Privacy policy
What you send us through the request form, why we use it, how long we keep it and what rights you have.
Who we are
The data controller is TDA TURISM RURAL SRL, registered office Str. Maramureșului nr. 5, ap. 1, 550062 Sibiu, Sibiu County, tax ID (CUI) 37884011, Trade Register no. J2017001015326, which runs Casa Bunicilor Gârbova, Str. Ion Creangă nr. 490, 517305 Gârbova de Sebeș, Alba County. You can write to us at claudiuarc@gmail.com or call us on +40 740 534 597.
What we collect
Through the request form: your name, phone number, email address (optional), the dates you want, the number of guests, your message together with your answers about pets, a school group and how many teachers or leaders, and the hot tub and sauna, how you heard about us (optional), the language of the site and, if you tick it, your consent to receive news and offers.
Every visit passes through our web server, whose access log records your IP address, the page requested and your browser type. To limit automated requests, the server also holds your IP address in its memory, for about an hour. With a request we keep only a shortened form of your IP address (the last part removed, so it no longer identifies your connection), not your browser type. The hidden field in the form only serves to stop automated programs.
We do not ask for payment details on the website, and nothing is paid online.
Why we use it
To answer your request and prepare the booking (steps prior to a contract, Art. 6(1)(b) GDPR); for the tax records of confirmed bookings (legal obligation, point c); for the security of the website (legitimate interest, point f); and for news and offers only with your consent (point a), which you can withdraw at any time.
How long we keep it
Requests that do not become bookings (including cancelled ones for which no deposit was paid) are deleted automatically 12 months after the requested departure date. For stays, your name, phone number, email address and message, and our notes, are anonymised automatically 36 months after departure; the dates, number of guests and amounts remain for our accounts. Invoices are kept for as long as tax and accounting law requires. Your consent to news and offers applies until you withdraw it or until your details are deleted or anonymised as described here. The web server's access log is deleted after 90 days and database backups after 14 days. The shortened IP address stays in our security log, together with the dates and number of guests of the request; that log cannot be altered and is kept for as long as the website runs.
Who has access
Only we see your data. It is processed on our behalf only by the providers the website cannot work without: the company hosting the website (in the European Union), the network and protection provider through which visits to the website may pass, the email provider through which we receive notifications of new requests, and Google, through the Gmail service, where those notifications arrive. Some of them may also process data outside the European Union, with the safeguards the GDPR requires. We do not sell your data or pass it to other companies for marketing.
If you choose to continue on WhatsApp, you send the message yourself through the WhatsApp app, and WhatsApp's (Meta's) terms also apply to it.
Cookies and external services
The public website uses no cookies and no tracking.
The interactive maps on the home page and the Surroundings page use OpenStreetMap data delivered by OpenFreeMap, a service of Hyperknot Software Kft. (Hungary). The map data (images, styles and fonts) passes through our server: your browser does not connect to OpenFreeMap, and OpenFreeMap receives neither your IP address nor any other data about you. Our server handles these requests like any other request to the website.
The camera at the entrance
One video camera watches the main entrance, for the safety of the house and its guests (legitimate interest, Art. 6(1)(f) GDPR). Only the owner sees the images. They are deleted automatically after a short time and are not shared with anyone, except where the law requires it.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you may withdraw your consent at any time. To exercise any of them, write to claudiuarc@gmail.com. You may also lodge a complaint with the Romanian data protection authority, ANSPDCP (www.dataprotection.ro).