The accommodation establishment Mălinului Resort & Spa undertakes to protect and respect the confidentiality of the personal data you entrust to us. This document contains important information about how we use the data collected. It describes how we collect, use, process and transmit the data you provide to us when you access and use our booking system. Those who access and use our booking system shall hereinafter be referred to as "users".
Users are invited to read this document, entitled "Privacy Statement", carefully. The user freely and voluntarily expresses their will to provide their own personal data, or that of third parties, to the accommodation establishment Mălinului Resort & Spa.
By the terms "booking system", "booking engine", "system", "website", "platform", "application", "web application", "services" and "online services", we mean all the online pages and services we operate on the website https://malinuluiresort.ro/, except where stated otherwise. By accessing the platform and providing us with your data, you consent to the provisions of our Privacy Statement as described in this document. The Statement may change from time to time, so we advise you to check it accordingly to make sure you are aware of the latest version.
Terms used
By the terms "we", "us" and "our", we mean the accommodation establishment Mălinului Resort & Spa.
Data controller: the accommodation establishment Mălinului Resort & Spa operates the booking system through a data processor, as explained below. Under the GDPR, the accommodation establishment is the data controller and the party that determines the purpose and the means by which the data is processed.
Mălinului Resort & Spa (accommodation establishment)
Company: Aframe Campulung S.R.L.
Address: Bughea de Sus, Strada Raului
Tax identification code (CUI): RO49082410
Trade Register No.: J03/2412/2023
1. What personal data users are asked to provide
Users are asked for their name, address, telephone number and email address, financial details for making the payment, and the names of the guests travelling with them. This may also include the IP address. This information is necessary and mandatory (unless otherwise specified in the relevant fields) in order to process the user's request, and is stored in the website's database for the purpose of processing the booking. If the user refuses to provide it, the request cannot be carried out. Users may be contacted by those who manage the accommodation establishment in connection with the booking. Their personal data is also stored after the stay, but will be kept only for as long as necessary in accordance with legal obligations.
2. Personal data processed directly by third parties
If users provide financial information (bank card details), it will be processed directly by payment processors holding PCI Level 1 certification, such as euplatesc.ro, PayPal, Authorize.net, Netopia, Stripe, etc.
3. Personal data of third parties (bookings for companions, friends, family members, etc.)
Where the user provides the data of a third party, it is presumed that the user has that person's consent and has passed on to them the information in this Privacy Statement, the data controller and the data processor being released from any liability in this respect. However, we may carry out additional checks, taking the appropriate measures in accordance with the legislation in force.
4. Purpose of using personal data
Depending on users' requests, the data collected will be processed for the following purposes:
- Managing the bookings made, including making the payment (where applicable) and handling the requests and preferences expressed by the user
- Managing users' enrolment in loyalty programmes and the obtaining of membership status
- Contacting users for the purposes listed here
- Sending personalised commercial offers by electronic means, where the user has given consent
- Managing additional services
- Conducting surveys and assessments of the quality of the services provided
5. Personal data retention period
The data is retained for the period necessary to fulfil the purposes listed above, except where it is needed for a longer period and this is permitted by law, or where the user requests its deletion by withdrawing consent. The criteria for determining the retention period are:
- The period during which the user has a relationship with the data controller in which the controller provides services to the user (for example, the period during which the user has an account in the booking system, or uses its services, or the period before the stay)
- Where there is a legal obligation (certain laws require the data controller to keep transaction data for a certain period of time before it is permitted to delete it)
6. Use of users' social media accounts
In the event of registration or login through a user account on a social media platform, we may collect and access various information from the user's profile on that social network for internal administrative purposes and/or the purposes set out above.
7. Security procedures
In accordance with the General Data Protection Regulation, AFRAME CÂMPULUNG SRL ensures the reasonable implementation of the procedures necessary to prevent unauthorised access to and improper use of personal data. We use appropriate systems and procedures to protect and keep secure the information transmitted to us. We also use technical and security procedures and physical restrictions to prevent access to and use of personal data on our servers. Only authorised staff have access to personal data, and only in the course of performing their work duties.
Data is processed in such a way as to ensure its security and to counter the risk of it being altered, lost, or unlawfully processed or accessed, taking into account the nature of the technology, the information stored and the risks to which it is exposed.
8. Users' control and rights over their personal data
Users have the right to access the data stored by the accommodation establishment. To do so, they should contact AFRAME CÂMPULUNG SRL by email at campulungchalet@gmail.com.
Users have the right to request the deletion of the data they have provided at any time.
Users have the right to modify any incomplete or invalid data.
Users have the right to request the deletion of their data when it is no longer necessary for the purposes for which it was collected and stored.
Users have the right to confirm the withdrawal of their consent.
9. Users have the right to obtain the restriction of data processing where the conditions laid down in the rules on the processing of personal data allow it.
Users have the right to request the portability of their data.
Users are also informed that they may at any time lodge a complaint concerning the protection of their personal data with the competent authorities.
Legitimate interest in processing the user's data
We may use users' information for legitimate purposes, such as administrative purposes, fraud detection or legal purposes.
The processed data we request in order to fulfil the purposes listed above may not be used without the user's consent. Furthermore, if the user withdraws consent, this will not affect the lawfulness of the prior processing of their data. To withdraw consent, the user must contact us through the channels mentioned above. Similarly, in cases where processing a user's data is necessary to fulfil a legal obligation or to perform a contractual relationship between us and the user, the processing will be legitimate, as it is necessary to achieve those objectives.
10. Cookies
The term "cookie" refers to a small amount of information placed in the web browser on the computer or mobile device used by users. Cookies are used to make the booking process easier and contain information such as the dates searched and the language in which the booking is made. There is a difference between temporary cookies and persistent cookies. Temporary cookies exist only until the web browser is closed. Persistent cookies are used for a longer time and are not deleted automatically when the browser is closed. We use persistent cookies in Google Analytics to analyse visitor traffic and behaviour. By using the website malinuluiresort.ro or making bookings through malinuluiresort.ro, you consent to the use of cookies as described above.
12. Use of the services by minors
The services are not intended for individuals under the age of 18, and we do not ask them to provide personal data.
13. Disclosure of personal data
Personal data will be used and disclosed in the following cases:
- To comply with the laws in force, including the laws of the user's country of residence
- To respond to a request in the course of legal proceedings
- To respond to requests from government authorities, including authorities outside the user's country of residence, and to meet national security requirements
- To enforce the terms and conditions
- To protect the rights, privacy and data security of ourselves, of users and of third parties
We may use and disclose Other Data for any purpose, except where current legislation does not permit this. In certain cases, we may combine Other Data with personal data (for example, the user's name with their location). If we do so, we will consider and treat the data resulting from this combination as personal data for as long as the combination is maintained.
14. User obligations
The user warrants that they are legally responsible and in full possession of their mental faculties, and that the information provided is true, valid, complete and up to date. The user is solely responsible for the accuracy of the data provided and undertakes to update the information when necessary.
The user undertakes, where applicable, to inform the third parties whose personal data they provide of the information in this document. The user also undertakes to obtain the third parties' approval for the provision of their personal data for the purposes set out above.
The user is liable for any false or invalid information provided through the website and for any resulting damage, direct or indirect, caused to us or to third parties.
Amounts paid for accommodation vouchers and cancelled bookings are non-refundable!