Privacy Policy


Table of Contents

I. Privacy Policy and Data Protection

a. Laws incorporated in this Privacy Policy
b. Identity of the Data Controller
c. Registry of Personal Data
d. Principles applicable to the Processing of Personal Data
e. Categories of Personal Data
f. Purposes of Processing
g. Legal Basis for the Processing of Personal Data
h. Retention Periods for Personal Data
i. Recipients of Personal Data
j. International Transfers of Personal Data
k. Confidentiality and Security of Personal Data
l. Rights of the Data Subject
m. Claims before the Supervisory Authority

II. Program Admission Age and Protection of Minors

II.1 Program admission age
II.2 Protection of minors under Peruvian law

III. Acceptance and Changes in this Privacy Policy

I. Privacy Policy and Data Protection
Your privacy is very important to us. In this Privacy Policy we explain how we collect, use, disclose, transfer and store your personal information, in accordance with applicable Peruvian law.
Asociación Irake para la Amazonia (the "Association"), as the entity behind the irake-project.org website (the "Website") and the organizer of the Programs offered to its Members, undertakes to adopt the technical and organisational measures necessary, at the level of security appropriate to the risks of the personal data collected.
This Privacy Policy forms an integral part of the Terms and Conditions of the Program published on the Website (https://irake-project.org/tc) and of the Participant Agreement and Informed Consent (Waiver) signed by the Participant prior to participation.
a. Laws incorporated in this Privacy Policy
This Privacy Policy is adapted to Peruvian legislation in force regarding the protection of personal data. In particular, it complies with the following rules:
  • Article 2, paragraph 6 of the Political Constitution of Peru, which recognises the right of every person to ensure that information services do not provide information affecting personal and family privacy.
  • Ley N° 29733, Ley de Protección de Datos Personales (Personal Data Protection Law).
  • Decreto Supremo N° 003-2013-JUS, Reglamento de la Ley N° 29733 (Regulation of the Personal Data Protection Law).
  • Resolución Directoral N° 019-2013-JUS/DGPDP, Directiva de Seguridad de la Información administrada por los bancos de datos personales (Information Security Directive).
  • The Reglamento de Infracciones y Sanciones, and any subsequent updates, administered by the Autoridad Nacional de Protección de Datos Personales (ANPDP).
  • Ley N° 29571, Código de Protección y Defensa del Consumidor, to the extent applicable to Participants treated as consumers.
b. Identity of the Data Controller
The party responsible for processing the personal data collected through the Website and in connection with the Programs is:
Asociación Irake para la Amazonia, a non-profit civil association registered in the Registro de Personas Jurídicas de Lima (the "Data Controller" or "Association").
Contact details:
  • Email: Asociacion-Irake@pm.me
  • Website: https://irake-project.org
For matters specifically related to administrative registration, payment processing and ancillary logistics of the Programs, certain operational data may also be processed by an independent commercial entity (the "Operator"), in accordance with Section 16 of the Terms and Conditions. For services provided by Partner Providers (such as independent screening professionals), processing is governed by each Partner Provider’s own privacy notice and contracts.
The Association and the Operator may, depending on the nature of the operations involved, act either as independent controllers or may jointly determine certain operational purposes and means of processing, in each case under applicable Peruvian law.
c. Registry of Personal Data
In compliance with Ley N° 29733 and its Reglamento, the personal data collected by the Association through the Website forms or through the registration, screening, payment and communication channels related to the Programs are incorporated into and processed in personal data banks (bancos de datos personales) maintained by the Association, in accordance with the requirements of Peruvian data protection legislation.
These data banks are maintained for the purpose of facilitating, administering and complying with the commitments established between the Association and the Member or applicant, and for handling any request, query or communication from the Participant.
d. Principles applicable to the Processing of Personal Data
The processing of the Participant’s personal data is subject to the principles set out in Title I, Chapter II of Ley N° 29733, in particular:
  • Principle of legality. The collection of personal data shall be carried out by lawful means and shall not be conducted by fraudulent, unfair or unlawful means.
  • Principle of consent. Personal data shall be processed only with the free, prior, express, informed and unequivocal consent of the data subject, except in cases expressly provided by law.
  • Principle of purpose. Personal data shall be collected for determined, explicit and lawful purposes, and shall not be processed in a manner incompatible with such purposes.
  • Principle of proportionality. Processing shall be adequate, relevant and not excessive in relation to the purposes for which the data are collected.
  • Principle of quality. Personal data shall be truthful, accurate, where necessary updated, and necessary for the purposes for which they are processed.
