Legal · Your data, plainly
Privacy and cookies
We are a small tour operator, and we collect the minimum we need to take you to the valley and back: who you are, how to reach you, where to pick you up. This page says what that is, why we keep it, who else sees it, and what you can ask us to do with it. It is written to comply with Bolivian law and, because many of our guests are European, with the EU General Data Protection Regulation (GDPR).
Last updated 15 September 2026. Items marked [under review] are being confirmed with our legal advisor and will be completed here.
1. Who is responsible for your data
The data controller is Fat Cat Valle de las Animas Tours, operating brand of Visit South America, Figueroa 760, La Paz, Bolivia. Legal entity and NIT: [under review — registration in progress]. Contact for anything in this policy: fatcat@valledelasanimas.com. We are a small company and have not appointed a data protection officer; the person answering that address is responsible for your request.
EU representative under GDPR Article 27: [under review — to be confirmed whether required and appointed].
2. What we collect and why
- When you write to us (WhatsApp, email): your name, phone number or email, and what you wrote. To answer you and quote a tour.
- When you book: full names of the travellers, a phone number, your hotel or address in La Paz, your tour and date, and your nationality and passport number — required by Bolivian tax rules to issue the tourist invoice (factura turística) for international visitors. To run the tour, pick you up, confirm the reservation and comply with tourism and tax rules.
- Health information you volunteer (altitude, pregnancy, heart or lung conditions, medication, allergies): only what you choose to tell us, only to keep you safe on the tour. This is sensitive data under GDPR; we process it with your explicit consent, given when you tell us, and you can ask us to delete it after the tour.
- Payment: processed by PayPal, Stripe or WeTravel. We receive a confirmation and the last digits of a card at most; we never see or store your full card number.
- Photos: taken by our guides during the tour, shared with you; used on our website and social media only if you have not told us you prefer otherwise (see terms, section 11).
- Website: this website sets no analytics or advertising cookies and does not track you. Our hosting provider (Cloudflare) receives your IP address and browser information to deliver the pages and protect against abuse, as any web server does. We use Cloudflare Web Analytics, a measurement without cookies or identifiers that counts visits and page speed and cannot recognize any person. See section 8.
3. Legal basis (GDPR)
- Contract (Art. 6(1)(b)): everything needed to quote, book and run your tour.
- Legal obligation (Art. 6(1)(c)): tax records, invoices, and any passenger information Bolivian tourism regulation requires.
- Legitimate interest (Art. 6(1)(f)): keeping our website secure, answering complaints, keeping booking records to defend claims.
- Consent (Art. 6(1)(a) and Art. 9(2)(a)): health information you volunteer; use of your image; any marketing (we currently send none).
5. International transfers
We are in Bolivia, so if you are in the EU your data leaves the EU when you write to us. The processors above (PayPal, Stripe, WeTravel, Meta, Cloudflare, Google) are established in the United States and rely on the EU–US Data Privacy Framework or standard contractual clauses. Bolivia has no EU adequacy decision; our safeguard is collecting the minimum, keeping it briefly, and the contractual terms in this policy. [under review — standard contractual clauses wording to be confirmed with legal advisor]
6. How long we keep it
- Enquiries that do not become a booking: 30 to 60 days, then deleted.
- Booking records and invoices: as long as Bolivian tax and commercial law require us to keep them [under review — exact statutory period to be confirmed with our accountant].
- Health notes: deleted after the tour, unless you ask us to keep them for a future booking.
- Photos: kept while we use them; removed from our channels on request.
- WhatsApp conversations: on the phones we use for sales and operations, deleted 30 to 60 days after your tour.
7. Your rights
Under GDPR (and to the extent recognised by Bolivian law) you can ask us to: access what we hold about you; correct it; delete it (except what the law obliges us to keep); restrict or object to a use; receive it in a portable format; and withdraw consent at any time for anything based on consent, without affecting what was done before. Write to fatcat@valledelasanimas.com; we answer within one month. If you are in the EU and are not satisfied, you may complain to your national data protection authority.
9. Security
Booking data lives in the email and messaging accounts of a small team, protected by two-factor authentication, and in the systems of the payment processors named above. The website is served over HTTPS with DNSSEC. We keep the minimum and we keep it briefly; that is our main safeguard. If a breach ever affected your data we would tell you and, where required, the authorities, without undue delay.
10. Children
We take bookings from adults only. Children's names are collected as part of a parent's or guardian's booking and used for nothing else.
11. Changes to this policy
We will update this page when our practices change and note the date at the top. Substantial changes affecting bookings already made will be sent to the contact you gave us.