1. Who processes your data

• The xtravel.cloud Platform, run by [RAZÓN SOCIAL DE LA PLATAFORMA] (NIT [NIT DE LA PLATAFORMA], address [DOMICILIO DE LA PLATAFORMA]), is the controller of your member account data, of sign-in (code or Google), of the operation and security of the site, of reviews and of the complaints you file with it.
• Each advertiser (hotel, tour operator or other tourism provider, the “Advertiser”) is an independent controller of the data you send it when you ask for information or a booking about its listing, from the moment it receives it, because it decides how to use it to answer you and provide the service. Its identity appears in the listing and in the confirmation of your request. Its processing is governed by its own privacy policy and by the law, and the Platform does not control what it does with the data beyond the rules it imposes in the Advertiser terms.

The Platform acts as an intermediary: it forwards your request to the Advertiser you choose and, until that delivery, is responsible for that data.

Contact for the Platform’s privacy matters: [CORREO DE CONTACTO DE LA PLATAFORMA].

2. Legal framework

Bolivia recognises the right to privacy and to one’s own image and dignity in the Political Constitution of the State (article 21) and protects personal data through the Privacy Protection Action, or habeas data (article 130). For the digital environment, Law 164 and Supreme Decree 1793 also apply, and Law 453 applies to the consumer relationship.

At the date of this text we are not aware of a general, specific Bolivian personal data protection law. This policy was written with the usual principles: lawfulness, purpose limitation, proportionality, accuracy, security and confidentiality. As a courtesy, for visitors from the European Economic Area and the United Kingdom, the rights of the General Data Protection Regulation (GDPR) are also recognised, as described in section 9.

3. Data we collect

Situation	Data
Booking request (sent to the Advertiser of the listing)	Name, phone and email (optional depending on the form), circuit, desired date, number of adults and children, rooms and room preference, free-text notes and confirmation of your consent. A reference code is generated.
Member account	Email address, full name and optional phone. With Google, the basic profile data Google shares with the identity service (email and name).
Session	Session identifiers in secure cookies (see the Cookie policy).
My trip and passport	Your requests and their status, stamps earned and rewards redeemed.
Reviews	Rating, title, text, display name and your consent to publish the name.
Complaints	Related request, subject and description.
Contact through WhatsApp	If you choose to write through WhatsApp, your number and the message you send, which WhatsApp and the Advertiser process under their own conditions.
Technical data	IP address, browser type, access date and time and error logs, needed to run and protect the service.

The virtual guide answers in your own browser with frequently asked questions. At the date of this text it does not send your questions to any server or to artificial intelligence models. If that changes, we will tell you beforehand and update this policy.

We do not ask for payment card data on this site. Payment is coordinated by each Advertiser through the means it gives you.

We do not deliberately collect sensitive data. If you type it in a free-text field (for example, a health condition or an allergy so the Advertiser can adapt the service), we will process it only for that purpose and with your consent.

4. What we use the data for and on what basis

Purpose	Basis
Receive your request, forward it to the Advertiser and communicate with you	Performance of a contract or pre-contractual steps at your request, and your consent when sending the form
Create and maintain your account, authenticate you and keep your session	Performance of the service you asked for
Show your trip, stamps and rewards	Performance of the service you asked for
Publish reviews and display your name	Your consent, which you can withdraw
Handle reports and complaints and meet the Platform’s legal obligations (consumer protection, tax, requests from authorities)	Legal obligation
Security, fraud and abuse prevention, usage limits and diagnostics	Legitimate interest, respecting your rights
Improve the site with aggregated information	Legitimate interest. At the date of this text the site uses no analytics tools

The Platform does not sell your data or use it for automated decisions with legal effects on you. We do not send advertising without your consent.

5. Who we share it with

• The Advertiser to which you address your request receives the form data needed to answer you (name, contact details, dates, people, notes). It does so as an independent controller (section 1). The data is shared only with the Advertiser of the listing you write about, not with others, and the Platform does not give Advertisers account data that is not needed for that request. Advertisers undertake to use it only to answer your request and not to send you advertising without your consent.
• Platform providers that host the site, store information, send the email with your sign-in code and deliver images and videos. They act on our behalf and under a duty of confidentiality. Current or planned providers: [LISTA DE PROVEEDORES: HOSTING, CORREO, ALMACENAMIENTO].
• Google, only if you choose to sign in with your Google account, under Google’s privacy policy.
• Authorities, when a rule or a court or administrative order requires it.
• Third parties that provide the service (hotels, carriers, guides), through the Advertiser you contracted, only with the data needed. The Advertiser decides that communication.

Links to maps (OpenStreetMap, map apps) and to WhatsApp leave the site: once opened, the third party applies its own policy.

6. International transfers

The Platform’s servers and providers may be outside Bolivia ([PAÍS O REGIÓN DE ALOJAMIENTO]). When your data is transferred to another country, we seek providers that offer equivalent security and confidentiality guarantees and limit the transfer to what is necessary. For visitors from the EEA or the UK, the transfer mechanism will be [CLÁUSULAS CONTRACTUALES TIPO U OTRO MECANISMO].

7. How long we keep it

Data	Indicative period
Requests sent from the Platform	[N] years from sending or until the complaint is closed, to handle reports and legal obligations. Each Advertiser sets the period for its own copy
Member account	While the account is active and up to [N] months after it is closed
Published reviews	While published. The name is removed if you withdraw your consent
Complaints	[N] years from their closure
Technical logs	[N] days
Session	Until it expires or you sign out

Once the periods end, data is deleted or anonymised, unless the law requires keeping it.

8. Security

We apply reasonable technical and organisational measures: encrypted connections, protected session cookies that the browser does not expose to scripts, passwordless sign-in for new accounts, role-based restricted access and usage limits against abuse. No system is infallible. If an incident significantly affecting your data occurs, we will tell you and notify the authority where appropriate.

9. Your rights and how to exercise them

You may, regarding your data:

• Access it and know how it is processed.
• Rectify it if it is inaccurate or incomplete.
• Cancel it or ask for its deletion when it is no longer needed or you withdraw consent.
• Object to processing based on legitimate interest or to uses you did not consent to.
• Port it, receiving it in a structured format, when processing is automated and based on consent or contract.
• Withdraw your consent at any time, without affecting what was processed before.

To exercise them, write to [CORREO DE CONTACTO DE LA PLATAFORMA] from your account’s email (for data held by the Platform) or to the relevant Advertiser (for data you sent it), stating which right you are exercising. We may ask for an additional detail to confirm your identity. We reply within [N] business days at most.

If you believe your rights were not respected, you may bring a Privacy Protection Action before the Bolivian judicial authority (Constitution, article 130) and go to the consumer protection authority. Visitors from the EEA or the UK may also lodge a complaint with their data protection authority.

10. Minors

The site is not aimed at people under 18 and accounts are for adults. Data of children and teenagers who travel is provided to the Advertiser by their parent or guardian, who declares having authority to do so. If we find data of a minor given without that authority, we will delete it.

11. Cookies and local storage

The detail of what the site stores in your browser is in the Cookie policy.

12. Changes to this policy

We may update this policy. The date and version appear at the top. If a change is significant, we will announce it on the site or by email, and if it requires your consent, we will ask for it again.

13. Contact

[RAZÓN SOCIAL DE LA PLATAFORMA], [DOMICILIO DE LA PLATAFORMA], [CORREO DE CONTACTO DE LA PLATAFORMA], [TELÉFONO DE CONTACTO DE LA PLATAFORMA].

To exercise rights over data held by an Advertiser, contact it through the channels in its listing. If it does not answer, the Platform can help you route the request.