  • Principle of security. The Association adopts the technical, organisational and legal measures necessary to ensure the security of personal data and to prevent their alteration, loss or unauthorised processing or access.
  • Principle of an adequate level of protection. Any international transfer of personal data shall comply with an adequate level of protection as required by Article 15 of Ley N° 29733.
  • Principle of being subject to recourse. The Participant has the right to file claims before the ANPDP.
e. Categories of Personal Data
The categories of personal data processed by the Association may include both ordinary identifying data and sensitive personal data within the meaning of Article 2, paragraph 5 of Ley N° 29733 (such as data relating to physical or mental health, biometric data, and other categories expressly classified as sensitive under applicable law).
In particular, the Association may collect the following:
  1. Identification and contact information. First and second surnames, given names, date of birth, nationality, identification document or passport number, residential address, email address, mobile phone number (with country code), and any other contact data provided by the Participant in the registration, screening or communication forms.
  2. Health information (sensitive data). Information regarding the physical and mental health of the Participant, including but not limited to: allergies, blood pressure range, medical history, frequency of consumption of alcohol, recreational drugs, tobacco or other substances, dietary information, exercise practice, information on consumption of antidepressants, anxiolytics, mood stabilisers, antipsychotics, lithium or any other prescription or over-the-counter medication, pregnancy status, periodicity of medication intake, mental health diagnoses or conditions, family history of mental illness, and any other data that may reveal the physical or mental state of health of the Participant. Health data also include data which may be used to infer or detect the health status of a person.
  3. Special practice and lifestyle data. Information regarding prior experience with master plants, traditional ceremonial practices, dietary preferences, and lifestyle factors relevant to safety screening.
  4. Payment and financial information. Billing address, payment method, bank or card details, and any other financial information necessary to administer contributions, processed primarily through the Operator and through external payment processors.
  5. Image, voice and audiovisual recordings. Photographs, audio recordings and video recordings captured during the Program, in accordance with the box ticked by the Member in Section XII of the applicable Waiver and Section 17.2 of the Terms and Conditions.
  6. Communications data. Records of communications between the Participant and the Association or the Operator, including email correspondence, messages on third-party messaging platforms (where the Participant chooses such channels), responses to questionnaires, and notes from preparation or follow-up calls.
  7. Web and technical data. Technical data automatically collected when the Participant visits the Website, including IP address, browser type, device data, pages visited, and basic analytics. Cookies and similar technologies are managed through the consent banner available on the Website, where the Participant can review and adjust their cookie preferences at any time.
The Association does not process sensitive personal data without the express written consent of the Participant, granted for one or several specific purposes. The Participant is not obliged to provide all personal data requested. However, if the Participant chooses not to provide it, the Association may be unable to admit the Participant to a Program or to ensure their safety, in which case the Association reserves the right not to accept the registration.
f. Purposes of Processing
The Association may process the personal data of the Participant for the following purposes:
  1. To carry out the suitability review (screening) and to assess the cultural safety suitability and participation compatibility of the applicant for participation in a specific Program, as described in Section 4 of the Terms and Conditions.
  2. To administer the membership of the Participant in the cultural Program (granted under Articles 4.15 and 4.17 of the Estatuto of the Association), including registration, communications, organisation of activities and post-Program follow-up.
  3. To administer contributions, payments and accounting, in cooperation with the Operator and external payment processors.
  4. To organise the logistics of the Program, including accommodation arranged with licensed hospitality establishments and transport.
  5. To coordinate the participation of Partner Providers and to share with them only the data strictly necessary for their independent services, where the Participant has accepted such services with the relevant Partner Provider.
  6. To prepare the Participant for the traditional ceremonies and dietas (informational and educational materials, contraindication information, dietary guidelines).
  7. To respond to emergencies and to protect the life, health and physical integrity of the Participant and of other Members, including communication with emergency contacts, medical facilities or competent authorities where strictly necessary.
