Privacy Policy

1. Introduction

Carpatia Retezat ("we", "our", "us") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with GDPR (General Data Protection Regulation) and Romanian data protection laws.

Data Controller: Carpatia Retezat
Address: Clopotiva, nr 368A, Râu de Mori, Hunedoara
Email: rezervari@carpatiaretezat.ro
Phone: +40 740 644 392 / +40 770 170 239
Data Protection Officer (DPO): dpo@carpatiaretezat.ro
ANSPDCP Registration: Notification sent in accordance with GDPR Article 37

2. Data We Collect

2.1. Information You Provide

• Name and surname
• Email address
• Phone number
• Country/city of residence
• ID document details (required by law for accommodation)
• Special requests or preferences
• Payment information

2.2. Automatically Collected Data

• IP address
• Browser type and version
• Device information
• Pages visited and time spent on site
• Referring website
• Cookies (see Cookie Policy)

3. How We Use Your Data

We use your personal data for the following purposes:

• Booking Management: Processing and confirming reservations
• Communication: Sending booking confirmations, updates, and responding to inquiries
• Legal Compliance: Meeting legal requirements for guest registration
• Service Improvement: Analyzing usage patterns to improve our services
• Marketing: Sending promotional emails (only with your consent)
• Security: Preventing fraud and ensuring platform security

4. Legal Basis for Processing

We process your data based on:

• Contract Performance: To fulfill our booking agreement with you
• Legal Obligation: Guest registration as required by Romanian law
• Legitimate Interest: To improve our services and prevent fraud
• Consent: For marketing communications (you can withdraw consent anytime)

5. Data Sharing

We do not sell your personal data. We may share your information with:

• Payment Processors: To process transactions securely (Stripe, PayPal)
• Email Services: To send booking confirmations (Resend)
• Government Authorities: When legally required (police, tax authorities)
• Service Providers: Third-party services that help us operate our business

All third parties are contractually obligated to protect your data and use it only for specified purposes.

6. Data Retention

We retain your personal data for the following periods:

• Booking Data: 5 years (accounting and tax requirements)
• Marketing Consents: Until you withdraw consent
• Website Analytics: 14 months
• Guest Registry: 10 years (legal requirement in Romania)

7. Your Rights Under GDPR

You have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interest
• Right to Withdraw Consent: For marketing communications
• Right to Lodge a Complaint: With Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

To exercise any of these rights, contact us at: rezervari@carpatiaretezat.ro

8. Cookies

We use cookies to enhance your browsing experience. Essential cookies are necessary for the website to function. Non-essential cookies (analytics, marketing) require your consent.

You can manage cookie preferences through our Cookie Consent banner or your browser settings.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• SSL/TLS encryption for data transmission
• Secure password storage with encryption
• Regular security audits
• Access controls and staff training
• Regular backups

10. Third-Party Data Processors

We work with the following third-party service providers who process your personal data on our behalf:

SCCs = Standard Contractual Clauses approved by the European Commission for international data transfers.

11. International Data Transfers

Some of our service providers are located outside the EU (primarily in the USA). We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequate safeguards as required by GDPR Article 46
• Regular review of data transfer agreements

12. Children's Privacy

Our services are not directed to children under 16. We do not knowingly collect personal data from children. Parents/guardians provide information for minor guests.

13. Changes to This Policy

We may update this Privacy Policy periodically. The "Last updated" date will be revised accordingly. Significant changes will be communicated via email or website notification.

14. Contact Us

For any questions about this Privacy Policy or to exercise your rights:

Email: rezervari@carpatiaretezat.ro

Phone: +40 740 644 392 / +40 770 170 239

Address: Clopotiva, nr 368A, Râu de Mori, Hunedoara