1. Purpose, scope and version
This policy describes how Sociedad Turismo HAE Ltda. (“Huella Andina Expeditions” or “HAE”) processes the personal data of people who visit huellandina.com, request information, book a program or take part in an activity operated by HAE.
It applies to all our service and operating channels: the website and its forms, email, the website chat, the booking and payment platforms, participant registration forms and field activities.
It is issued in compliance with Chilean Law No. 19.628 on the Protection of Personal Data, as amended by Law No. 21.719, and forms an integral part of HAE’s Terms and Conditions.
This policy is available in Spanish, English and German. In the event of any discrepancy between versions, the Spanish version prevails.
Version 1.0 · Effective from: October 31, 2026
2. Data controller
The controller of your personal data is Sociedad Turismo HAE Ltda., which operates under the trade name Huella Andina Expeditions.
| Company name | Sociedad Turismo HAE Ltda. |
| Tax ID (RUT) | 76.076.673-9 |
| Legal representative | Matías Andrés Potthoff Pugin |
| Address | V-623 km 3.8, Ensenada, Puerto Varas, Los Lagos Region, Chile |
| Contact for personal data | info@huellandina.com |
Any inquiry or request regarding the processing of your personal data, including the exercise of your rights, must be sent to info@huellandina.com with the subject line “Personal data”. This is the only channel enabled for these purposes; requests are not handled through social media, WhatsApp or telephone.
3. Data we process and where it comes from
We only request the data needed to answer inquiries, manage bookings and carry out activities safely and in accordance with the regulations on adventure tourism and protected wilderness areas.
| Category | Data | When it is collected |
|---|---|---|
| Identification | First and last name, type and number of identity document or passport, nationality, date of birth, sex | Booking and participant registration |
| Contact | Email, phone, preferred language, pick-up location (accommodation or address) | Inquiry, booking and coordination |
| Emergency contact | Name, phone and email of a person designated by the participant | Participant registration |
| Health (sensitive data) | Medical information relevant to the activity and blood type | Participant registration, with express consent (see section 5) |
| Condition and equipment | Previous experience, height, weight, shoe and clothing sizes, own or required equipment | Participant registration |
| Food | Dietary preferences or restrictions | Participant registration |
| Contract and payment | Program, dates, additional services, amounts, payment method and receipts | Booking and payment |
| Acceptances | Record of acceptance of risks, Terms and Conditions and insurance | Booking and participant registration |
| Communications | Messages by email, contact form and website chat | Any contact with HAE |
| Browsing | Technical and usage data from huellandina.com obtained through cookies and analytics tools | Visit to the website (see section 13) |
| Image | Photos and videos taken during activities | Field activities, with consent (see section 7) |
HAE does not receive or store payment card numbers. That data is processed directly by the payment platforms listed in section 8.
Source of the data
Most data is provided directly by the data subject, through the website, email or participant registration.
When a person books for a group, they also provide the data of their companions and emergency contacts. In that case, they declare that they have their authorization and have informed them of this policy.
We may also receive data from agencies or operators that book our services for their clients, and from the booking and payment platforms we use.
4. Purposes and legal bases
We process data only for the purposes listed in this table, each with its legal basis. We do not use data for purposes incompatible with them, and we do not sell or transfer it for commercial purposes.
