The Confidentiality policy regarding the processing of personal data

Your personal data are processed by SC KULTUR PROJECT SRL SRL in full accordance to the EU Regulations 2016/679 („General data protection regulation” or „GDPR”), as well as any other legislation applicable on the Romanian territory. We wish to inform you about the way in which we collect, use, transfer and protect your personal data when you interact with us in connection to our products and services, inclusively, by means of our website.

The types of personal data categories we process

In general, we collect your personal data directly from you so you have control upon the type of information that you provide us. As example, we receive information from you such as:

• When you access the form from the Contact page of the site transilvania-cincsor.ro, you give us: your name, e-mail address, your subject and a message that can contain other personal information.

• When you access the Reservation form, you give us: the arrival and departure date, the number of nights for accommodation, the number of rooms, the number of adults and children, room type, additional services, payment method and bank information.

We can, also, collect and process afterwards certain information regarding your behavior, during your visit on our website, in order to customize your online experience and put at your disposal the offers adjusted to your profile. We invite you to find out more details within this sense by seeing the section below regarding the processing.

On our website, we can store and collect information in cookies and similar technologies, according to the cookie policy.

We do not collect or process in any other way sensitive data, included by the General regulation regarding the data protection in special personal data categories. Also, we do not wish to collect or process data of persons under 18 years.

What are the purposes and grounds of data processing?

We will use your personal data within the following purposes:

1. In order to provide the services in your interest.

This general purpose may include, when the case, the followings:

1. a) processing of orders/ reservations, including their collection, validation, delivery and invoicing;
2. b) settlement of cancellations or any type of issues referring to an order/ reservation or the acquired goods or services;
3. c) reimbursement of products according to the legal provisions;
4. d) assuring the assistance services, including providing answers to your questions regarding your orders/reservations.

The processing of your personal data within these purposes is in accordance to the Government Decision no. 237/2001. Also, certain types of processing which come under these purposes are enforced by the applicable legislation, including the fiscal and accounting legislation.

1. In order to enhance our services

We want to provide you, permanently, the best online experience. For that, we might collect and use certain information connected to your behaviour as Buyer.

The ground for these activities is our legitimate interest to run commercial activities, by always taking care that your fundamental rights and freedoms are not affected.

1. For marketing purposes

We want to let you know about the best offers for the products/ services you’re interested about. Within this sense, we can send you any type of message (such as: e-mail/ SMS/ mobile phone/ mobile push/ web push etc.), containing general systematic information, information regarding products similar or complementary to the ones acquired by you, information regarding offers or advertising as well as other commercial messages such as market researches and opinion surveys and we can display customized recommendations on the website. In order to put at your disposal information of interest, we can use certain data regarding your behavior as buyer (for example, the viewed products) in order to create a profile for you. We always make sure that the processing is always made by observing your rights and freedoms and that the undertaken decisions based on these do not have legal effects upon you and they do not affect you similarly in a significant manner.

In most of the cases, we ground our marketing messages on your previous consent. You can change your mind and withdraw your consent, anytime, by:

• Accessing the unsubscribe link within the messages you receive from us;
• Contacting us directly by using the following contact details: tel +4 0744.373.090 or email kulturproject@gmail.com.

In certain cases, we can ground our marketing activities on our legitimate interest to advertise and develop our commercial activity. In any situation, when we use information regarding you for our legitimate interest, we take care and we take all the necessary measures in order not to affect your fundamental rights and freedoms. Nevertheless, you can always request, by the above mentioned means, to stop processing your personal data within marketing purposes, followed by our observance of your request.

1. In order to defend our legitimate interests

There can be situations in which we will use or deliver information in order to protect our commercial activity and rights. These may include:

• Measures of protecting the website and its users in regard to the cyber attacks;
• Measures of preventing and detecting the fraud attempts, including delivering certain information to the competent public authorities;
• Measures of managing other different risks.

The main ground for these types of processing is our legitimate interest to defend our commercial activity, being understood that we make sure that all the measures we take guarantee a balance between our interests and your fundamental rights and freedoms.

We, also, in certain cases, ground the processing on legal provisions such as the obligation to assure the security of the goods and assets, required by the legislation applicable within this matter.

How long do we keep your personal data?

We will store your personal data for 3 years, according to the Government’s decision no. 237/2001. You can ask us anytime for the deletion of certain information and we will observe these requests, subject to the storage of certain information including after the termination of the collaboration, in the situations where the applicable legislation or our legitimate interests assert it.

To whom we deliver your personal data

When the case, we can deliver or provide access to some of your personal data to the following beneficiaries’ categories:

• Providers of delivery services;
• Providers of payment/ banking services;
• Providers of marketing/ telemarketing services;
• Providers of market research services;
• Insurance companies;
• Other companies with whom we can develop mutual market offers for our goods and services.

In case if we’ll have a legal obligation or if it is necessary to defend a legitimate right, we can also disclose certain personal data to certain public authorities.

We make sure that the access to your data by third parties as private law entities is made in accordance to the legal provisions regarding the data protection and the information confidentiality, based on the contracts concluded with them.

The countries where we transfer your personal data

We currently store and process your personal data on the Romanian territory.

How we protect the safety of your personal data

We submit to assure the safety of the personal data by implementing proper technical and organizational measures, according to the standards of the industry.

The delivery of your personal data is made by using the last generation encryption algorithms and we store them on secured servers, by assuring in the same time the redundancy of the data.

Despite the measures taken to protect your personal data, we remind you that the delivery of information by means of Internet, generally, or by means of other public networks, is not fully safe because there is always the risk that the data might be seen and used by unauthorized third parties. We cannot be responsible for such vulnerabilities of systems that are not under our control.

What are your rights

The general regulation regarding the data protection will admit a series of rights regarding your personal data. You can require the access to your data, the adjustment of any errors from our files and/ or you can set against the processing of your personal data. Also, you can exercise your right to submit a claim to the competent monitoring authority or to file a lawsuit. Depending on the case, you can also benefit of the right to claim the clearing of your personal data, the right to restrain the processing of your data and the right to data portability.

Access

You can ask us for:

• A confirmation if we will process your personal data;
• To put at your disposal a copy of these data;
• To provide you other information about your personal data, such as the data we use, the purpose of their use;
• To whom we disclose them, if we transfer them abroad and how we protect them, how long we store them, what are your rights;

Rectification

• You can ask us to rectify or to fill in your inaccurate or incomplete personal data
• It is possible to try to check the trustworthiness of the data before their rectification

Data deletion

You can ask us for the deletion of your personal data but only in case if:

• These are not necessary anymore within the purposes for which they were collected;
• You have withdrawn your consent (in case if the data processing is based on consent);
• You claim a legal right to set against;
• They were illegally processed;
• We have a legal obligation within this sense.

We do not have the obligation to observe your request regarding the deletion of your personal data in case if the processing of your personal data is necessary:

• In order to observe a legal obligation;
• In order to ascertain, exercise or defend a right in front of a court.

 Data portability

You can ask us to provide you the personal data in a technical form, currently used and that can be read automatically or you can ask for it to be directly transferred to another data operator but in each of the cases, only if:

• The processing is based on your consent or on the conclusion or execution of a contract with you;
• The processing is made by automatic means.

Opposition

You can set against, any time, based on grounds related to your specific situation, to the processing of your personal data based on our legitimate interest, case in which you think that your fundamental rights and freedoms prevail over this interest.

Also, you can set anytime against the processing of your data within a direct marketing purpose, without invoking any ground, case in which we will terminate as soon as possible this processing.

Claims

You have the right to submit a claim to the National Authority for the Monitoring of Personal Data Processing.