INTRODUCTION.

ENTRETENIMIENTO CULTURAL S.A.C and its brands Paracas es Aventura and Paracas.pe (hereinafter referred to as “The Company”), ensures the utmost confidentiality and protection of the personal data of the Users of its website: https://paracas.pe. Any communications regarding this document should be directed to the following email address: [email protected].

This document outlines the “Privacy Policy” that governs the processing of personal data provided by Users on the website.

OBJECTIVE AND PURPOSE.

At “The Company,” we are aware of the high regard our customers and all those interested in our products and services place on privacy. In line with this, we are committed to respecting your privacy and protecting the confidentiality of your private information and personal data. Therefore, the objective of this privacy policy is to inform our Users about how personal data collected through the website is gathered, processed, and protected.

Personal private information does not include information available from publicly accessible sources, such as electronic, optical, or other technological media designed to provide information to the public and open to general consultation, including: telephone directories, newspapers and magazines, social media, professional lists, anonymized jurisprudence repositories, Public Records administered by the National Superintendent of Public Records, and any other register or database deemed public by law, as well as information held by public administration entities that must be provided to citizens under Law No. 27806 – Law of Transparency and Access to Public Information.

At “The Company,” we are particularly interested in offering our Users the highest level of security and protecting the confidentiality of the data they provide. For this reason, operations are conducted in a secure server environment under the SSL (Secure Socket Layer) protocol, currently used by the world's most important companies for secure electronic transactions.

The website has been created and designed for “The Company” to offer goods and services, as well as to provide other information that we believe may be of interest, creating a communication space for Users.

LEGISLATION.

This policy is governed by Peruvian legislation, particularly:

- Law No. 29733 – Law on Personal Data Protection.

- Supreme Decree No. 003-2013-JUS, Regulation of Law No. 29733.

- Information Security Directive, approved by Directoral Resolution No. 019-2013-JUS/DGPDP.

According to Law No. 29733 – Law on Personal Data Protection and its Regulation approved by Supreme Decree No. 003-2013-JUS, personal data is defined as any numerical, alphabetical, graphic, photographic, acoustic information, or information concerning personal habits or any other type related to a natural person that identifies or makes them identifiable through means that can be reasonably used.

Moreover, the processing of Personal Data is understood as any technical operation or procedure, automated or not, that allows the collection, registration, organization, storage, preservation, elaboration, modification, extraction, consultation, use, blocking, deletion, communication by transfer or diffusion, or any other form of processing that facilitates the access, correlation, or interconnection of personal data.

“The Company” develops its personal data processing policy in accordance with the guiding principles established in Law No. 29733 – Law on Personal Data Protection. Therefore:

- In accordance with the principle of legality, “The Company” rejects the collection of personal data by fraudulent, unfair, or illegal means.

- Under the principle of consent, the processing of personal data will require the User's consent.

- Personal data will be collected for a specific, explicit, and lawful purpose and will not be extended to other purposes that have not been unequivocally established at the time of collection, except in cases of activities with historical, statistical, or scientific value when a dissociation or anonymization procedure is used.

- Any processing of personal data will be adequate, relevant, and not excessive concerning the purpose for which it was collected.

- Personal data will be accurate, truthful, and, where possible, up-to-date, necessary, relevant, and adequate concerning the purpose for which it was collected. It will be stored securely and only for the time necessary to fulfill the purpose of the processing.

- “The Company” and, where applicable, the data processors, adopt the necessary technical, organizational, and legal measures to ensure the security and confidentiality of personal data. “The Company” has appropriate security measures in place, in line with the type of processing to be carried out and the category of personal data involved.

- “The Company” informs its Users that they can exercise their rights under the constitutional right to personal data protection before the National Data Protection Authority and before the Judiciary in the context of initiating the corresponding habeas data process.

- “The Company” guarantees an adequate level of protection for the cross-border flow of personal data of its Users, with a minimum level of protection comparable to that provided by Law No. 29733 or international standards in this area.

4. INFORMATION.

Users are informed that the personal data they enter in the forms found in the "Contact Us" section of the website will be processed by “The Company” to manage the comments they make and to contact these Users. The processing will be governed by the provisions of this Privacy Policy.

