Privacy Policy

Last updated: October 22, 2026

1. Data Controller Identification

The data controller responsible for personal data processed through this website is ANCESTRAL COCINA TRADICIONAL CONTEMPORÁNEA E.I.R.L., identified with RUC N.° 20605269096, with address at Av. Atusparia 327, Huaraz, Ancash, province of Huaraz, department of Áncash, Peru (hereinafter, "the Restaurant"), operating commercially under the trade name Casona Ancestral.

For any inquiries, requests, or exercise of personal data protection rights, the data subject may contact the Restaurant directly via email at admin@casonancestral.com.

2. Applicable Legal Framework

Personal data processing conducted by the Restaurant is governed by the laws of the Republic of Peru, in particular Ley N.° 29733 (Ley de Protección de Datos Personales), its regulations approved by Decreto Supremo N.° 016-2024-JUS, and where applicable by Ley N.° 29571 (Código de Protección y Defensa del Consumidor) and Decreto Supremo N.° 011-2011-PCM (Reglamento del Libro de Reclamaciones, amended by D.S. N.° 006-2014-PCM).

3. Exclusive Processing Purposes and No Advertising Use

Personal data collected through this website is exclusively processed for the following specified, legitimate purposes:

  • Reservation management: Processing, evaluating, coordinating, and confirming table booking requests submitted by customers through the reservation form.
  • Management of the Libro de Reclamaciones: Registering, assigning unique sequential correlatives, evaluating, investigating, and issuing reasoned formal responses to claims and complaints, as well as dispatching immediate digital receipts and email responses pursuant to statutory obligations established in the Código de Protección y Defensa del Consumidor.
  • Customer contact and inquiries: Addressing and responding to commercial inquiries, event requests, or messages sent through the general contact form.
  • Job recruitment: Evaluating professional profiles voluntarily submitted through CVs for staffing selection processes.

Strict absence of advertising or commercial use: Personal data provided by users—and strictly data collected through the Libro de Reclamaciones—will never be used for commercial prospecting, unsolicited advertising, promotional emails, mass marketing, or consumer profiling.

4. Categories of Personal Data Processed

Depending on the form or feature used, the Restaurant collects only data strictly necessary to fulfill declared purposes:

  • Reservation form: Full name, email address, contact telephone, party size, requested date and time, occasion, and special dietary or seating requests.
  • Contact form: Name, email address, optional telephone, and message content.
  • Job applications ("Work with us"): Curriculum vitae details and contact information voluntarily submitted by applicants.
  • Libro de Reclamaciones:
    • Consumer identification: Full legal names, identity document type and number (DNI, Foreigner ID [CE], Passport, or RUC).
    • Contact details and physical address: Email, phone number, and street address.
    • Legal representative (for minors): Full name, ID document, and contact telephone of parent or legal guardian.
    • Contracted item: Description of product or service, claimed amount, and details of the transaction.
    • Dispute details: Classification as Reclamo (Claim) or Queja (Complaint), factual account, and specific requested redress.

5. Collection Method and Technology Processors

Reservation requests and complaint sheets are transmitted securely using encrypted connections (HTTPS/TLS 1.3) and are primarily stored in a Cloudflare D1 relational database. The following technology providers act as data processors:

  • Cloudflare, Inc.: Provides cloud hosting infrastructure, edge compute platforms (Workers and Pages), transactional storage (Cloudflare D1), object storage (R2), and perimeter access controls for the admin panel (Cloudflare Access).
  • Resend, Inc.: Provides telematic email delivery infrastructure utilized to dispatch digital receipts from the Libro de Reclamaciones, reasoned responses, and internal administrative alerts.
  • Google LLC: Provides the interactive map embedded in the "Find us" section, governed by its own privacy terms.

International data transfers: Cloudflare and Resend operate distributed global network infrastructure with servers that may be located outside the Republic of Peru. Such international processing occurs exclusively to provide the technical service under security and confidentiality standards equivalent to Peruvian legal requirements.