  8. To comply with legal, regulatory, accounting, tax and administrative obligations applicable to the Association in Peru.
  9. To send the Participant communications about the Programs, news of the Association and similar activities, by email or by other channels designated by the Participant, provided that the Participant has expressly consented to receive such communications, with the right to withdraw consent at any time.
  10. To produce and share, within a restricted-access group intended only for Members of the relevant Program, photographs and audiovisual recordings of the Program (as described in Section 17.2 of the Terms and Conditions and Section XII of the Waiver).
  11. To use photographs of the Participant for informational, educational and communication purposes related to the Programs, only when the Participant has expressly authorised such use in the Waiver. Where the Participant has not authorised, the Association shall use such photographs externally only if the face of the Participant is fully and recognisably obscured.
  12. To defend the legitimate interests and rights of the Association in case of disputes, claims, judicial or administrative proceedings.
g. Legal Basis for the Processing of Personal Data
The legal bases for the processing of personal data, in accordance with Ley N° 29733, are the following:
  1. Express, informed and unequivocal consent of the Participant, granted in writing through the registration form, the screening questionnaire, the Waiver, the box ticked in Section XII of the Waiver, and the acceptance of the Terms and Conditions and of this Privacy Policy. This is the primary legal basis for the processing of identification, health and image data.
  2. Necessity for the execution of contractual relationships between the Participant and the Association (and, where applicable, the Operator), under the exceptions provided in Article 14 of Ley N° 29733, for the purpose of administering the membership, the contributions and the logistics of the Program.
  3. Compliance with a legal, regulatory, tax or administrative obligation to which the Association is subject under Peruvian law.
  4. Protection of vital interests of the Participant or of any other Member, in particular in emergency situations affecting the life, health or physical integrity of the data subject, including the retention and review of past safety screening information in subsequent registrations.
The Participant has the right to withdraw consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to the withdrawal. Withdrawing consent may prevent the Association from administering the Program or from ensuring the safety of the Participant, in which case the Association may decline or terminate participation in accordance with the Terms and Conditions.
h. Retention Periods for Personal Data
Personal data shall be retained only for the period strictly necessary to fulfil the purposes for which they were collected, in accordance with the following criteria:
  • Identification, contact and registration data, payment data and communications related to the contractual relationship: retained for ten (10) years from the end of the Program, in accordance with the general statutory limitation period for personal contractual actions under Article 2001, paragraph 1 of the Peruvian Civil Code.
  • Health and sensitive data collected through the screening questionnaire and the Waiver: retained for ten (10) years from the end of the Program, for purposes of safety, evidence of informed consent and defence against potential claims, in accordance with Section XI of the Waiver.
  • Image and audiovisual recordings of the Program: retained for as long as the Member has not withdrawn consent and for as long as it remains relevant for the institutional, educational or communication purposes of the Association, subject to the right of withdrawal set out in Section 17.2 of the Terms and Conditions and Section XII of the Waiver.
  • Tax, accounting and administrative records: retained for the period required by Peruvian tax and accounting legislation.
  • Marketing and informational communications data: retained until the Participant withdraws consent or unsubscribes.
Once the applicable retention period has expired, the personal data shall be deleted, anonymised or, where mandatory legal retention applies, blocked under the conditions of Article 38 of the Reglamento of Ley N° 29733.
i. Recipients of Personal Data
The personal data of the Participant may be shared with the following recipients or categories of recipients, only to the extent strictly necessary for the purposes set out above:
  1. The Operator, an independent commercial entity engaged to administer registrations, contributions and ancillary logistics services in connection with the Programs.
  2. Partner Providers, such as independent screening professionals or other ancillary service providers, only with the prior consent of the Participant and only for the services that the Participant has contracted with each Partner Provider under its own terms.
  3. Facilitation Team members (maestros, cultural guides and support staff), to the extent strictly necessary to ensure the cultural and safety facilitation of the Program.
  4. Accommodation and transport providers engaged by the Operator, limited to identification data necessary for hospitality and travel coordination.
