The controller of your personal data is [COMPANY NAME], a company registered in Romania, with its registered office at [REGISTERED ADDRESS], entered in the Trade Register under no. [TRADE REGISTER NO.], sole registration code [VAT/CUI NUMBER], hereinafter “LASTRAJA” or “we”. We process data under Regulation (EU) 2016/679 (GDPR). This page explains what we collect, why, how long we keep it and what rights you have.
1. What we collect
- Account data: name, email address, password (stored only as a hash, never in clear text).
- Booking data: dates, number of guests, the service booked, price and booking status.
- Profile data, if you choose to fill it in: phone number and contact preferences.
- Content you create: reviews and ratings.
- Technical data: IP address, device and browser type, pages visited, needed for security and for the site to work.
2. Why we process it, and on what basis
- To carry out your booking and run your account. Basis: performance of a contract (art. 6(1)(b) GDPR).
- To prevent fraud and abuse and keep the platform secure. Basis: our legitimate interest (art. 6(1)(f) GDPR).
- For tax and accounting obligations. Basis: legal obligation (art. 6(1)(c) GDPR).
- For marketing messages, if you ask for them. Basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time.
3. Who we share it with
We pass the partner delivering the service only what is needed to honour your booking: your name, the dates, the number of guests and contact details. That partner becomes an independent controller for those data.
- [PAYMENT PROCESSOR NAME]: payment processing.
- [EMAIL PROVIDER NAME]: sending transactional email.
- Cloudinary: hosting the images published on the platform.
- [HOSTING PROVIDER NAME]: the infrastructure the site runs on.
4. Transfers outside the EU
Some of the providers above may process data outside the European Economic Area. Where they do, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision.
5. How long we keep it
- Account data: for as long as the account is active, plus [NUMBER] months after it is closed.
- Booking data and financial records: 10 years, as required by Romanian accounting law.
- Reviews: stay published, but are anonymised when the account is deleted.
- Technical logs: [NUMBER] months.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
Exercise these rights by writing to [CONTACT EMAIL]. We respond within one month.
If our answer does not satisfy you, you can complain to the Romanian data protection authority (ANSPDCP) at dataprotection.ro.
7. Security
Passwords are stored hashed. Traffic is encrypted over HTTPS. Access to production data is restricted by role. One partner cannot see another partner's data.
8. Children
The platform is not aimed at people under 16 and we do not knowingly collect their data. Bookings for a minor are made by an adult.
9. Contact
For anything concerning your data: [CONTACT EMAIL], [REGISTERED ADDRESS], [PHONE]. [IF A DATA PROTECTION OFFICER IS APPOINTED, THEIR DETAILS GO HERE.]