Privacy policy

This page describes how PENSION LA CUSCRII SRL. (hereinafter referred to as the "Operator") collects, uses and protects the personal data of people who use the website pensiune-arad.ro or who request our services.

1. Identity of the Data Controller

2. Data Collected and Purpose of Processing

2.1 Accommodation Reservations

When you make an accommodation reservation via website, phone or email, we collect: first and last name, phone number, email address, arrival and departure date, number of people.

Purpose: Confirmation and management of the reservation.
Legal basis: Execution of the contract — Art. 6 para. (1) lit. (b) GDPR.
Storage duration: 5 years from the end of the stay (accounting and tax obligations).

2.2 Private Event Bookings

For organizing events (baptism, wedding, conference, party), we additionally collect: event type, number of guests, special requirements, optional: company name (for corporate).

Purpose: Preparing the personalized offer and organizing the event.
Legal basis: Execution of the contract — Art. 6 para. (1) lit. (b) GDPR.
Storage duration: 5 years from the date of the event.

2.3 Online Payments

Card payments made on the site are processed through a secure payment processor (PCI-DSS certified). The operator does not store and does not have access to your bank card details. The payment processor acts as an independent or authorized operator, in accordance with its own privacy policies.

Legal basis: Execution of the contract — Art. 6 para. (1) lit. (b) GDPR.

2.4 Contact Forms

When you fill out a contact form or request a quote, we collect: name, phone number, email, message sent.

Purpose: Response to the request and related commercial communication.
Legal basis: Legitimate interest — Art. 6 para. (1) lit. (f) GDPR (response to a request initiated by the data subject).
Storage duration: 12 months since last interaction.

2.5 Browsing Data and Cookies

The site uses analytics (Google Analytics) and advertising (Google Ads) cookies that collect anonymized data about browsing behavior. Full details in Cookie Policy.

Legal basis: Your consent — Art. 6 para. (1) lit. (a) GDPR, expressed by accepting cookies on the first visit.

3. Duration of Data Storage

We store personal data only for as long as is necessary for the purpose for which it was collected:

• Contractual data (confirmed reservations, invoices): 5 years — legal tax and accounting obligations
• Data from contact forms / unconfirmed offers: 12 months
• Analytics data (cookies): according to the table in the Cookie Policy
• After the period expires, the data is deleted or anonymized.

4. Rights of Data Subjects

According to GDPR, you have the following rights in relation to your personal data:

• Right of access (Art. 15): You can request confirmation that we are processing data about you and a copy of it.
• Right to rectification (Art. 16): You can request the correction of inaccurate data or the completion of incomplete data.
• Right to erasure (Art. 17): You can request the deletion of data, under the conditions provided by law.
• Right to restriction of processing (Art. 18): You can request the temporary suspension of the processing of your data.
• Right to portability (Art. 20): You can request your data in a structured, commonly used and machine-readable format.
• Right to opposition (Art. 21): You can object to processing based on our legitimate interest.
• Right to withdraw consent: If the processing is based on consent, you can withdraw it at any time without affecting the lawfulness of the previous processing.

5. Transfer of Data to Third Parties

Your data may be transmitted to:

• Google LLC (USA) — by using Google Analytics and Google Ads services. The transfer is covered by EU-US Data Privacy Framework and the EU Standard Contractual Clauses. You can view Google's privacy policy at policies.google.com/privacy.
• Payment processor — exclusively the data necessary to complete the transaction.
• Public authorities — if Romanian or European law obliges us to do so (e.g. tax authorities, judicial bodies).

We do not sell, rent or disclose your data to third parties for commercial purposes.

6. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss or accidental disclosure, including:

• Secure SSL/TLS connection throughout the site (HTTPS)
• Access to stored data is restricted to authorized personnel.
• Complex and regularly updated passwords for internal systems

7. Cookies

Our website uses cookies. Full details about the types of cookies used, their duration and how to manage them are available in Cookie Policy.

8. Complaints to the Supervisory Authority

If you believe that your data protection rights have been violated, you have the right to file a complaint with National Supervisory Authority for Personal Data Processing (ANSPDCP):

9. Changes to the Policy

We may update this Privacy Policy periodically to reflect changes in our business or applicable law. The date of the last update is indicated in the page header. We recommend that you periodically review this page.

Current version: 1.0 | Effective date: April 9, 2026