Your information, with respect

Privacy policy

Last updated: 2 November 2026

You decide what you share with us. Here we explain, clearly, what data we process, for what purpose, on what legal basis and what rights you have.

This policy applies to people who visit this website or write to us from the European Union and the European Economic Area, and is drawn up in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), as well as European rules on privacy in electronic communications and the use of cookies. It also applies to those who contact us from other countries.

1. Controller

SAPC Viajes y Operaciones Turísticas EAS, operating under the trade name South America Private Collection (SAPC).

Address: Capitán Juan Dimas Motta 551, Asunción, Paraguay.
Contact and data protection email: southamericaprivatecollection@sapc.travel

We have not appointed a data protection officer. Any query about this policy may be sent to the email address above.

2. What data we process, why and on what basis

A. Replying to your travel request

Data First name and surname, email address, mobile or WhatsApp number and, depending on the form, country of residence, destination or format of interest, approximate dates, number of travellers, language, preferred means of contact and the message you write.

Legal basis Taking pre-contractual steps at your request (Art. 6(1)(b) GDPR). For health data or personal circumstances you choose to include in your message (for example, mobility or dietary needs), your explicit consent, which you give by ticking the box on the form and sending the message (Art. 9(2)(a)).

Retention Up to 12 months from the last contact, unless a journey is booked; in that case, for the periods required by the applicable legal obligations.

B. Website security and spam prevention

Data Date and time of submission and the IP address of your connection, stored together with your request, and an irreversible code derived from the IP address to limit mass submissions.

Legal basis Our legitimate interest in protecting the website and the form against abuse (Art. 6(1)(f)).

Retention The IP address is kept together with the request, for the same period. The rate-limit code is discarded after one hour.

C. Website usage statistics (Google Analytics)

Data Cookie identifiers, pages visited, duration, device and browser type, approximate location (country or city) and origin of the visit. They never include your name, email address or telephone number.

Legal basis Your consent (Art. 6(1)(a) GDPR and cookie rules). If you do not give it, Google Analytics is not loaded.

Retention 14 months.

D. Newsletter (when available)

Data Email address and, if you provide it, your name.

Legal basis Your express consent when you subscribe (Art. 6(1)(a)). We will send you a confirmation email to verify that the address is yours. This is a process separate from the contact form: requesting a journey does not subscribe you to the newsletter.

Retention Until you withdraw your consent. Every newsletter will include a link to unsubscribe with a single click.

You are not obliged to provide us with your data. However, the fields marked as required in the contact form are necessary in order to reply to you: if you do not complete them, we will not be able to deal with your request. We do not take automated decisions or create profiles that affect you.

We do not ask you for identity documents, card details or passwords through the forms. Please do not send them this way.

3. Cookies and Google Analytics

This website does not use advertising or third-party tracking cookies, and it does not need technical cookies to work. Only if you accept it in the cookie notice do we activate Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) that helps us understand how the site is used so that we can improve it. The reports we receive are aggregated.

Google Analytics 4 does not log or store full IP addresses of EU visitors. We do not activate Google's advertising features nor share Analytics data for advertising purposes.

How to manage your choice. You can accept or reject analytics cookies in the notice that appears when you enter the site, and change your decision whenever you like from the “Cookie preferences” link in the footer. You can also delete cookies from your browser or install the Google Analytics opt-out browser add-on. Rejecting them does not limit your use of the site or the form.

Fonts and images are served from our own site. The home page loads an animation library (GSAP) from the cdnjs content delivery network, run by Cloudflare, which, like any web server, receives your IP address when serving the file.

To remember your preferences, your browser stores in local storage (not in cookies) the language you choose and, if you use the cookie notice, your decision about cookies. This data is necessary for the site to work as you ask: it is not sent to our servers or to third parties.

4. Who receives your data

We do not sell, rent or transfer your data to third parties for commercial purposes. Only providers that process it on our behalf and with contractual safeguards have access to it (Art. 28 GDPR):

• our web hosting and email provider (Hostinger), which stores the site and the messages we receive;
• Google Ireland Limited, for Google Analytics, only if you accept analytics cookies;
• when available, the provider we use to send the newsletter, only if you subscribe.

If you decide to go ahead with a journey, some additional data may be needed to book services with hotels, guides or other providers. Before sharing it, we will tell you what data is involved and with whom. We may disclose data to the authorities when a rule requires us to.

5. International transfers

To Paraguay. SAPC is based in Paraguay, a country that the European Commission has not declared to have a level of data protection equivalent to the European one. When you send us your request, your data reaches Paraguay because you address it to us in order to receive a travel proposal (Art. 49(1)(b) GDPR) and, in the case of the newsletter, because you expressly consent to it after having been informed of this point (Art. 49(1)(a)). We apply the security measures described below and process the data only for the purposes stated.

To the United States. Google may process Analytics data on servers in the United States. Google LLC is certified under the EU-US Data Privacy Framework, recognised by the European Commission as providing an adequate level of protection, and also applies standard contractual clauses.

6. Your rights

You may exercise the following rights at any time, free of charge:

• Access: find out what data of yours we process and receive a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Restriction: ask us to temporarily suspend its processing.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on our legitimate interest.
• Withdraw your consent: where processing is based on it, without affecting what was done before you withdrew it.

To exercise them, write to us at southamericaprivatecollection@sapc.travel stating your name and the email address with which you contacted us; we may ask you to prove your identity. We will reply within one month of receiving your request, extendable in the cases provided for by the GDPR.

If you consider that we have not handled your data correctly, you have the right to lodge a complaint with the data protection supervisory authority of your country of residence or work: in Spain, the Spanish Data Protection Agency (AEPD); in Germany, the authority of your federal state or the Federal Commissioner for Data Protection and Freedom of Information (BfDI). We would be grateful if you would first give us the opportunity to resolve it.

7. Security

We apply appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), server-side validation of the data, restricted access to the information received and storage outside the public area of the website. No system is infallible, but we work to keep your information protected.

8. Minors

Our services are aimed at adults. If you travel with minors, the data you share about them must be provided by their mother, father or legal representative.

9. Changes to this policy

If we update this policy we will publish the new version on this same page and change the “Last updated” date. If the change is significant, we will tell you prominently.

10. Contact

South America Private Collection · SAPC Viajes y Operaciones Turísticas EAS
Capitán Juan Dimas Motta 551 · Asunción, Paraguay
southamericaprivatecollection@sapc.travel

← Back to designing my journey