1GLOSSARY

The terms below are used in the sense set out here, in the singular or plural as appropriate.

• ANDINO: ASOCIACIÓN EDUCATIVA AUSANGATE SCHOOL, identified by RUC N.° 20601130301, with registered address at Predio Chucllacunca S/N Mz. 1 Lote B2, Cachimayopampa, Cachimayo district, Anta province, Cusco region. It is the data controller for the processing described in this Policy and the legal entity that operates the private school ANDINO CUSCO INTERNATIONAL SCHOOL.
• ANPD: Autoridad Nacional de Protección de Datos Personales, the agency attached to the Ministry of Justice and Human Rights, empowered to provide guidance, supervise and sanction the processing of personal data in Peru.
• DATA BANK: an organised set of personal data that has been declared, approved and registered before the National Register of Personal Data Protection, held by the ANPD.
• Personal data: information relating to a natural person that identifies them or makes them identifiable. Sensitive data is that which reveals information about their physical or mental health, sexual orientation, or any other circumstance affecting their fundamental rights.
• Processor: a natural or legal person that processes personal data on behalf of ANDINO, following ANDINO's instructions and for the purposes determined by ANDINO.
• LPDP: Law N.° 29733, Peru's Personal Data Protection Law, and its Regulation approved by Supreme Decree N.° 016-2024-JUS, in force since 31 March 2025, together with its amending, supplementary and concordant rules.
• Data subject: the natural person to whom the personal data processed by ANDINO relates.
• Transfer: the communication of personal data to a party other than the processor or ANDINO itself, within or outside Peru.
• USER: a natural person who accesses the WEBSITE, contacts ANDINO, requests information about its educational services, or takes part in an admissions process. Where the USER acts on behalf of an applicant child, the USER is also that child's legal guardian.
• WEBSITE: the domains and subdomains owned and administered by ANDINO, in particular andinoschool.edu.pe (including its /es/ and /en/ language directories), blog.andinoschool.edu.pe and admision.andinoschool.edu.pe, together with the contact and admissions forms linked to them.

2DATA CONTROLLER, SCOPE AND OWNERSHIP OF THE WEBSITE

ANDINO decides on the purposes and means of processing the personal data collected through the WEBSITE and through the systems it uses to serve families, applicants and the school community.

The WEBSITE is the institutional information and communication service of the private school ANDINO CUSCO INTERNATIONAL SCHOOL. It is published and administered by ANDINO, without prejudice to the content editors identified in each section, who assume responsibility for the use they make of the data they publish.

Registered address: Predio Chucllacunca S/N Mz. 1 Lote B2, Cachimayopampa, Cachimayo district, Anta province, Cusco. Privacy contact: administracion@andinoschool.edu.pe.

3PRINCIPLES THAT GOVERN PROCESSING

ANDINO's processing is governed by the LPDP and its Regulation. It applies the principles that the Law itself recognises in Articles 5 to 9:

• Lawfulness: personal data is processed with the data subject's consent, within the boundaries of the law and with respect for their rights.
• Purpose: data is collected for a specific and explicit purpose, which is notified in this Policy.
• Truthfulness: the data provided by the data subject must be true and accurate, expressed in an exact and understandable way, and kept up to date.
• Utility or proportionality: processing responds to the purpose notified. No excessive data is collected or used beyond what is necessary, and no discrimination is made on grounds unrelated to the educational relationship.
• Security: ANDINO adopts measures that protect data against deterioration, loss, alteration, destruction, unauthorised use or access.
• Transparency: ANDINO clearly informs how it uses data and guarantees the data subject access to it and the exercise of their rights.
• Destination: data is used for the purposes notified. It is not handed to third parties unless the law authorises it, or unless there is an engagement, consent or a new purpose notified to the data subject.
• Suppression: data is kept for the period set out in this Policy and is then deleted or blocked in accordance with the law.
• Responsibility: ANDINO takes responsibility for identifying and correcting any errors or omissions that may affect processing.

4CATEGORIES OF PERSONAL DATA WE PROCESS

The information ANDINO processes comes from interactions with the WEBSITE, from communications with families and applicants, from the school's academic and administrative records, and from the records the competent education authority provides. The specific categories depend on your relationship with ANDINO.

