This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.
ARCO rights
1. Description
1.1 Objective:
The procedure aims to serve as a guide to meet the requests submitted for the exercise of the rights of information, revocation and ARCO rights by the holder of personal data, in order to comply with the requirements of the Law on Protection of Personal Data and its Regulations, thus avoiding violations and sanctions of the National Authority for the Protection of Personal Data, which affect the institutional image, the relationship with its customers and reputation of Inversiones Nacionales de Turismo S.A (hereinafter INTURSA).
1.2 Scope:
This document is applicable to all areas of INTURSA that are involved in the processing of personal data.
1.3 Definiciones:
- Responsible for the protection of personal data: Person or Committee in charge of ensuring compliance with the processing of personal data for the purposes for which the holder of personal data granted his/her consent. Likewise, he/she is in charge within INTURSA of requesting and receiving the necessary documentation for the exercise of the right of the holder of personal data and validating compliance with the requirements of the request. If necessary, he/she will also be in charge of formulating and submitting additional documentation or correcting the request.
- Personal data owner: natural person to whom the personal data correspond.
- Processing of personal data: any operation or procedure related to personal data, whether automated or not, such as the collection, recording, organization, storage, preservation, processing, modification, extraction, consultation, use, blocking, deletion, communication by transfer or dissemination, or others that allow access, correlation or interconnection of personal data.
- Responsible for receiving personal data: is any natural or legal person under private law, including branches, subsidiaries, affiliates or similar; or public entities, which receives the data in case of international transfer, either as owner or manager of the personal data bank, or as a third party.
- Third party: any natural person, legal person under private law or public entity, other than the owner of personal data, the owner or manager of the personal data bank and the data controller, including those who process the data under the direct authority of the former.
- Blocking: is the measure by which the person in charge of the personal data bank prevents third parties from accessing the data. Data subject to a blocking process may not be processed during the period in which a request for updating, inclusion, rectification or deletion is being processed, in accordance with the provisions of the third paragraph of article 20 of the Law. It is also provided as a prior step to the cancellation for the time necessary to determine possible liabilities in relation to the processing, during the statutory or contractually stipulated limitation period.
- Data Controller of the Personal Data Bank: any natural person or legal person under private law or public entity that alone or acting jointly with another performs the processing of personal data on behalf of the owner of the personal data bank.
- Days: working days.
1.4 Right to information, revocation and ARCO rights:
This document, describes the process of attention to the rights of information, revocation and ARCO rights of the holders of personal data, which are defined as follows:
- Information: right of the holder of personal data to be informed about the purpose for which their personal data is being processed, as well as the recipients of the same and the database where their personal data is stored.
- Revocation: the right of the holder of the personal data to revoke his consent partially or totally with respect to the processing of his personal data at any time, without prior justification and without retroactive effects.
- Access: right of the holder of personal data to obtain information related to his personal data, as well as to all the conditions and generalities of the processing thereof.
- Rectification: the right of the holder of personal data to have his or her inaccurate, erroneous or false data modified.
- Cancellation: the right of the holder of personal data to request the deletion or cancellation of their personal data when they consider that they are not being processed in accordance with the Law and its Regulations.
- Opposition: the right of the holder of personal data to request the cessation of processing, when he/she has not given his/her consent for the collection of his/her personal data, for a justified and legitimate reason related to a specific personal situation.
2. Procedure for the exercise of the rights of the holder of personal data:
2.1 Receipt of the request:
The receipt of the request for attention to the rights of the holders of personal data may be made through the following channels:
- A) In person at INTURSA’s offices, the holder of the personal data may request the “Format for exercising the right to information, revocation and ARCO rights – Annex 1”, to begin with the presentation of the request to exercise his/her rights. The holder of personal data will have to complete the personal data required in the form and sign the document as a sign of conformity of the data provided. A copy of the form must be provided to the data owner as a receipt of the document.
- B) Through INTURSA’s web page, the holder of personal data may download the “Format for exercising the right to information, revocation and ARCO rights – Annex 1 ” to begin with the presentation of the request to exercise his/her rights. The holder of personal data must complete the personal data required in the form and sign the document in accordance with the data provided, then send the document to the email indicated on the website. The email sent must be forwarded to the “Personal Data Protection Officer” in order to evidence the receipt of the request for the exercise of the rights of the holder of personal data
Additionally, in both channels, once the form for the exercise of their rights has been completed, the holder of personal data must prove their identity by presenting a copy of their identity document and in the case of a legal representative, they must present a document that proves such power of attorney and their ID card, providing a copy of the documents to the personnel in charge of handling requests.
2.2 Rgistration of the request:
The Personal Data Protection Officer shall fill out a register (which shall be updated) of the requests for information, revocation and ARCO rights that allows keeping an adequate control of the requests submitted in person or by e-mail, assigning a correlative control code to the request.
2.3 Management of the request
The handling and management of requests at ABC will be carried out according to the activities described in the Flowchart – “Process for handling requests for information rights, revocation and ARCO rights”.
3. Term of attention to your request
The period of attention for the closing of the request will depend on the right exercised by the holder of the personal data according to the following table:
| Law | Deadline for Internal Attention | Maximum term in accordance with the LPDP |
| Information | 5 working days | 8 working days |
| Access | 15 working days | 20 working days |
| Rectification, Cancellation and Opposition | 7 working days | 10 working days |
Except for the term established for the exercise of the right to information, the terms for the response or attention of the right may be extended only once for an equal term, at the most, provided that the circumstances justify the extension of the term. The justification for the extension shall be notified to the holder of personal data within the term to be extended.
3.1 Deadline for application correction
All applications submitted must be received and a record made of their receipt. The request must contain at least the following information:
- Names and surnames of the holder of the personal data and accreditation of these, as well as of their legal representatives, if applicable.
- Specific request that gives rise to the request.
- Address, or address, which may be electronic, for the purpose of the corresponding notifications.
- Date of the request and signature of the applicant.
- Documents supporting the request, if applicable.
In case the application does not contain the aforementioned data, within a term of five (5) days, counted from the day following the reception of the application, the observations for non-compliance that cannot be saved ex officio are formulated, inviting the holder to correct them within a maximum term of five (5) days. If the aforementioned term has elapsed without the correction being made, the application will be considered as not having been filed.
3.2 Request for additional information
In the event that the information provided in the request is insufficient or erroneous in a way that does not allow its attention, INTURSA may require within seven (7) days of receipt of the request, additional documentation to the holder of the personal data to meet the request. Within ten (10) days of receipt of the request, counted from the day following its receipt, the owner of the personal data shall accompany the additional documentation that he/she deems pertinent to support his/her request. Otherwise, the request shall be deemed not to have been filed.
3.3 Situations to consider
Although the holders of personal data may exercise any of the rights indicated in section 1.4, it should be taken into account that the answers to such requests must be duly grounded, especially in those cases of denial of requests originating in restrictions provided for in any specific regulation applicable to the company. For example, labor restrictions, Peruvian National Police, among others.
You can download your ARCO Rights request here.