| Purpose | Data used | Legal basis |
|---|---|---|
| Answering inquiries and preparing quotes | Identification, contact, communications | Pre-contractual steps requested by the data subject |
| Managing the booking, payments and contracted services | Identification, contact, contract and payment | Performance of the contract |
| Issuing tax documents and keeping accounts | Identification, contract and payment | Compliance with a legal obligation |
| Planning and running the activity: guide assignment, transport, accommodation, food and logistics | Identification, contact, food, contract | Performance of the contract |
| Selecting equipment and informing the guide of the group’s physical makeup, to plan safe techniques and manoeuvres (for example, short-roping) | Condition and equipment | Performance of the contract |
| Preventing and responding to incidents and emergencies in the field | Health, emergency contact | Express consent; in an emergency where the data subject cannot consent, protection of their life or physical integrity |
| Registering entry to protected wilderness areas and complying with adventure tourism regulations (CONAF, SERNATUR) | Identification, emergency contact, activity data | Compliance with a legal obligation and with the conditions of the operating permit |
| Managing the complementary accident insurance | Identification | Performance of the contract |
| Sending communications about the booking: confirmations, payment reminders and pre-activity information | Contact, contract | Performance of the contract |
| Inviting participants, after the activity, to share their experience on review platforms | Name, email | Legitimate interest; the data subject may object at any time |
| Sending HAE news, programs and offers | Name, email, language | Consent, which may be withdrawn at any time; every message includes an unsubscribe option |
| Measuring the use of huellandina.com and improving how it works | Browsing | Consent, except for strictly necessary technical cookies (see section 13) |
| Using photos and videos for promotional purposes | Image | Separate and revocable consent (see section 7) |
| Handling complaints and exercising or defending HAE’s rights | Those relevant to the case | Legitimate interest |
5. Health data
Health information is sensitive data, and we only process it with your express consent, given specifically and separately from the acceptance of the Terms and Conditions.
What data. Medical conditions, allergies, medication, injuries or other information the participant declares relevant to the activity, and their blood type.
What for. To assess the conditions for participation, take preventive measures during the activity and provide timely information to rescue and medical teams in the event of an incident.
Who has access. The guide in charge of the activity and the operations staff who need it. The registration form that CONAF requires for entry to protected wilderness areas includes the medical information relevant in the event of an incident or accident. In the event of an incident, it is also shared with rescue teams, medical facilities and the insurer, to the extent necessary.
If you do not wish to provide it. HAE requests this information from all participants. Anyone who does not wish to provide it must state so expressly in the participant registration. In that case, HAE will not be able to take preventive measures based on that information, and may make participation conditional or restrict it when the safety of the participant or the group so requires, in accordance with the Terms and Conditions.
Withdrawal of consent. The participant may withdraw their consent at any time by writing to info@huellandina.com. Withdrawal does not affect processing carried out before that date.
The retention periods for this data are set out in section 10.
6. Data of children and adolescents
We process the data of participants under 18 in their best interest and with respect for their progressive autonomy, and always with the authorization of their father, mother, legal representative or the person who has their personal care.
Who provides the data. The minor’s data and health information are provided and authorized by the responsible adult, who also signs the participation authorization required under the conditions of each program.
Health data. Consent to process the health data of any participant under 18 is given by the responsible adult, with the adolescent’s knowledge.
Images. We do not publish photos or videos in which identifiable minors appear.
Commercial communications. We do not send commercial communications aimed at minors.
7. Images and audiovisual recordings
We use photos and videos of participants for promotional purposes only with their consent, given separately, voluntarily and revocably. Declining has no effect whatsoever on participation in the activity.
Recording during the activity. Guides may take photos and videos during the program as part of the experience. Afterwards, they are sent directly to each participant, via WhatsApp from the guide or by email from HAE; no groups are used. A photo may include other members of the group, so by participating you accept that images of the activity are shared among its members.
Promotional use. With the participant’s consent, we may publish these images on huellandina.com, on our social media and in HAE’s promotional materials. Consent is requested in the participant registration, in a dedicated checkbox.
Minors. We do not publish images in which identifiable minors appear (see section 6).
Withdrawal of consent. The participant may withdraw their consent at any time by writing to info@huellandina.com. From then on we will not use their images in new publications, and we will remove those already published on channels managed by HAE within a reasonable time.
