Privacy Policy

Mystery Peru is a travel agency based in Nazca, Peru (Hacienda Curve Alto S/n, Nazca, Peru 08000). We are the data controller for the information described here. You can reach us at [email protected] or by WhatsApp at +51 941 695 002.

When you book: name, surname, email, phone or WhatsApp, nationality, passport or ID number (required by airlines and transport operators in Peru), hotel or pick-up point, dietary or mobility needs you choose to share, and the details of your booking.

When you contact us: the details you type in the contact form, in an email or in a WhatsApp conversation.

When you browse: technical data such as IP address, browser, device, pages visited and approximate country, collected through cookies and similar technologies described below.

When you create an account: your login email, a hashed password and your booking history.

To confirm and operate your tour: we share the passenger list with airlines, drivers, guides and hotels involved in your booking.

To answer questions, send booking confirmations, vouchers, reminders and changes.

To process payments and prevent fraud.

To improve the site, measure which pages are useful and fix errors.

To comply with legal obligations in Peru, including tax and tourism regulations.

Card payments are processed by Izipay (Lyra Network), a licensed payment provider in Peru. Your card number is entered in a secure form served by Izipay and is never stored on our servers. We keep only the transaction reference, amount and status.

Only the providers needed to run your tour or this website: airlines for the Nazca Lines flights, transport companies, guides, hotels, our payment provider, our email and hosting providers, and analytics tools. We do not sell personal data.

Some providers process data outside Peru. In those cases we rely on their contractual commitments to protect it.

mysteryperu.com uses strictly necessary cookies (session, language, shopping cart) and, where enabled, analytics cookies such as Google Analytics to understand how the site is used. You can block cookies in your browser; necessary cookies are required for booking.

Booking and invoicing data is kept for as long as Peruvian tax law requires. Contact messages are kept for up to two years. Account data is kept while the account is active and deleted on request.

You may ask to access, correct, delete or export your personal data, or object to certain uses, by writing to [email protected]. We answer within the terms set by Peruvian Law 29733 on Personal Data Protection and, for residents of the European Union, the GDPR.

We use HTTPS across the site, restricted access to booking data and reputable providers for hosting and payments. No system is completely secure; if a breach affects your data, we will inform you as required by law.

We may update this policy when our services or the law change. The current version is always published on this page with its date. Questions: [email protected].