Last updated: October 17, 2026

This Policy clearly explains how Viajes Alkimista collects, uses, shares, retains and protects personal data, and how individuals may exercise their rights.

1 Data Controller

Data Controller: Gerardo Emilio Gonzalez | Trading name: Viajes Alkimista | CUIT 20-22979561-1 | DNT Travel Agency Registration No. 10352 | Allende 4132, CABA (C.P. 1419), Buenos Aires, Argentina | accounts@viajesalkimista.com | +54 11 5032 2554 | www.viajesalkimista.com

2 Scope

This Policy applies to personal data processed through the website, forms, email, WhatsApp, social media, the passenger's private account area, and throughout the enquiry, booking, payment and delivery of travel services.

3 Personal Data We May Process

Depending on the interaction and the services requested, we may process identification and contact details; billing and payment information; enquiry or booking information; travel preferences; date of birth, nationality and country of residence; passport number, expiry date and copy; and health, dietary or accessibility information that is strictly necessary to arrange the requested services.

To verify payment authorisation and prevent fraud or chargebacks, we may also process a cardholder responsibility or authorisation form and a masked image of the card used. The image must display only the cardholder's name and the last four digits; all remaining digits and the security code must be concealed. Viajes Alkimista will never request or retain the card security code or the complete card number.

Fields marked as required are necessary to process the request or arrange the trip. Failure to provide the required information or documentation, or the provision of inaccurate information, may prevent or delay a quotation, booking, payment verification or service. It may also result in the suspension or cancellation of the transaction when verification is not possible.

4 Purposes of Processing

• Responding to enquiries and preparing proposals or quotations.
• Managing registrations, bookings, payments, documentation and the delivery of travel services.
• Verifying the identity and authorisation of the payment method holder, preventing fraud, and handling claims, chargebacks or payment disputes.
• Sharing the necessary information with service providers involved in the trip.
• Complying with legal, tax, accounting and contractual obligations.
• Managing subscriptions, webinars, groups, newsletters and campaigns where consent or another valid legal basis applies.
• Maintaining the security of the website, private account area and travel files, and recording privacy preferences.

5 Legal Bases for Processing

Personal data is processed with the data subject's consent where appropriate, to take requested pre-contractual steps or perform requested services, to comply with legal obligations and, where permitted, on the basis of legitimate interests that are not overridden by the rights of the individual. Fraud prevention, payment verification and the defence of claims will be limited to the information necessary for those purposes. Consent to marketing is voluntary and separate from the management of an enquiry or booking.

6 Recipients and Processors

Where necessary, personal data may be disclosed to airlines, hotels, destination management companies, transport providers, travel assistance companies, excursion providers, payment service providers and other participants in the contracted services. Technology and administrative providers may also process data, including, where applicable, GetResponse, WordPress and WooCommerce, hosting and secure storage services, Microsoft, WhatsApp, Stripe, Cecabank, banking institutions and accounting professionals. Each recipient will process the data according to its role and the applicable law.

We use attachmentAV, a service provided by widdix GmbH in Germany, as a technology provider for file malware scanning.

7 International Data Transfers

Travel operations and the use of service providers with international infrastructure may require personal data to be processed or disclosed outside Argentina. Viajes Alkimista will limit such transfers to what is necessary for the stated purpose and will apply the safeguards required by the destination and the applicable law.

8 GetResponse and Marketing Communications

GetResponse may be used for forms, registrations, operational communications, subscriptions, webinars, groups, newsletters and marketing. Registration for an activity or submission of an enquiry does not, by itself, constitute consent to receive promotional communications. Every marketing communication will include an unsubscribe mechanism, and subscriptions may also be cancelled by writing to accounts@viajesalkimista.com.

9 Retention

Data and documents relating to an enquiry, booking, trip, payment, fraud-prevention review or cardholder authorisation will be retained for 24 months from the completion of the trip or, if later, from the last transaction connected with the booking. At the end of this period, passport copies, authorisation forms and masked card images will be securely deleted unless an outstanding claim, chargeback, dispute, investigation or legal obligation justifies retention until it is resolved.

Tax, accounting and contractual records may be retained for any longer period required by applicable law. Data used solely for marketing will be retained until the individual unsubscribes or withdraws consent, after which only the record necessary to honour that decision will be kept.

10 Security and Confidentiality

Reasonable technical and organisational measures are implemented to prevent unauthorised access, loss, alteration, misuse or disclosure. Access is restricted to persons who need the information for the relevant purpose and is recorded within the passenger's private travel file.

Passport copies, authorisation forms and masked card images must be uploaded through the private link or secure channel provided by Viajes Alkimista. Complete card numbers and security codes must never be submitted. No Internet-connected system can guarantee absolute security.

Files uploaded to the private area are sent over an encrypted connection to attachmentAV in the European Union for malware scanning before they are added to the travel file. According to the provider's documentation, files are temporarily stored in encrypted form during scanning and deleted afterwards; the scan result is retained. If a threat is detected or scanning cannot be completed, the file is not added to the travel file. This check does not confirm identity, document authenticity or receipt of payment.

11 Individual Rights

Individuals may request access to, updating, rectification or deletion of their personal data and may withdraw consent where applicable. Requests should be sent to accounts@viajesalkimista.com and may be subject to reasonable identity verification. Access is provided free of charge at the intervals established by Argentine Law No. 25,326.

12 Supervisory Authority

Argentina's Agency for Access to Public Information is the supervisory authority responsible for enforcing Law No. 25,326 and receiving complaints from individuals who believe their rights have been affected. Information: www.argentina.gob.ar/aaip. Registration reported by the Data Controller: RL-2018-56294154-APN-DNPDP#AAIP. The registered address is pending administrative update.

13 Application of the GDPR

Where the European Union General Data Protection Regulation applies to a specific processing activity, the individual will also have the applicable rights and safeguards, including restriction, objection, data portability and the right to lodge a complaint with the competent supervisory authority. Applicability is determined according to the circumstances of each processing activity.

14 Minors

Personal data relating to minors may be processed where necessary for a booking or family trip and will be used solely to arrange and provide the services. Marketing forms are not specifically directed at minors.

15 Cookies and Third Parties

The use of cookies is explained in the Cookie Policy. Links to airline, hotel, social media and other third-party websites are also governed by the policies of their respective operators.

16 Changes and Contact Details

The current version of this Policy will be published at www.viajesalkimista.com together with its last-updated date. For questions or to exercise your rights, contact accounts@viajesalkimista.com, WhatsApp +54 11 5032 2554 or the address stated in section 1.