8. Recipients and processors
We only disclose personal data to those who need it to provide the service, comply with the law or respond to an emergency. We do not sell personal data.
| Recipient | What it receives | Reason |
|---|---|---|
| Guides in charge of the activity | Data of the participants in their group, including health information | Running the activity safely; they act on behalf of HAE and under a confidentiality commitment |
| CONAF | Registration form for the activity and its participants | Entry requirement for protected wilderness areas |
| MetLife | Identification of participants and, in the event of a claim, the necessary information | Complementary accident insurance, under the coverage stated in each program’s Terms and Conditions |
Outside these cases, we only disclose data to rescue teams and medical facilities in the event of an incident or accident, and to authorities when required by law.
Processors
Some providers process data on HAE’s behalf, following our instructions and without using it for their own purposes:
| Processor | Service |
|---|---|
| FieldOps | Management platform for bookings, participants, registration forms and communications |
| Anthropic | Artificial intelligence assistant in our management platform, used to manage bookings and translate content |
| Meta (WhatsApp Business) | Messaging with clients via WhatsApp |
| WeTravel | Online bookings and payments |
| Klap and Transbank (Webpay) | Card payments |
| Google (Workspace, Analytics, Tag Manager, Maps) | Email, calendars, documents and website analytics |
| Trustindex | Display of reviews on the website |
| Web hosting provider | Hosting of huellandina.com |
9. International transfers
Some of our processors store or process data outside Chile. These transfers take place because they are necessary to manage the booking and provide the contracted service, and with providers that offer contractual data protection safeguards.
| Provider | Country or region | Purpose |
|---|---|---|
| WeTravel | United States | Online bookings and payments |
| Google (Workspace, Analytics, Tag Manager, Maps) | United States and other countries where Google operates servers | Email, calendars, documents and website analytics |
| FieldOps (Google Cloud / Firebase infrastructure) | Google servers, which may be located outside Chile | Booking and participant management platform |
| Anthropic | United States | Artificial intelligence assistant and translations |
| Meta (WhatsApp Business) | United States and other countries | Messaging with clients |
| Web hosting provider (Chilean company) | Servers outside Chile | Hosting of huellandina.com |
| Trustindex | European Union | Display of reviews on the website |
| Bunny CDN | European Union, with global distribution | Delivery of website images and files |
Klap, Transbank and MetLife operate in Chile.
10. Retention periods
We keep data only for as long as necessary for the purpose for which it was collected and to comply with legal obligations. Once the period has expired, we delete or anonymize it.
| Data | Period | Reason |
|---|---|---|
| Inquiries and quotes that do not lead to a booking | 2 years from the last contact | Handling later inquiries from the same person |
| Booking, contract and payment data | 6 years from the close of the tax year | Tax and accounting obligations |
| Participant registration, registration forms and acceptance of risks | 5 years from the activity | Evidencing regulatory compliance and handling possible claims |
| Health data | 6 months from the activity, when it is also removed from the registration forms; if there was an incident, 5 years together with its records | Preventing and responding to emergencies; supporting records in the event of an incident |
| Commercial communications | Until the data subject withdraws consent | Sending news and offers |
| Images for promotional use | Until the data subject withdraws consent | Promoting HAE |
| Browsing data | According to the duration of each cookie (see section 13) | Website operation and measurement |
11. Security measures
We apply technical and organizational measures proportionate to the type of data we process, with special protection for health data and data of minors.
- Restricted access. Each person accesses only the data their role requires, through differentiated profiles on our management platform. Guides only see the data of the participants in their own activities.
- Confidentiality. Guides and collaborators who access personal data are bound by a confidentiality commitment.
- Encrypted communications. The website and our platforms transmit data over encrypted connections.
- Payments. Card data is processed directly by specialized payment providers; HAE does not receive or store it.
- Traceability. Each booking keeps a record of the changes made to it and its participants.
- Providers. We select processors that offer security and data protection safeguards.
Security breaches
If a breach affecting personal data occurs, we will report it to the Chilean Personal Data Protection Agency without undue delay. When it affects health data, data of minors or financial data, we will also notify the affected data subjects, stating the measures taken.
