Privacy policy

1. Data controller

The owner of the personal data bank is the owner of Tonazo (identification details to be completed before launch). You can write to us from the contact page, choosing the topic “Privacy and personal data”.

We process your data in accordance with Law No. 29733, the Personal Data Protection Law, and its Regulations. The data banks will be registered with the National Registry for Personal Data Protection (Registro Nacional de Protección de Datos Personales) before launch.

2. What data we process

Account: name, email, password (stored encrypted with a one-way algorithm), language, favorite genres and districts.

Activity: saved events, organizations and venues you follow.

Organizers: details of the organization and its members.

Statistics: views and clicks in aggregate form. We do not store your full IP address: we use an encrypted digest with a key that changes every day. If you accept all cookies, we also use an anonymous identifier.

Contact: the data you send us through the form.

Emails: we log each email we send you (your address, which email it was, the date and whether it was delivered), never its content, to solve delivery problems. The log is deleted after 90 days and, if you delete your account, your address is removed from it.

Account security: we keep the date of your last sign-in and, if the Tonazo team acts on your account (resending you a link, suspending or reactivating it), who did it, when and why. It's deleted when you delete your account.

3. What we use it for

To provide you with the service (your account, your saved plans, recommendations), to let organizers see aggregated statistics for their events without identifying anyone, to maintain security (for example, limiting login attempts) and to reply to your messages.

We do not sell your data or use it for third-party advertising.

4. Legal basis and retention

We process your data with your consent and to fulfill the relationship you accept when you create your account. We keep it while your account is active. If you delete your account, we anonymize your personal data; statistics that have already been aggregated cannot identify you. Non-aggregated visit data is deleted after 90 days.

5. Who we share it with

With providers that supply us with infrastructure services (hosting, image storage, email delivery and machine translation), who may only use it for that purpose. Some are located outside Peru (for example, Amazon Web Services), which results in a cross-border flow of data with the safeguards required by law.

With authorities, when a regulation or an order requires it.

The small map of each venue loads from OpenStreetMap, which receives your IP address like any image server; we send it no other data.

6. Your rights

You can exercise your rights of information, access, rectification, cancellation and objection (ARCO rights), as well as withdraw your consent, by writing to us from the contact page. You can change or delete much of your data yourself from “My account”.

If you believe we did not handle your request, you can turn to the National Authority for Personal Data Protection (Autoridad Nacional de Protección de Datos Personales) of the Ministry of Justice and Human Rights (Ministerio de Justicia y Derechos Humanos).

7. Security and minors

We apply reasonable technical and organizational measures (encrypted connections, encrypted passwords, restricted access). Tonazo is not intended for people under 18.