREEN, THE USER CONFIRMS THAT HE HAS READ THIS TEXT AND ACCEPTS IT IN THE VERSION PUBLISHED ON THE DATE OF REGISTRATION ON THE WEB PORTAL.

Date for last update: January 15th 2021