12. Data subject rights and how to exercise them
You may exercise the following rights over your personal data free of charge by writing to info@huellandina.com with the subject line “Personal data”.
| Right | What it means |
|---|---|
| Access | To know whether we process your data, which data, for what purpose, where it comes from and to whom it is disclosed |
| Rectification | To correct or complete inaccurate or incomplete data |
| Erasure | To request deletion of your data when it is no longer necessary, has been processed without a legal basis or you withdraw your consent, unless a legal obligation requires it to be kept |
| Objection | To object to processing based on legitimate interest, such as the invitation to leave reviews |
| Portability | To receive your data in a structured, commonly used format, or to have it transmitted to another controller |
| Blocking | To request the temporary suspension of processing while a request for rectification, erasure or objection is being resolved |
Withdrawal of consent. Where processing is based on your consent (health data, promotional images, commercial communications and non-essential cookies), you may withdraw it at any time through the same channel. Withdrawal does not affect processing carried out before.
How to submit a request. State your name, the right you are exercising and the data or processing it concerns. Write from the email address registered in your booking or attach a document proving your identity. If you are acting on behalf of another person, such as a minor child, provide proof of that representation.
Response time. We respond within 30 calendar days of receiving the request.
Complaint to the Agency. If your request is rejected or you receive no response within the deadline, you may file a complaint with the Chilean Personal Data Protection Agency.
13. Cookies and similar technologies
huellandina.com uses strictly necessary technical cookies to function and, only with your consent, analytics and third-party service cookies. When you enter the site, a notice lets you accept, reject or customize your choice by category; you can change it at any time from the cookie preferences icon or from the «Cookie preferences» link at the bottom of every page. Until you accept, Google tools run in consent-denied mode and do not set analytics cookies.
| Category | Cookie or technology | Provider | Purpose | Duration | Consent required? |
|---|---|---|---|---|---|
| Necessary | cookieyes-consent | CookieYes | Storing your cookie choice | 1 year | No |
| Necessary | PHPSESSID | huellandina.com | Maintaining the browsing session | Session | No |
| Necessary | Cloudflare Turnstile | Cloudflare | Protecting forms against automated submissions | Session | No |
| Functional | wp-wpml_current_language | huellandina.com | Remembering the chosen language | Session | No |
| Functional | Website chat | FieldOps | Keeping the conversation open while you browse | Session | No |
| Analytics | _ga, _ga_* | Google Analytics | Measuring visits and use of the site | 13 months | Yes |
| Third-party content | Google map | Google Maps | Showing our location on the contact page | Set by Google | Yes |
| Third-party content | Embedded video | YouTube (Google) | Playing the videos published on the site | Set by Google | Yes |
| Third-party content | Review widget | Trustindex | Showing reviews from Google and Tripadvisor | Set by Trustindex | Yes |
Advertising. We do not currently use advertising cookies or tracking for commercial purposes. If we introduce them in the future, they will only be activated with your consent, in a dedicated category of the cookie notice, and we will update this policy.
If you reject non-essential cookies, the site keeps working; some third-party content, such as the map, may not be displayed until you accept it.
You can also delete or block cookies from your browser settings.
14. Automated decisions
HAE does not make decisions based solely on the automated processing of your data, nor does it create profiles that produce legal effects or significantly affect you.
Decisions about participation in an activity, such as assessing a participant’s condition, are always made by a person: the HAE team or the guide in charge. Inquiries received through the website chat outside business hours are forwarded to email and answered by a person.
15. Changes to this policy
Each amendment to this policy is published with a new version number and its effective date, shown in section 1.
Minor changes. Wording adjustments, the replacement of a provider with an equivalent one or updated contact details apply upon publication of the new version.
Substantial changes. A new purpose, new recipients or a request for data not previously collected are published at least 15 days before taking effect, and are notified by email to clients with active bookings. If the change requires new consent, we will request it before applying it.