  5. External service providers acting on behalf of the Association or of the Operator, including form management platforms (Jotform and Google Forms, used for registration, screening and intake), email service providers (ProtonMail, used for direct communications), newsletter and mailing platforms (SendPulse, used for non-essential communications), analytics providers (Google Analytics, used for Website traffic analysis), and payment processors engaged by the Operator, in each case under the confidentiality and data protection terms of the relevant provider.
  6. Tax, accounting and legal advisors of the Association and of the Operator, under professional secrecy obligations.
  7. Competent authorities, including the ANPDP, INDECOPI, tax authorities, prosecutorial authorities, judicial authorities or medical authorities, where required by law or by an order of a competent authority, or where strictly necessary for the protection of the life, health or physical integrity of the Participant or of any other person.
The Association does not sell personal data to third parties and does not rent or trade personal data for commercial purposes.
j. International Transfers of Personal Data
Due to the international nature of the Programs, of the Participants and of certain service providers (such as hosting, email, form management and payment processing platforms), personal data may be transferred to, accessed from, stored or processed in countries outside Peru.
Such transfers are carried out in accordance with Article 15 of Ley N° 29733 and the corresponding provisions of its Reglamento. The primary legal basis for these transfers is the prior, express, informed and unequivocal consent of the Participant, given through the registration form, the Waiver and the acceptance of this Privacy Policy. Where applicable, the Association also relies on transfers to jurisdictions recognised as providing an adequate level of protection, and on the confidentiality and data protection commitments obtained from the relevant service providers under their applicable terms.
By accepting this Privacy Policy, the Participant acknowledges and consents to such international transfers for the purposes set out in this document.
k. Confidentiality and Security of Personal Data
The Association undertakes to adopt the technical, organisational and legal measures necessary, at a level of security appropriate to the risks of the personal data collected, in accordance with the Directiva de Seguridad approved by Resolución Directoral N° 019-2013-JUS/DGPDP, in order to guarantee the security of personal data and to prevent their destruction, loss, alteration, unauthorised disclosure or unauthorised access, whether accidental or unlawful.
The Website is protected by an SSL (Secure Sockets Layer) certificate, which ensures that personal data are transmitted in a secure and confidential manner between the Participant’s device and the server, in fully encrypted form. The Association may also use additional infrastructure services (such as content delivery networks and security services).
The Participant acknowledges that, notwithstanding such measures, no method of transmission over the Internet or electronic storage can be guaranteed to be completely secure. The Association undertakes to notify the Participant, without undue delay, in the event of a security breach involving the personal data of the Participant which is likely to result in a high risk to their rights and freedoms, in accordance with applicable law.
Personal data shall be treated as confidential by the Association. The Association ensures that the obligation of confidentiality is respected by its officers, employees, volunteers, contractors and by the Operator, as well as by any other person who may access the data, by means of contractual obligations or, where applicable, professional confidentiality obligations.
Participants acknowledge that certain communications may take place through third-party messaging or communication platforms (such as email or messaging applications) which may not provide the same level of confidentiality as dedicated protected systems. Participants are encouraged not to transmit highly sensitive medical documentation through informal messaging channels unless specifically requested by the Association.
The Association shall not use the image, voice, recordings or biometric characteristics of any Participant for the training of artificial intelligence systems, for the generation of synthetic media, for biometric identification or facial recognition systems, or for similar machine-learning, profiling, biometric analysis or synthetic media purposes, without the separate, explicit and written consent of the Participant.
l. Rights of the Data Subject
In accordance with Title III of Ley N° 29733, the Participant has the following rights with respect to their personal data (the so called ARCO rights and additional rights):
  1. Right of information. To be informed in advance, in a clear, express and unequivocal manner, of the existence and identity of the controller, the purposes, the recipients and the rules of the processing.
  2. Right of access. To obtain from the Association confirmation as to whether personal data concerning the Participant are being processed and, where applicable, access to such data and to information about the processing.
  3. Right of rectification. To request that inaccurate, incomplete or outdated personal data be rectified, completed or updated.
