1. INTRODUCTION

Bonanza Conservation Experience S.A.C.. is a company in the tourism sector dedicated to the sale and operation of tourist services in the Manu National Park, located at Calle Suecia 343 – Cusco. Bonanza Conservation Experience S.A.C. RUC. 20542854422, is obliged to comply with current Peruvian legislation on the protection of personal data, Law No. 29733 Protection of Personal Data and its complementary provisions.
Therefore, Bonanza Conservation Experience S.A.C. undertakes to:
• Collection and use of personal information.
• Ensure the quality and security of the information. • Respect the rights of individuals regarding information about themselves.
• Bonanza Conservation Experience S.A.C.. is committed to the protection, management and proper treatment of personal data to which it has access in the regular operation of its business. Said commitment includes the review and continuous improvement of the organization's processes in order to guarantee adequate protection of said personal data and the guidelines established by Bonanza Conservation Experience S.A.C. for the collection and processing of personal data in order to ensure respect for the rights of their owners and compliance with the current regulatory framework. The Policy may be supplemented with additional procedures, regulations and/or guidelines that develop what is established in this document, provided they are aligned with its guiding principles.

2. OBJECTIVE

• The purpose of this document is to establish principles, uniform practices and responsibilities regarding the processing of personal data in which Bonanza Conservation Experience S.A.C. is involved.

3. SCOPE

• This document is applicable to all processes of Bonanza Conservation Experience S.A.C. that will use personal data of the clients destined to be contained in the different databases Bonanza Conservation Experience S.A.C.. and to the treatment of these.
• The Policy will be known and fully complied with by all workers of Bonanza Conservation Experience S.A.C. and providers. For the purposes of interpreting this Policy, the definitions contained in the Law and especially those included below apply.

4. DEFINITIONS

• Personal data: All information that identifies a natural person or that can be identified through means reasonably used. For example, the DNI or Passport, physical address, full name. Sensitive data: Personal data constituted by biometric data that by themselves can identify the owner; data referring to racial and ethnic origin; economic income, opinions or political, religious, philosophical or moral convictions; union membership; and health related information.
• Treatment of personal data: Any operation or technical procedure, automated or not, that allows the collection, registration, organization, storage, conservation, elaboration, modification, extraction, consultation, use, blocking, deletion, communication by transfer or by diffusion or any other form of processing that facilitates the access, correlation or interconnection of personal data. In summary, the processing of personal data regulates all possible forms of use and processing of personal data within the organization from its entry to its eventual elimination or conservation.
• Consent: Prior, free, unequivocal and express authorization that the individual must grant to authorize the processing of her personal data. • Previous: It must be obtained before the collection. • Free: It must not be forced or conditioned. • unequivocal and express: There should be no doubt of its manifestation and it must be recorded in some tangible medium. Bank of personal data: Organized set of personal data, automated or not, regardless of the support, be it physical, magnetic, digital, optical or others that are created, whatever the form or modality of its creation, formation, storage, organization and access.
• Holder of the personal data bank: Natural person, legal person under private law or public entity that determines the purpose and content of the personal data bank, its treatment and security measures. Person in charge of the personal data bank: Any natural person, private legal entity or public entity that alone or acting jointly with another performs the processing of personal data on behalf of the owner of the personal data bank. Anonymization procedure: Processing of personal data that prevents identification or does not make the owner of the personal data identifiable. The procedure is irreversible. Disassociation procedure: Processing of personal data 

that prevents the identification or that does not make the owner of the personal data identifiable. The procedure is reversible.

