PRIVACY POLICY

WHO WE ARE

CUSCO RESTAURANTS S.A.C. is responsible for the website www.cuscorestaurants.com and for the personal data collected through it. We process this data in accordance with Peruvian Law No. 29733, Personal Data Protection Law, and its Regulations (Supreme Decree No. 003-2013-JUS).

SCOPE OF THIS POLICY

This policy applies to the pages of www.cuscorestaurants.com, in Spanish and English, and to the services we offer through them: contact form, Complaints Book, job applications, reservations, WhatsApp contact, gift card lookup and comments on posts. Below we explain, tool by tool, what data we collect, what we use it for and where it is stored.

WHAT DATA WE COLLECT AND HOW WE USE IT

1. Contact form

• Data: your name, email address, subject, message and any other information you choose to write.
• Purpose: to answer your inquiry.
• Where it is stored: the message is sent by email to our team. The website does not keep a copy in its database.
• Legal basis: your consent, given when you submit the form.

2. Online Complaints Book

• Data: the information required by Peruvian consumer protection rules: name, ID document, address, phone and email; details of the parent or legal representative if the claimant is a minor; the restaurant, the product or service, the amount, the details of the complaint and your request.
• Purpose: to record, handle and answer your complaint within the legal deadline, and to provide the information to INDECOPI (Peru’s consumer protection authority) when required.
• Where it is stored: in a Google spreadsheet accessible only to the staff in charge. A copy is emailed to that staff and a confirmation is sent to your email.
• Legal basis: compliance with a legal obligation (Law No. 29571, Consumer Protection and Defense Code, and the Complaints Book Regulations).

3. Job applications

• Data: your identification and contact details, the position or area of interest, your education and experience, your CV and any information you attach.
• Purpose: to assess your application and contact you during the selection process.
• Where it is stored: on the website server. CVs are kept in a protected folder that cannot be reached from the internet. Only Human Resources staff and the hiring area review them, through our intranet. We also receive an email notice.
• Legal basis: your consent, given by ticking the box on the form.

4. Reservations

Reservations are made through Mesa247, a third-party platform embedded in our reservations page. The data you enter there (name, contact details, date, time and party size) is collected by Mesa247 under its own privacy policy. Mesa247 shares your booking details with us so that we can serve you.

5. WhatsApp

The WhatsApp button opens a conversation in the WhatsApp app, owned by Meta. We use your number and messages only to answer your inquiry. WhatsApp processes this data under its own privacy policy.

6. Gift card lookup

• Data: the gift card code and key. For security, we log the IP address and code of each lookup attempt.
• Purpose: to show you the status of your gift card and manage its redemption. The attempt log is used to temporarily block an IP address after several failed attempts and prevent unauthorized access.

7. Comments

If you leave a comment on a post, we store the name, email and website you provide, the comment text, your IP address and your browser details. We use them to moderate comments and detect spam. Your email is not published.

8. Browsing: analytics and advertising

When you visit the site, we show you a privacy notice so that you can choose which cookies to accept. You can change your choice at any time with the Cookie settings link at the bottom of every page.

• Google Analytics 4 (Google): only if you accept analytics. It measures visits, pages viewed, traffic source, device, approximate city and interactions. We use it to improve the site.
• Google Ads (Google) and Meta Pixel (Meta Platforms): only if you accept advertising. They measure the results of our campaigns on Google, Facebook and Instagram and allow us to show ads to people who visited the site.
• Google Tag Manager: loads the tools above in line with your choice.
• If you do not accept: the Meta Pixel is not loaded. Google tools run in consent mode: they do not store cookies in your browser and only send signals without cookie identifiers, which Google uses in aggregate form.

9. Technical and security logs

Like any website, our server logs technical data for each visit: IP address, date and time, requested page and browser. We use it to keep the site running and protect it from attacks. In addition, the administration area logs the IP address of failed login attempts in order to block unauthorized access.

10. Fonts

Some fonts on the site are loaded from Google Fonts servers. To deliver them, Google receives your browser’s IP address.

COOKIES WE USE

WHO WE SHARE YOUR DATA WITH

We do not sell or rent your personal data. We only share it with:

• Service providers acting on our behalf: our website hosting provider; Google (Analytics, Ads, Tag Manager, Fonts, spreadsheets and email); Meta (Pixel and WhatsApp); and Mesa247 (reservations).
• Authorities: INDECOPI, the National Personal Data Protection Authority, courts or other public bodies, when required by law.

INTERNATIONAL DATA TRANSFERS

Some of these providers store data outside Peru. Google LLC and Meta Platforms, Inc. process data mainly in the United States, and our hosting provider may also have servers outside the country. When you accept analytics or advertising cookies, or use the services described above, your data may be transferred to those countries. We choose providers that apply recognized security measures and data protection commitments.

HOW LONG WE KEEP YOUR DATA

• Contact and WhatsApp: as long as needed to answer your inquiry.
• Complaints Book: at least two (2) years from the date of the complaint, as required by law.
• Job applications: twelve (12) months from the application, for future selection processes, unless you ask us to delete it sooner.
• Gift cards: while the gift card is valid and for the period required by accounting and tax rules. Lookup attempt logs are used only for security control.
• Comments: while the comment remains published.
• Cookies: the period shown in the table. Google Analytics and campaign data are kept for the periods we set in those platforms.
• Technical logs: the period set by our hosting provider.

HOW WE PROTECT YOUR DATA

The site uses an encrypted connection (HTTPS). Access to data is limited to staff who need it for their work. CVs are kept in a protected folder, the administration area limits login attempts and the gift card lookup temporarily blocks repeated attempts.

MINORS

Our website is intended for adults. If a minor wishes to file a complaint, the form asks for the details of their parent or legal representative. If we learn that we have received data from a minor without the required authorization, we will delete it.

YOUR RIGHTS

You may at any time exercise your rights of information, access, rectification, cancellation and objection (ARCO rights), and withdraw any consent you have given us. To do so:

• Write to ti@cuscorestaurants.com or visit our registered address.
• State which right you wish to exercise and attach a copy of your ID document (or that of your representative, with proof of representation).
• We will reply within the deadlines set by the Regulations of Law No. 29733: 8 business days for the right of information, 20 business days for access and 10 business days for rectification, cancellation or objection.

To withdraw your consent to analytics or advertising cookies you do not need to write to us: use the Cookie settings link.

If you believe your request has not been properly handled, you may file a claim with the National Personal Data Protection Authority of Peru’s Ministry of Justice and Human Rights.

CHANGES TO THIS POLICY

We may update this policy when our tools or the law change. We will publish the new version on this page with its update date.

This English version is provided for convenience. In case of discrepancy, the Spanish version prevails.