Sensitive data: ANDINO does not request categories of sensitive data for purposes other than assessing the educational and admissions process. Where processing is unavoidable, for example health or accessibility information, express consent is requested and processing is limited to what is strictly necessary.

Data relating to children: applicants and students are minors. Their data is processed with the signed consent of their parents or legal guardians, in accordance with Article 7 of the LPDP, and observing the equivalence principle as to the quality of the information. See also section 12.

5SOURCE OF THE PERSONAL DATA

The data ANDINO processes comes from the following sources:

• Directly from you: through the WEBSITE's contact, admissions and enrolment forms, by email, and through admissions interviews with families.
• From parents or legal guardians: when they register a child, take part in an admissions process, or send documentation.
• From members of the school community: when an applicant or student joins the school and becomes part of their record.
• From public bodies: when the Ministry of Education, the Regional Directorate of Education or the Local Education Management Unit provide enrolment data within their remit.
• From service providers: when a third party acting as processor sends us information, such as the admissions CRM or the hosting provider.

Verification of information: ANDINO does not verify the accuracy of data declared by third parties, unless there is a legitimate reason to do so. In that case, the data subject is given the opportunity to correct their data.

6CONSENT

ANDINO requests the consents corresponding to each processing activity in a differentiated manner. Under the LPDP, personal data must be processed with the data subject's consent for the purposes that require it. Processing may take place without prior consent in the following cases:

• Processing with consent: once the data subject gives consent, ANDINO may process their data for the purposes notified. Consent is prior, free, informed, unequivocal, strict and separable, and may be withdrawn in whole or in part at any time, with no retroactive effect on processing already carried out.
• Data necessary for performance of a contract: prior consent is not required, because such data is necessary to deliver the educational service requested.
• Third-party data: where a data subject provides data about another person, such as an applicant child or a relative, they must evidence that person's authorisation, unless a different legal basis applies to the processing.
• Data held in public registers: ANDINO may process data available from public sources where there is a legitimate reason for the processing under Article 15 of the LPDP.
• Data not consented to, or outside the notified purpose: ANDINO will not process it unless a legal basis permits it.

7PURPOSES AND RETENTION PERIODS

ANDINO processes personal data exclusively for the purposes set out below. Data is kept for the periods indicated, or for as long as the relationship with the data subject remains in force. Once these periods end, data is deleted or blocked in accordance with the law.

Exception to the retention period: where data is held in a declared file, record or data bank, ANDINO blocks or deletes the information when the data subject requests it, unless a retention obligation takes precedence.

8AUTOMATED PROCESSING AND AUTOMATED DECISIONS

ANDINO does not use automated decisions that produce legal effects for the data subject, nor does it carry out profiling with discriminatory effects based solely on personal data. Statistical measurement of use of the WEBSITE, such as that carried out by analytics cookies, is only performed with the data subject's authorisation and is limited to aggregated data.

9DATA BANK AND NATIONAL REGISTER OF PERSONAL DATA PROTECTION

ANDINO holds a data bank of clients, suppliers, staff, prospects, applicants and students, declared before the ANPD and registered in the National Register of Personal Data Protection. All the information set out in this document is contained in that data bank or in the school's files and records.

In accordance with Law N.° 29733, it is hereby stated that:

• The information presented is intended for the analysis and performance of the procedures inherent to the relationship with data subjects, as described in section 7.
• The data was collected from the sources set out in section 5.
• Processing is carried out with consent, except in the cases set out in section 6.
• This information is used by ANDINO alone, and its processing is carried out in accordance with the LPDP and its Regulation.
• The data subject has the right to access, rectify, cancel or object to the processing of their data, following the procedure described in section 13.
• Information about the ANPD is available at www.gob.pe/institucion/minjus.

10PROCESSORS, TRANSFERS AND CROSS-BORDER FLOWS

In order to meet the purposes described, ANDINO uses the services of the providers and processors listed below, with whom it has entered into the contractual clauses required by data protection law.

The international transfers referred to in this section are made only to providers whose servers are located abroad. Providers act as processors, so they do not determine the purposes or means of processing themselves, and they are bound by the clauses required under current regulations.