  4. Right of cancellation (deletion). To obtain the deletion of personal data when such data are no longer necessary for the purposes for which they were collected, when the Participant has withdrawn consent and there is no other legal basis for processing, when the data have been processed unlawfully, or in the other cases provided by law.
  5. Right of opposition. To object, at any time and on legitimate grounds, to the processing of personal data, including processing for advertising or marketing purposes.
  6. Right to revoke consent. To withdraw, at any time, the consent previously granted for the processing of personal data, in a manner as easy as it was to grant such consent.
  7. Right to objective processing. Not to be subject to a decision producing legal effects, or significantly affecting the Participant, based solely on the automated processing of their personal data (including profiling), unless otherwise permitted by law.
  8. Right to be subject to recourse. To file claims before the ANPDP.
The Participant may exercise these rights free of charge, in accordance with the procedure set out in the Reglamento of Ley N° 29733, by sending a written request to the following email address:
  • Email: Asociacion-Irake@pm.me
  • Subject line: "Ley N° 29733 / Solicitud ARCO / irake-project.org"
The request must include:
  • Full name of the Participant and a copy of the national identity document, foreign resident card or passport. Where the Participant is represented, identification of the representative and of the document certifying the representation must also be provided.
  • Specific subject matter of the request, indicating the right being exercised and the personal data concerned.
  • Address (postal or email) for notification purposes.
  • Date and signature of the requester.
  • Any document supporting the request.
The Association shall respond to the request within the maximum legal time periods (in particular, twenty (20) business days for requests of access, and ten (10) business days for requests of rectification, cancellation or opposition, in accordance with the Reglamento of Ley N° 29733), without prejudice to the possibility of a single extension where the complexity of the request so requires.
m. Claims before the Supervisory Authority
If the Participant considers that the processing of their personal data infringes Peruvian data protection legislation, the Participant has the right to file a claim before the supervisory authority, that is, the ANPDP of the Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales of the Ministerio de Justicia y Derechos Humanos.
Information on how to file a claim is available at: https://www.gob.pe/minjus
Where the rules of Ley N° 29571, Código de Protección y Defensa del Consumidor, apply, the Participant also has the right to file a complaint before INDECOPI in matters of consumer rights related to the Program.
II. Program Admission Age and Protection of Minors
II.1 Program admission age
Participation in the Programs is reserved to persons aged twenty one (21) years or older, as established by the Association in Section 4.5 of the Terms and Conditions and Section II.7 of the Waiver. This is a business and safety rule of the Association and does not constitute a child-protection threshold under Peruvian law. No person under twenty one (21) years of age may register for a Program or be admitted to a Program.
II.2 Protection of minors under Peruvian law
Under Peruvian law, a minor (menor de edad) is any person under eighteen (18) years of age. The Association does not direct the Website or the Programs to minors and does not knowingly collect or process personal data of minors. If the Association becomes aware that it has inadvertently collected personal data of a minor without the verified consent of the parent or legal guardian, it shall delete such data without undue delay.
If a parent, legal guardian or any other person believes that the Association may hold personal data concerning a minor, please contact us at:
  • Email: Asociacion-Irake@pm.me
III. Acceptance and Changes in this Privacy Policy
The Participant must have read and accepted the conditions on the protection of personal data contained in this Privacy Policy, and must accept the processing of their personal data, so that the Association may proceed with such processing in the manner, for the periods and for the purposes indicated. The use of the Website, the acceptance of the Terms and Conditions, the signature of the Waiver and the payment of the initial contribution imply the acceptance of this Privacy Policy.
The Association reserves the right to amend this Privacy Policy to reflect operational, legal or regulatory changes. The version of this Privacy Policy in force at the time of registration shall govern the processing of the personal data of the Participant for the corresponding Program; subsequent amendments shall not apply retroactively to confirmed registrations, except where required by mandatory law. The Association recommends that the Participant consults this page periodically in order to remain informed of any update.
In the event of any inconsistency between this Privacy Policy and Section 16 of the Terms and Conditions or Section XI of the Waiver, with respect to data collected directly through the screening questionnaire, the Waiver and the registration form, the provisions of those documents shall prevail. For data collected through the Website and through other channels, this Privacy Policy prevails.

Last updated: 11 February 2026

Made on
Tilda