Privacy policy

Who processes your data

The data controller for this website is CORSEM IMPEX SRL, VAT ID: RO4973970, Trade Register: J1993001947333, with its registered office at Str. Orizont nr. 6A, Gura Humorului, Suceava county, postal code 725300, Romania.

You can write to us or call us at any time about anything to do with your data, using the details in the page footer or the form on the contact page. Requests go directly to the management of the property.

What data we collect

The website has no user accounts, sells nothing online and processes no payments. The only place where you give us personal data is the enquiry form.

The fields of the contact form

• Name (required) — so that we know who we are replying to.
• Telephone (required) — the channel through which we confirm availability.
• Email (optional) — if you would rather have a written reply.
• Dates you have in mind (optional) — the arrival and departure dates.
• Number of guests (optional).
• Message (optional) — please do not include here any data about your health, your beliefs or other special categories of data.
• The language of the page and the moment consent was given — recorded automatically, as evidence of consent and so that we reply in the right language.

The legal basis on which we process

In order to answer your enquiry and check availability, the basis is Article 6(1)(b) GDPR — steps taken at your request before entering into an accommodation contract.

For keeping the message after the conversation has ended, and for any other use of the data from the form, the basis is Article 6(1)(a) GDPR — your consent, given by ticking the box on the form. Consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

Providing your name and telephone number is necessary if we are to reply. If you would rather not provide them, you can simply call us.

How long we keep the data

Messages received through the form are kept for 12 months from receipt and are then deleted permanently. That deletion does not depend on anyone remembering to do it: it runs automatically, every day, as a scheduled task in the application.

If your enquiry leads to a booking, the associated tax and accommodation records are kept separately, for as long as tax law and the rules on the registration of tourists require.

Who else has access to the data

• The reception staff and the management of the property, strictly in order to reply to you.
• The provider hosting the website and the database, on secure servers in the European Union.
• The secure email service provider through which reception receives your message.
• Public authorities, but only where the law requires it.
• We do not sell the data, we do not rent it out and we do not pass it to partners for marketing. We do not transfer data outside the European Economic Area.

What we do not do

• We load no non-essential cookie and no third-party service before you have explicitly agreed.
• We do not use Google Fonts: the fonts are served from our own server, so your IP address does not reach a third party merely because you opened the page.
• We do not use reCAPTCHA. The form is protected by an invisible honeypot field and by a check on how long it took to fill in, without processing your behaviour.
• Traffic statistics, if switched on, work without cookies, without a persistent identifier and without profiling.
• We do not profile you and we take no automated decisions that affect you.
• We neither ask for nor store card details: there is no online payment on this website.
• The Google map loads only after you press the dedicated button.

Your rights

• The right of access — to find out whether we process your data and to receive a copy of it.
• The right to rectification — to have inaccurate or incomplete data corrected.
• The right to erasure — to have your data deleted, where we no longer have a lawful reason to keep it.
• The right to restriction of processing — to have it kept but not used, while an objection is being checked.
• The right to data portability — to receive the data you provided in a structured, commonly used, machine-readable format.
• The right to object — to object to processing based on legitimate interests.
• The right to withdraw consent — at any time, as easily as you gave it.

How to exercise your rights

Send us a request through any of the channels in the page footer or through the contact page. We reply within one month of receipt; if the request is complex, we will tell you and may extend that period by a further two months.

We may ask you for additional information, but only enough to satisfy ourselves that the request comes from the data subject. Exercising your rights is free of charge; for manifestly unfounded or excessive requests, the law allows us to charge a reasonable fee or to refuse, giving reasons.

The right to lodge a complaint

If you are unhappy with the way we handle your data, tell us first: we will most likely sort it out quickly. You do, however, always have the right to go to the supervisory authority.

ANSPDCP — the Romanian data protection authority (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal)
B-dul General Gheorghe Magheru nr. 28-30, sector 1, Bucharest
www.anspdcp.ro

You may also apply to the competent courts.

Data security

The website is served exclusively over an encrypted connection. Access to the messages we receive is limited to the people who need them in order to reply to you, and the database is not publicly exposed.

No system is perfect. If a security incident occurs that is likely to affect your rights, we notify the authority within 72 hours of becoming aware of it and, where the law requires, we notify you as well.

Cookies and changes to this policy

The cookies the site uses, how long they last and how to withdraw consent are described separately in the Cookie policy.

If we change anything material in the way we process data, we update this page and the date at the top of it. We suggest you read it again before sending us new data.