Privacy Policy

1. Data Controller Identity

The personal data controller for the website arcchalettransylvania.ro is:

• SC Speedbos S.R.L.
• CUI: RO24407347
• Registered office: Str. Dobrogeanu Gherea nr. 61, Târgu Mureș, postal code 540353, Mureș County, Romania
• Contact person: Bosa Adrian
• Email: Arcchalet@gmail.com
• Phone: +40 731 575 060

2. What Data We Collect

Through the booking form on the website, we collect: first and last name, phone number, email, stay dates (check-in/check-out), number of guests (adults/children), and the chosen villa (Sky View, Family Lodge, or both).

The property is equipped with a video surveillance system on the exterior of the buildings, for safety reasons. Recorded footage constitutes personal data when it allows for the identification of a person.

3. Data Processing Channels

Data from the booking form is transmitted and stored via Google Firebase Firestore (servers in Frankfurt, Germany — European Union) and, optionally, via WhatsApp (Meta), if you choose to send your booking request this way.

4. Legal Basis for Processing

• Art. 6(1)(b) GDPR — performance of a contract (processing the booking request)
• Art. 6(1)(c) GDPR — compliance with a legal obligation (tax/accounting records)
• Art. 6(1)(a) GDPR — explicit consent, given by checking the GDPR box on the form
• Art. 6(1)(f) GDPR — legitimate interest, for video surveillance for the safety of the property and its guests

5. Data Retention Period

• Booking data (requests, contact details): 3 years from the stay date
• Documents with tax relevance (invoicing): 10 years, in accordance with applicable accounting legislation
• Technical website connection data: 90 days

6. Who We Share Data With

• Google Firebase (Frankfurt, EU) — storage of booking requests
• Meta / WhatsApp — if you choose to send your request via WhatsApp
• Public authorities — police authorities, exclusively upon written request, including for video recordings

We do not sell or rent your data to third parties for marketing purposes.

7. Your Rights

Under the General Data Protection Regulation (GDPR), you have the right to: access your data, rectification, erasure ("the right to be forgotten"), restriction of processing, data portability, objection to processing, and to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, you can contact us at Arcchalet@gmail.com. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro.

8. Data Security

• Secure HTTPS connection across the entire website
• Firestore security rules that restrict access to stored data
• Password-protected access to the management dashboard
• Data stored on servers located within the European Union