11SECURITY MEASURES AND INCIDENT NOTIFICATION

ANDINO applies technical, organisational and legal security measures to protect personal data against deterioration, loss, alteration, destruction, unauthorised use or access. These measures include:

• Restricting access to information to authorised personnel, in line with the principle of least privilege.
• Robust passwords and mechanisms for updating staff credentials.
• Encryption in transit of sensitive information across the WEBSITE and its communication channels.
• Regular backups, and the location of sensitive information on trusted servers in accordance with transfer agreements.
• Logging of accesses and sensitive operations, with periodic review of their scope.
• Staff training in personal data protection.
• Verification of providers' profiles through contractual clauses and confidentiality agreements.

In the event of a security incident that may affect personal data, ANDINO takes the containment and prevention measures necessary, assesses the risk and, where appropriate, notifies the ANPD and the affected data subjects within the periods and requirements set by current regulations. Evidence of the measures adopted is retained in all cases.

12CHILDREN AND ADOLESCENTS

ANDINO recognises that applicants and students are, in most cases, minors. Their data is therefore processed with the prior, informed, unequivocal and written consent of their parents or legal guardians, with particular care in applying the equivalence principle as to the quality of the information.

ANDINO does not use data relating to children for marketing or advertising directed at them, nor for practices that could affect their overall development. Legal guardians may exercise ARCO rights on the child's behalf, following the procedure in section 13. Once the child reaches the age of majority, they may exercise those rights themselves.

13DATA SUBJECT RIGHTS AND THE ARCO PROCEDURE

The LPDP recognises data subjects' right to know of the processing in which their data is included, and to access, rectify, cancel or object to it. These are known as ARCO rights.

The periods run from receipt of the complete request. Where exercising a right requires proof of identity, ANDINO may request documentation evidencing the identity of the applicant or their representative, or verify it by secure electronic or telephone means.

How to make a request: requests are submitted in writing to administracion@andinoschool.edu.pe, stating full name, identity document, address, details of the data concerned and the right being exercised, together with any supporting documentation.

Response: ANDINO responds in writing and reports the outcome. Where a request is denied, the reason is given. If the data subject receives no response or is not satisfied with it, they may file a complaint with the ANPD or use the administrative or judicial routes. Administrative review is governed by Article 135 of the LPDP.

Withdrawal of consent: a data subject may withdraw consent at any time, in whole or in part, with no retroactive effect on processing carried out beforehand. This can be done by writing to the same email address or by using the «Cookie settings» link in the WEBSITE footer.

14VOLUNTARY NATURE OF THE DATA AND CONSEQUENCES OF NOT PROVIDING IT

The provision of personal data is voluntary, except for data whose processing is necessary for the performance of a contract or compliance with a legal obligation.

Failure to provide data that is reasonably necessary for a given purpose may have the following consequences:

• Enquiries, information requests or the admissions process cannot be handled, where that data is needed in order to assess them.
• Enrolment cannot be managed, nor can the school's official documents be collected.
• The certificates, records and reports required by sectoral regulations cannot be produced.

Refusing to provide data for purposes other than those notified does not prevent a data subject from using the WEBSITE or taking part in the admissions process.

15USER OBLIGATIONS AND DECLARATIONS

The USER undertakes to:

• Provide true, accurate, complete and up-to-date data about themselves, about the child they are applying for, and about any other data subject.
• Notify ANDINO of any change to their data so that the record can be kept up to date.
• Use the WEBSITE lawfully, without accessing restricted areas and without taking actions that could harm the security of the systems or of other users.
• Not impersonate third parties, not introduce malicious code, and not carry out uses that could affect the operation of the WEBSITE.
• Use the WEBSITE's content and information solely for lawful purposes, in accordance with Peruvian legislation.

16CHANGES TO THE POLICY, COMPLAINTS TO THE ANPD AND EFFECTIVE DATE

ANDINO may update this Privacy Policy to reflect legislative changes, ANPD criteria, or changes to the services or providers. Updates will be published on this page and announced through a visible notice on the WEBSITE where they are material. You are advised to consult this Policy periodically.

If a data subject considers that ANDINO is failing to comply with personal data protection law, they may lodge a complaint with the ANPD through its official channels.

Effective date: version published on 1 October 2026, applicable to all domains and subdomains listed in section 1.