QUALITY OF PERSONAL DATA

The personal data requested from Users are basic contact details and are adequate, relevant, and not excessive concerning the purpose for which they are collected. The personal data “The Company” will have access to are those voluntarily provided by the User by completing the forms made available for this purpose.

“The Company” provides its Users with the appropriate technical resources to become aware of this Privacy Policy and any other relevant information; the entry of Personal Data or confidential information on the website constitutes an express manifestation of consent to this Privacy Policy.

The personal data provided by Users must be accurate and correct so that they truthfully reflect their current situation. Otherwise, these data will be canceled.

The personal data provided by Users are collected to fulfill the purposes outlined in this document and will not be used for other purposes incompatible with the specified ones.

Personal data will be canceled when they are no longer necessary for the purposes for which they were collected. However, they will be retained for the time during which “The Company” may be liable for any responsibility arising from this relationship with the Users.

PURPOSE OF PERSONAL INFORMATION PROCESSING.

The purposes of processing the personal data Users enter in the different forms on the website are to respond to queries, requests, and other types of information they make through them and to provide subsequently any information “The Company” believes may be of interest.

Similarly, the personal data provided in our promotions or campaigns will be processed for the development, fulfillment, and execution of these activities, as well as to provide the User with information about “The Company’s” products or those of other group and associated companies (whose activities are related to supermarkets, department stores, shopping centers, and financial services, among others), including the sending of equivalent electronic communication such as SMS, WhatsApp, Telegram, Messenger, Zoom, emails, and phone calls.

If the User does not wish to receive the aforementioned commercial communications, they may notify us at any time via the email mentioned as official in the Introduction of this document.

PROCESSING OF PERSONAL DATA AND CONSENT

The personal data provided by Users will be stored in databases that are part of “The Company’s” information system and will be processed to carry out the purposes outlined above.

The databases containing personal data are registered with the Data Protection Registry of the Data Protection Authority.

The personal data provided by Users will only be accessible and handled by “The Company” personnel who need to know this information to respond to Users' requests. These personal data will be processed fairly and lawfully and will not be used for purposes incompatible with those specified.

COMMUNICATION BY TRANSFER OF PERSONAL DATA

“The Company” respects its Users' privacy and will not share their information with third parties unless explicitly requested, except in the case of related companies within the corporate group to which we belong and subcontracted companies for product delivery and customer service assistance.

Users are informed that the personal data they provide will not be transferred to any third party that is not part of “The Company’s” group or subcontracted companies for product delivery and customer service assistance.

Likewise, Users should be aware that their personal data may be communicated by transfer to administrative entities, judicial and/or police authorities, whenever established by law.

CONFIDENTIALITY OF PERSONAL DATA

The personal data provided by Users will be treated with total confidentiality. “The Company” commits to maintaining professional secrecy indefinitely concerning this information and guarantees the duty to safeguard it by adopting all necessary security measures.

SECURITY OF PERSONAL DATA

In compliance with current regulations, “The Company” has adopted the appropriate technical and confidentiality security measures to the category of personal data necessary to maintain the required level of security to prevent alteration, loss, unauthorized processing, or access that may affect the integrity, confidentiality, and availability of the information.

“The Company” has implemented all necessary legal, technical, and organizational measures to ensure the security of personal data and prevent their alteration, loss, unauthorized processing, and/or access, considering the state of technology, the nature of the data stored, and the risks to which they are exposed, whether arising from human action, the physical or natural environment, as established by current Peruvian personal data protection legislation.

The Company has also implemented additional security measures to reinforce the confidentiality and integrity of the information and continuously monitors, controls, and evaluates processes to ensure the privacy of personal data.

However, transmitting information through communication networks and the Internet is not entirely secure; therefore, although “The Company” will make every effort to protect personal data, it cannot guarantee their security during transit to the website. In this sense, any information Users provide will be sent at their own risk.

For this reason, “The Company” recommends that its Users exercise maximum diligence when transferring personal information to third parties or publishing it to avoid putting their