5. COMPLIANCE OFFICERS

• Bonanza Conservation Experience S.A.C. will assign and communicate the corresponding responsibilities to all personnel and suppliers, for compliance with this Policy.
• The area responsible for annually reviewing this Policy and making the respective adjustments within Bonanza Conservation Experience S.A.C. It will be the General Manager. Likewise, said Management will be in charge of answering any query related to the application and scope of this Policy.
• Notwithstanding the foregoing, all employees of Bonanza Conservation Experience S.A.C.. as well as all suppliers and third parties with Bonanza Conservation Experience S.A.C.. that are involved in the regular exercise of their business and have access to or process personal data are subject to the compliance with the Policy. Finally, no employee of Bonanza Conservation Experience S.A.C.. should perform on behalf of the Company. actions or incur in omissions that imply a breach with the Law.

6. CONFIDENTIALITY

• This Policy will be for internal and exclusive use of Bonanza Conservation Experience S.A.C.., therefore, it is confidential. Any use other than that indicated is prohibited and must be expressly authorized in writing by the General Management.
• The personal data to which both the Bonanza Conservation Experience S.A.C. as related third parties have access or participate in their treatment, they may not be treated or used in any way without the prior consent of the owner of the personal data even after the termination of their relationship with Bonanza Conservation Experience S.A.C.., except for the exceptions regulated by Law .
• In the case of workers who, due to the nature of their duties, have access to confidential and sensitive personal information, Bonanza Conservation Experience S.A.C. will seek to develop training and specific awareness actions. The persons involved in the processing of personal data are obliged to keep professional secrecy and maintain confidentiality with respect to them. Said obligation will continue even after the end of your relationship with Bonanza Conservation Experience S.A.C.

7. PRINCIPLES

• All employees of Bonanza Conservation Experience S. A.C. They must permanently comply in the exercise of their functions with the principles established in the Law that we detail below: a. Legality. The processing of personal data carried out by Bonanza Conservation Experience S. A.C. it will be done in accordance with the provisions of the Law. The collection of personal data by fraudulent, unfair or illegal means is prohibited.
• b. Consent. Bonanza Conservation Experience S.A.C. may not process personal data that does not have the prior, express, unequivocal and free consent of its owner as necessary, except for the exceptions provided by Law.
• c. Purpose. Bonanza Conservation Experience S.A.C. will collect personal data clearly indicating the purpose for which such collection is made, which must be determined, explicit and lawful. The personal data subject to processing may not be used for purposes other than or incompatible with those for which they were obtained, except with the consent of the owner. In this sense, Bonanza Conservation Experience S.A.C. will comply with implementing measures that guarantee: • The collection, storage and preservation of personal data comply with the principles of proportionality and finality. • The proper safeguarding of personal data in compliance with appropriate technical and legal security measures. It should be noted that Bonanza Conservation Experience S.A.C. You will not be able to reveal personal data unless it is ordered by reasoned order of the judge or with the authorization of its owner, with the guarantees provided for in the Law. Likewise, Bonanza Conservation Experience S.A.C. You may not refuse to deliver information containing personal data to a public entity provided that said requirement is made for strict compliance with the powers of said entities assigned by current legislation.
• d. proportionality. All processing of personal data carried out by Bonanza Conservation Experience S.A.C. It must be adequate, relevant and not excessive for the purpose for which they were collected.
• e. Quality. The personal data that will be processed by Wild Bonanza Conservation Experience S.A.C. They must be true, accurate and, to the extent possible, up-to-date, necessary, pertinent and adequate with respect to the purpose for which they were collected. They must be kept in such a way as to guarantee their safety and only for the time necessary to fulfill the purpose of the treatment, respecting the legal terms of conservation of applicable documents and information.
• f. Security. Bonanza Conservation Experience S.A.C. and the third parties entrusted with the processing of personal data must adopt the necessary and appropriate technical, organizational and legal measures to guarantee the security of personal data against different risks, such as accidental loss or destruction due to accident, unauthorized access , the covert use or infection of malware or computer viruses. These measures will be established, communicated and, if applicable, updated by Bonanza Conservation Experience S.A.C.
• g. Adequate level of protection. In case Bonanza Conservation Experience S. A.C. carry out international transfers of personal data must guarantee a sufficient level of protection for the personal data to be processed or, at least, comparable to what is provided by Law.
• h. Rights of the holders of personal data. Bonanza Conservation Experience S.A.C. will have a simple and free procedure for attention to the rights of owners of personal data contemplated in the Law: (i) information, (ii) access, (iii) updating, (iv) inclusion, (v) rectification, (vi) deletion, (vii) prevent supply, (viii) opposition and (ix) objective treatment.
• Therefore, Bonanza Conservation Experience S.A.C.: • Will take the necessary measures to inform the owner of the personal data about the rights conferred by the Law. • Will adopt the measures that allow the owner of the personal data to keep them updated. • It will comply with responding in a timely manner and within the legal terms to the requirements and requests related to the rights of the aforementioned personal data holders; In the processes of attention to the rights of owners of personal data, the following guidelines will apply. • The deletion or rectification of personal data will not proceed when it affects the rights or legitimate interests of Bonanza Conservation Experience S.A.C., its shareholders, employees or managers or third parties or when there is a legal obligation to preserve personal data. • Bonanza Conservation Experience S.A.C. may reject certain requests when the disclosure of personal data may compromise or hinder judicial or administrative proceedings in progress.