6. Transient IP Address Processing and Abuse Protection

To safeguard the platform, prevent Denial-of-Service (DoS) attacks, and enforce rate limiting against abusive automated traffic, the system derives a cryptographic identifier from the user's IP address using a one-way HMAC-SHA256 function with a secret salt.

The Restaurant expressly clarifies that:

  • IP addresses are never stored in plaintext within the database or permanent logs.
  • The generated HMAC cryptographic digest is strictly transient and used solely for short-term rate limiting across minute windows.
  • Rate limit tracking entries expire and are automatically purged.
  • Under no circumstances is this HMAC IP digest preserved during the mandatory two-year claim archiving period, nor is it linked permanently to consumer identity.

7. Personal Data Retention Periods

Personal data is retained solely for periods strictly necessary to satisfy its designated purposes:

  • Reservations and inquiries: Retained for an ordinary period of twelve (12) months from submission, unless earlier deletion is requested.
  • Job recruitment: Retained for a maximum of twelve (12) months, after which records are securely destroyed unless employment commenced.
  • Libro de Reclamaciones: Pursuant to Article 12 of Decreto Supremo N.° 011-2011-PCM, complaint sheets, reception receipts, and formal reasoned responses issued by the Restaurant are mandatorily archived for a minimum period of two (2) calendar years from the date of filing or resolution. Following this two-year retention period, records undergo periodic review for final archival, secure deletion, or anonymization, barring active administrative or judicial proceedings.

8. Technical and Organizational Security Measures

In accordance with Ley N.° 29733 and Decreto Supremo N.° 016-2024-JUS, the Restaurant has implemented technical and organizational safeguards to ensure the confidentiality, integrity, and availability of personal data, including:

  • End-to-end encryption in transit via HTTPS/TLS 1.3 with valid certificates.
  • Restricted administrative access limited to authorized personnel via corporate single sign-on and cryptographic token validation (Cloudflare Access).
  • Personally Identifiable Information (PII) isolation within the admin panel, viewable exclusively inside protected modal views.
  • Immutable operational audit logs (`audit_log`) auditing actions without logging PII or cryptographic secrets.
  • Parameterized database queries preventing SQL injection and `no-store` cache headers preventing public caching.

9. ARCO Rights and Exercise Procedure

Data subjects (or their accredited legal representatives) may exercise at any time their statutory rights of Access, Rectification, Cancellation, and Opposition (ARCO rights), as well as rights to information and consent revocation, pursuant to Ley N.° 29733 and D.S. N.° 016-2024-JUS.

Official channel: Requests should be submitted directly to the following official email address:

admin@casonancestral.com

Request requirements:

  • Full name of the data subject and, where applicable, of their legal representative.
  • Copy of identification document (DNI, CE, Passport) and power of attorney if acting through a representative.
  • Clear and specific request identifying the right being exercised and the personal data concerned.
  • Supporting documentation where data rectification or update is requested.

Statutory response deadlines: Requests for rectification, cancellation, and opposition will be addressed within a maximum of ten (10) business days, and access requests within twenty (20) business days.

Statutory retention exception for Libro de Reclamaciones: In application of Article 12 of D.S. N.° 011-2011-PCM and statutory exceptions regarding legal obligations, cancellation requests cannot compel the premature deletion of claim sheets before the mandatory two (2) calendar year retention period has elapsed.

If the data subject considers that their request has not been satisfactorily addressed, they may lodge a complaint with the Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales of the Peruvian Ministry of Justice and Human Rights.

10. Cookies and Tracking Technologies

This website does not utilize proprietary cookies for marketing, behavioral profiling, or invasive analytics. The only technical third-party cookie that may appear originates from the embedded Google Maps service in the "Find us" section, which can be blocked via browser preferences without impairing remaining website features.

11. Amendments to the Privacy Policy

The Restaurant reserves the right to amend this Privacy Policy to align with regulatory reforms or service additions. Any revisions will be posted on this page, indicating the date of the latest effective version in the header.

Book here