Inca Trail Company
USD $
  • USD $
English
Check permits

Privacy and personal data

Privacy policy

This policy explains what personal data Inca Trail Company processes through this website, why it is used, how long it is kept and how you can exercise your rights.

Effective and last reviewed: August 10, 2026

Who is responsible for your data

Inca Trail Company, an independent information and technology platform based in Cusco, Peru, is responsible for deciding how personal data submitted through incatrailcompany.com is used.

Location
Cusco, Peru

This policy applies to data handled by this website. It does not govern a tour operator, booking platform, government authority or other third party merely because it is mentioned or linked here.

Personal data we process

Contact form and direct email

When you contact us, we receive the data you provide: name, email address, optional organization, message topic, optional related page URL, message, consent confirmation and normal email metadata. If you send a correction, listing or contribution proposal, your message may also contain professional information, sources and material you choose to attach or link.

Availability checker

When you start the availability checker, our server processes a session identifier, IP address, requested route and date, request time and basic security information. Route and date are sent to the availability-data provider so the requested result can be returned. We do not ask for a name, passport, payment details or booking information through this tool.

Technical and security logs

The web server and hosting infrastructure may record IP address, browser or device information, requested URL, referring URL, response status and timestamp. We use this information to deliver the site, diagnose errors, enforce rate limits and investigate abuse.

Information from other sources

We may receive professional or public business information from tourism companies, contributors, public registers and authoritative sources when reviewing a listing or correction. If we need to contact the person concerned, we will identify the source when required by applicable law.

Please do not send sensitive data. The website does not need passport numbers, payment-card details, medical records, precise travel documents or account passwords. If you include unnecessary sensitive information, we may delete or redact it.

Purposes, consent and required fields

We process personal data only for the purposes described at collection and in this policy:

  • Receive and answer questions, accessibility reports and factual corrections.
  • Evaluate agency listings, contributions, commercial proposals and technology inquiries.
  • Operate and secure the contact form and availability checker.
  • Prevent spam, automated abuse, fraud and unauthorized access.
  • Maintain editorial accuracy and document material corrections or disputes.
  • Comply with legal obligations and establish, exercise or defend legal claims.

The contact form asks for your consent before submission. Name, email, topic, message and consent are required because we cannot review and answer a message reliably without them. Organization and related page URL are optional. Refusing the required information means the form cannot be submitted; you may instead browse the site without contacting us.

You may withdraw consent for future processing by emailing the privacy contact. Withdrawal does not invalidate processing already carried out and may not require deletion where another lawful reason requires limited retention, such as security, evidence of a request or compliance with law.

We do not sell personal data, use contact-form messages for behavioral advertising, or make decisions that produce legal or similarly significant effects through automated profiling.

Cookies and browser storage

Essential availability session

The availability checker creates a first-party session cookie named itc_availability. It is restricted to this website, marked Secure, HttpOnly and SameSite=Strict, and expires when the browser session ends. The associated request token lasts approximately 10 minutes. These controls authenticate the checker and reduce automated abuse; they are not used for advertising or cross-site tracking.

Packing-checklist storage

The interactive packing checklist stores its route and checked items in your browser under incaTrailPackingChecklistV1. This information remains on that device until you reset the checklist, clear browser storage or the browser removes it. The checklist does not transmit those selections to our server.

Optional Google Analytics

We use Google Analytics 4, provided by Google LLC, only after you select “Accept analytics”. It helps us understand which planning pages are visited and how the website is used. Depending on your browser and our Analytics configuration, this may include the page URL and title, referring page, approximate location, browser, device, language, session information and interactions with website features. We do not intentionally send names, email addresses, contact-form contents, passport details, payment information or precise travel documents to Google Analytics.

After consent, Google Analytics may set first-party cookies including _ga and _ga_H7FC9J1N1P to distinguish browsers and sessions. Google states that an IP address may be used to derive approximate location before it is discarded and is not logged or stored by Analytics. Advertising storage, advertising user data, ad personalization and Google Signals remain disabled in our implementation.

