Last updated: August 12, 2026
Courtesy translation of the original Spanish document. If there is any discrepancy, the Spanish version prevails: Política de Privacidad.
This policy is governed by Law No. 29733, the Personal Data Protection Law of Peru, and its Implementing Regulations (Supreme Decree No. 016-2024-JUS). If you write to us from the European Union, Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) also applies; we point this out in each section where something changes.
It is written so that you can understand it without being a lawyer. It only says things we actually do.
| Data controller | Alejandro Huamán Herrera |
|---|---|
| Operating under | Two Scorpions (trade name) |
| Country | Peru |
| twoscorpions.service@gmail.com | |
| Phone and WhatsApp | +51 938 542 553 |
This is the email address you can write to in order to revoke your consent or exercise any of your rights. We reply through the same channel.
We only process what you give us through the contact form. Nothing else: we do not buy lists, we do not track your browsing and we do not cross-reference your data with other sources.
| Data item | Required? | Why |
|---|---|---|
| Name | Yes | To address you |
| Email address | Yes | It is where we reply |
| Service, situation and timeline | Yes | It is your inquiry: without this there is nothing to reply to |
| Company | No | It helps us understand the context |
| Phone number and country code | No | Only if you prefer that we call you or message you on WhatsApp |
| Free-text message | No | Whatever you want to tell us |
| IP address | Automatic | Our server records it to stop automated submissions and abuse |
If you do not complete the required fields, the form is not submitted and we will not be able to reply to you; you can still write to us at the email address or WhatsApp number above. Not filling in the optional fields has no consequences.
We do not ask for sensitive data (health, ideology, religion, sex life, biometric or genetic data) and we ask you not to include it in the free-text message.
We do not send you advertising or newsletters, we do not build profiles, we do not make automated decisions about you, and we do not sell or transfer your data for commercial purposes.
With your free, prior, express and informed consent, which you give by checking the box on the form (Article 5 of Law No. 29733). For visitors from the European Union, that basis is Article 6(1)(a) of the GDPR, together with the pre-contractual measures under Article 6(1)(b).
You can withdraw your consent whenever you want, by writing to our email address. It is free of charge and unconditional, and it does not affect the lawfulness of what we did before.
In a personal data bank called “Commercial Inquiries” (Consultas comerciales), whose controller is the one indicated in section 1. In practice, your inquiry arrives in our email inbox and is kept there for the periods set out in section 8.
To make the website and email work, we use these providers. They only access what is essential to provide their service and cannot use your data for anything else:
| Provider | What it sees | Country |
|---|---|---|
| Google (Apps Script and Gmail) | The full content of your inquiry, to deliver and store it | United States |
| Cloudflare (Turnstile) | Your IP address and technical browser signals, to check that you are not a robot | United States |
| DigitalOcean | Hosts the website server; your IP address is recorded in its technical logs | United States (San Francisco) |
Outside these cases, we do not disclose your data to anyone unless required by law.
As you can see in the table above, your data leaves Peru: all three providers are in the United States. We tell you this expressly because the law requires it (Article 13.2 of the Implementing Regulations) and because we think you should know before writing to us, not after.
The United States does not have a declaration of an adequate level of protection issued by the Peruvian authority. We base those transfers on the safeguards provided for in Articles 18 and 20 of the Implementing Regulations: the data processing agreements and contractual clauses that each provider makes available to its customers.
| Situation | Period |
|---|---|
| Inquiry that does not lead to work | 12 months from the last contact |
| Inquiry that does lead to work | For as long as the relationship lasts and afterwards, for the time required by Peruvian tax regulations |
| Technical logs containing the IP address | They are overwritten continuously; they are not archived |
Once the period has expired, they are deleted. If you want us to delete your inquiry sooner, ask and we will do it.
These are the measures in place today, not a list of good intentions:
No system is infallible. If a breach occurred that posed a risk to your rights, we would inform you and notify the National Authority for Personal Data Protection (Autoridad Nacional de Protección de Datos Personales) within the legal time limits.
You can exercise them at any time and free of charge:
If you write to us from the European Union, you also have the GDPR rights to restriction of processing and to data portability.
To exercise them, write to twoscorpions.service@gmail.com stating what you want. We reply within the time limits set by Law No. 29733 and its Implementing Regulations.
If you believe we have not handled your request properly, you can file a complaint with the National Authority for Personal Data Protection of the Ministry of Justice and Human Rights of Peru (Ministerio de Justicia y Derechos Humanos; gob.pe/minjus). If you reside in the European Union, you can complain to the supervisory authority of your country.
This website is aimed at professionals and businesses. We do not knowingly collect data from minors under 14 without the consent of their parents or guardians. If we find that we have received data of this kind, we delete it.
If we change anything significant—a new provider, a different purpose, a different period—we update this page and its date. The version in force is always the one published here.