Privacy policy

1. Who is responsible for your data

The controller of your personal data is OPERADORA DE TURISMO TREK ECUADOR (tax ID, RUC 1792001080001), trading as ViajeTrek, with its offices at Av. Pampite S/N y Padre Carlo, Edificio Officenter, oficina 300, Quito, Ecuador.

This policy is governed by Ecuador's Personal Data Protection Act (Ley Orgánica de Protección de Datos Personales, LOPDP) and its regulations. It applies to this website and to the service we give by WhatsApp, email and phone.

2. What data we collect

We only ask for what the service you are using needs.

When you create an account

• Name and email address.
• A password, which we store hashed with bcrypt. Nobody at ViajeTrek can read it, not even us.

When you ask for a quote

• Name, email address and phone number.
• Destination, dates, number of travelers and any notes you write us.

When you book a trip

• Traveler details: full name and date of birth; for an online hotel booking, each guest's name and age.
• Your national ID or passport number, and in some cases a photograph of the document, because airlines, hotels and consulates require them from us before they will issue the booking.
• A contact phone number and anything you ask the hotel for, both of which travel to the supplier with the booking.
• Details of the people traveling with you.

The national ID and the images of documents are sensitive data. We keep them in a private store that can only be reached through signed links expiring in one hour, and only the agency staff handling your booking can open them.

When you pay

• We do not store your full card number or its security code. Card details are entered directly in the payment gateway and never pass through our servers.
• From the gateway we only receive and store the result of the transaction: amount, currency, status, authorization code, card brand and the last digits, so that we can identify your payment and issue the invoice.

When you use the AI planner

• The destination, the length of the trip, the number of travelers and your preferences.
• Your IP address, which we use only to prevent abuse of the free service (one plan every so often per connection).

Data collected on its own

• Strictly necessary cookies, described in section 6.
• Technical logs from our hosting provider (IP address, date and time, browser), needed to run the site and spot attacks.

We use no analytics and no advertising cookies, and we do not sell your data to anyone.

3. What we use your data for, and on what legal basis

• Handling your booking or quote — performance of the contract, or of the pre-contractual steps you ask us for.
• Issuing invoices and applying tax withholdings — compliance with our tax obligations to the SRI, Ecuador's tax authority.
• Contacting you by WhatsApp, email or phone about your trip — performance of the contract.
• Keeping your account and your booking history — performance of the contract.
• Preventing fraud and abuse of the service — the agency's legitimate interest.
• Sending you promotions, if we ever do — only with your prior consent, which you can withdraw whenever you like.

4. Who we share your data with

We share the bare minimum, and only with those who are needed for the trip to happen. None of them may use your data for their own purposes.

• Travel suppliers — airlines, hotels and the booking house Restel (Grupo Hotusa, Spain). They receive the traveler details needed to issue the booking.
• Payment gateways — Payphone (Ecuador) and PayPal. They process the charge under their own privacy policies.
• Vercel (United States) — site hosting.
• Database and storage provider — keeps booking information and the documents you upload, encrypted at rest.
• Resend — sending the confirmation emails.
• Google (Gemini) — generates the planner's itineraries. It only receives the destination and the preferences for the trip. We never send it your name, ID number, contact details or payment data.
• Authorities — when a law or a court order obliges us to.

Transfers outside Ecuador

Several of these providers run servers outside the country. When we hire them we require contractual clauses guaranteeing a level of protection equivalent to the one the LOPDP demands. If you book a trip abroad, your traveler details necessarily travel to the destination country, because the supplier who will look after you requires it.

5. How long we keep it

• Bookings and invoicing: seven years from issue, as tax law requires.
• Images of identity documents: only while the booking needs them; they are deleted afterwards.
• Quotes that come to nothing: up to two years, so we can pick the conversation back up.
• User account: for as long as you keep it open. If you close it, we delete whatever we are not obliged to keep.
• AI plans and the IP addresses tied to them: purged periodically; the IP is there only for abuse control.

6. Cookies

We use strictly necessary cookies only. They need no consent because the site does not work without them, and they cannot be used to profile you:

• vt_locale — remembers whether you prefer Spanish or English.
• Customer session cookie — keeps you signed in so that you can see your bookings.
• vt_agent_session — the session of the agency's staff in the internal panel. It is never set for visitors.

Your browser also keeps two things on your own device, neither of which is sent anywhere by itself: that you dismissed the notice saying the site is also available in English, and — only while the tab stays open — what you typed into an unfinished booking, so that we do not have to ask you for it again if the payment fails or you reload the page.

You can delete all of it from your browser whenever you like; you will lose your session and your language preference, nothing more.

7. How we protect your data

• All traffic on the site is encrypted with HTTPS.
• Passwords are stored as a bcrypt hash, never in plain text.
• Identity documents live in private storage behind signed links that last one hour.
• The internal panel requires authentication and limits each action to the advisor's role.

No system is infallible. If a security breach were to put your rights at risk, we will notify you and the supervisory authority within the time limits the law sets.

8. Your rights

The LOPDP gives you the right to:

• Access the data we hold about you.
• Correct whatever is wrong or incomplete.
• Delete it, when it is no longer needed.
• Object to certain kinds of processing.
• Temporarily suspend the processing while a complaint is being resolved.
• Portability: receive your data in a structured, commonly used format.
• Withdraw your consent at any time, without that affecting what has already been processed.
• Not be subject to automated decisions that have legal effects. To be clear: the AI planner only suggests itineraries — it does not set prices, approve payments or turn customers away.

To exercise them, write to us at soporte@viajetrek.com saying which right you want to exercise and attaching something that proves your identity. We reply within fifteen days at the most.

If we do not reply, or you are not satisfied with the reply, you can complain to Ecuador's Superintendency of Personal Data Protection.

9. Minors

We do not open accounts for anyone under 18. We do process minors' data when they travel as companions, and in that case it is given to us by the responsible adult, who declares that they are entitled to do so.

10. Changes to this policy

If we change anything that matters, we will update the date in the header and, if the change affects you significantly, we will tell you by email.