Your decision is saved in this browser under itcAnalyticsConsentV1. Rejecting analytics does not affect access to the website, the essential availability session or the local packing checklist. You can change or withdraw your decision at any time through “Cookie settings” in the footer. Withdrawal stops Analytics on subsequent page loads and attempts to remove its first-party cookies from this domain.

Service providers, recipients and disclosures

Personal data may be processed only as necessary by providers supporting:

  • Website hosting, network delivery, server logs and security.
  • Email delivery and storage for messages sent to our published addresses.
  • Live availability data. This provider receives the route, requested date and authorized website domain, but not contact-form content.
  • Google Analytics (Google LLC): optional website-usage measurement after consent. Google may process this data on infrastructure outside Peru under its own service and privacy terms. See Google’s Privacy Policy.

These providers act under their own terms or our instructions, depending on the service. Their infrastructure may be located outside Peru. Where an international transfer of personal data occurs, we will use the safeguards and registration or notification steps required by Peruvian law.

We may also disclose information where reasonably necessary to comply with law or a valid authority request; protect users, the website or third parties; investigate abuse; or establish and defend legal claims. We do not forward your identity to a tour operator merely because your message concerns that operator. We will request permission first unless disclosure is required by law or necessary to address a claim you asked us to transmit.

Third-party links open services controlled by other organizations. Their privacy policies apply once you leave this website.

Retention and security

  • Routine contact messages: up to 24 months after the last relevant exchange, unless deleted sooner.
  • Correction, contribution and business records: while the relationship, published material or documented dispute remains relevant, followed by a reasonable legal-record period.
  • Availability session: the cookie ends with the browser session and its authentication token expires after approximately 10 minutes.
  • Security and server logs: only for the period reasonably needed for hosting, diagnostics, abuse prevention and legal obligations.
  • Local packing checklist: until you reset it or remove browser storage.
  • Google Analytics: user- and event-level data for up to 14 months, depending on the property setting; standard aggregated reports may remain available for longer.

We use reasonable technical and organizational safeguards appropriate to the limited data handled by the site, including HTTPS, access controls, same-origin validation, input limits, rate limiting and restricted session cookies. No internet service can guarantee absolute security. If a personal-data incident creates the risks described by applicable law, we will notify the competent authority and affected individuals within the required periods.

Your privacy rights

Under Peru’s Personal Data Protection Law, you may request information about processing and exercise rights of access, rectification, cancellation and opposition (ARCO). Where applicable, you may also request data portability, withdraw consent and challenge qualifying automated treatment.

Send a free request to info@incatrailcompany.com with the subject “ARCO privacy request”. State your name, the right you wish to exercise, the email or message concerned and a clear description of your request. We may ask for proportionate evidence of identity; do not send identity documents until we explain a secure and necessary method.

Maximum response periods under the current Peruvian regulation are eight days for the right to information, twenty days for access, and ten days for rectification, cancellation or opposition, counted from the day after a valid request is received. A legally permitted extension will be explained within the original period.

If your request is denied or not answered within the applicable period, you may seek protection before Peru’s National Authority for Personal Data Protection or pursue habeas data where applicable. Official information is available from the National Authority for Personal Data Protection.

Children and international users

This website provides general travel-planning information and is not directed to children. A person who lacks legal capacity to consent should not submit a contact form without authorization from a parent or legal representative. If we learn that personal data was submitted without valid authorization, we will take reasonable steps to delete it.

The website can be viewed internationally, but its data controller is based in Peru. Mandatory privacy rights in your place of residence may also apply and are not limited by this policy.

Policy changes and contact

We may update this policy when website features, providers or legal requirements change. The effective date will be revised when a material change is published. If a new purpose requires fresh consent, publication alone will not replace that consent.

Questions, consent withdrawals and privacy requests can be sent to info@incatrailcompany.com.

Inca Trail Company is not a tour operator and does not receive passport, payment or booking records from independent agencies merely because they are listed, compared or linked on this website.