8. TRANSFERS OF PERSONAL DATA

• Personal data processed by Bonanza Conservation Experience S.A.C. They may only be assigned or transferred to third parties for the fulfillment of purposes related to the legitimate interest of the assignor and the assignee and with the prior, express, free, unequivocal and informed consent of the owner of the personal data. Said consent will not be required in the cases permitted by Law.

9. COLLECTION OF SENSITIVE DATA

• Bonanza Conservation Experience S.A.C. will only collect personal data and/or sensitive data when strictly necessary and in compliance with the principles of purpose and proportionality. When the collection and processing of said data is derived from compliance with a legal obligation Bonanza Conservation Experience S.A.C. will inform the owner of the data of such a situation prior to its collection.

10. DISCLOSURE OF PERSONAL DATA

• Bonanza Conservation Experience S.A.C. will not disclose personal data to third parties except when: a) It is necessary for the purpose for which the personal data was collected; as in the provision of services through third parties and suppliers. b) The owner of the personal data is informed before the disclosure or at the time of the collection of the personal data. c) The owner of the personal data gives his prior and express consent. d) Consent is not required by law. e) Personal data is required by public entities within the scope of their legal powers and attributions. f) The personal data is necessary to satisfy the legitimate requirements of any company interested in acquiring any of the operations of Bonanza Conservation Experience S.A.C., with the prior consent of its owner; or, g) Access to personal data is by auditors and lawyers and other professionals obliged to keep professional secrecy.

11. ELIMINATION OF PERSONAL DATA

• Once the processing of personal data has been completed and the principle of purpose has been complied with, and provided that there is no legal mandate or reason that justifies the conservation of personal data Bonanza Conservation Experience S. A.C. will proceed to remove them from their records. Alternatively Bonanza Conservation Experience S.A.C. may apply dissociation processes, or equivalent when for any commercial, statistical or market analysis reason.

that justify the advisability of keeping such data. Bonanza Conservation Experience S.A.C. will timely define the respective procedures that are necessary for the elimination of personal data.

12. SANCTIONS REGIME

• An employee who commits an infringement of the provisions established in this Policy will be considered a serious offense and subject to sanction. Bonanza Conservation Experience S.A.C. will take the disciplinary measures it deems pertinent in cases of non-compliance with the obligations stipulated herein by the employees.

13. DISSEMINATION AND COMPLIANCE WITH THE POLICY

• Bonanza Conservation Experience S.A.C. will endeavor: i) to comply with the provisions of this Policy; ii) make known, observe and respect this Policy for each employee; iii) publish this Policy in easily accessible places; and iv) sign confidentiality obligations with employees, users, contractors and third parties who access the personal data included in the data banks.