1. Who is responsible for your information
ANDES.LUXE is operated provisionally by Carlos Palma Arzubialde, a natural person based in Lima, Peru, who runs the ANDES.LUXE project while the future operating company is being incorporated.
The company is in the process of formation. Its definitive legal name, tax identification, registered address and corporate privacy contact have not been formalized yet. They will be published here as soon as they exist.
2. What information we collect
When you send a request through our forms, we collect the information you provide:
- Contact details: your name, email address, phone or WhatsApp number, and country of residence.
- Your travel request: the package or destinations you choose, preferred experiences and travel style, dates and flexibility, trip duration, number of adults, and number and ages of children.
- Optional details: special occasions, dietary needs, accessibility or mobility requirements, and any comments you choose to share.
- Technical and security information: the page you came from, the status of automated security checks, pseudonymized identifiers used to prevent abuse, and technical event records linked to your request.
Dietary, accessibility and mobility fields are entirely optional — please share only what is needed to prepare your request.
3. How we obtain information
Directly from you, when you complete the Private Quote or Bespoke Itinerary forms on our website.
Automatically, through security and anti-abuse checks needed to keep the forms reliable. Verification tokens used for these checks are never stored.
We do not buy contact lists and we do not receive your information from data brokers.
4. How we use your information
- Receiving and answering your requests.
- Preparing private quotes and designing bespoke itineraries.
- Contacting you about your request.
- Managing commercial follow-up and organizing our concierge work.
- Sending transactional confirmations related to your request.
- Keeping our forms secure and preventing abuse.
- Diagnosing technical errors.
- Complying with applicable legal obligations.
- Keeping evidence of the consents you gave.
5. Legal grounds for processing
We process your request information because you asked us to and because it is necessary to respond to it. Where required, we rely on your consent — for example, the processing consent checkbox in our forms.
Optional marketing relies on your separate consent, which you can withdraw at any time.
Security and anti-abuse processing relies on our legitimate interest in operating reliable forms, where applicable.
The exact legal basis can vary depending on your jurisdiction and the nature of your request.
6. Information about children
Our forms are designed for adults. We ask for children's ages only to design a suitable family trip, and those details must be provided by a parent, guardian or responsible adult.
Children should not complete these forms themselves. Please do not include full names, documents, medical diagnoses or other unnecessary information about minors.
7. Providers and recipients
We work with the following categories of providers, only as needed for their function:
- Railway — application hosting and infrastructure, when enabled in production.
- PostgreSQL — the main database where requests and operational events are stored.
- Cloudflare Turnstile — form protection and abuse prevention.
- Resend — transactional email delivery, once the sending domain is verified.
- Monday.com — the concierge team's operational interface. Our database remains the source of truth.
- Travel suppliers — only when necessary to prepare or deliver a proposal or booking; we do not share your request with them automatically.
- Authorities — when we are legally required to do so.
Some of these services are still being activated for production; this notice describes them so you know what to expect.
This site uses Plausible Analytics, a privacy-first analytics service that does not use cookies and does not collect personal data.
8. International processing
Some technology providers may process information outside Peru, depending on their infrastructure.
We will put appropriate contractual safeguards in place where required. These details are being reviewed before the definitive production launch.
9. Security
We apply technical and organizational measures proportionate to the information we handle, including encrypted connections, anti-abuse checks on forms and limited retention of technical records.
No system is perfectly secure, but we design our processes to collect only what we need.
10. How long we keep your information
- Requests that do not lead to a booking: up to 24 months from the last interaction, or earlier if you ask us to delete them and we have no obligation to keep them.
- Booked clients and services: for the duration of the relationship and any additional period required by legal, accounting or contractual obligations or the defense of claims.
- Optional marketing: until you withdraw your consent, or up to 24 months without interaction, subject to review.
- Technical security records: for short periods proportionate to their purpose; rate-limiting buckets are deleted operationally after short windows.
- Operational events linked to a request: for the same general period as the request itself.
These periods are provisional and will be reviewed when the company is incorporated and its obligations are formalized.
11. Transactional communications
When your request is received, we send two operational emails: a notification to our concierge team and a confirmation to you, in the language of the page you used.
These messages are part of answering your request — they are not marketing, and you receive them regardless of your marketing choice.
12. Optional marketing
Marketing communications are sent only if you tick the separate, optional marketing checkbox. It is unchecked by default and never required to receive a quote.
You can withdraw your marketing consent at any time by writing to [email protected]. Processing your request never depends on marketing.
We do not run behavioral advertising and we do not sell your information.
13. Automated decisions and abuse protection
We use automated checks to detect abuse and protect our forms. The resulting technical risk signal is a security indicator only — it is not a commercial evaluation of you.
It is never used to approve or decline trips, prices or bookings, and we make no decisions with legal or similarly significant effects based solely on it.
If a legitimate request of yours runs into difficulty, write to us at [email protected] and we will review it.
14. Your rights
Depending on your jurisdiction, you may have the right to:
- Access the information we hold about you.
- Rectify or update inaccurate information.
- Request deletion of your information.
- Object to certain processing.
- Withdraw your consent at any time.
- Request limitation of processing.
- Request portability where legally applicable.
- Complain to the competent data protection authority.
In Peru, you may contact the Autoridad Nacional de Protección de Datos Personales. Rights in other jurisdictions may provide additional protections.
15. How to exercise your rights
Write to us at [email protected] with enough detail for us to reasonably verify your identity and locate your information. There is no charge.
Please do not send identity documents or other sensitive documents by email unless we specifically ask for them after reviewing your request.
Requests to withdraw marketing consent can also be sent to the same address.
16. Changes to this notice
We will update this notice as the project formalizes — for example, when the operating company is incorporated, its registrations are completed, or our providers change.
The current version and its effective date are always shown at the top of this page.
17. Contact
Provisional privacy contact: Carlos Palma Arzubialde, Lima, Peru.
Email: [email protected].
This contact channel is provisional and will be replaced by a corporate privacy address when the company is incorporated.