Privacy Policy

1. Introduction

Rodnei Retreat & Spa (“we”, “our” or the “Data Controller”) respects the privacy of our website visitors and guests. This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website rodnei-retreat.dm.mitscaleup.com or interact with our services.

This policy has been prepared in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR) and Romanian Law No. 190/2018 on measures for the implementation of Regulation (EU) 2016/679.

2. Data Controller Identity

Data Controller: Rodnei Retreat & Spa
Address: Strada Pietroasa, nr. 35B, Borșa 435200, Județul Maramureș, Romania
Phone: +40 754 381 996
Email: contact@rodnei-retreat.com
Website: rodnei-retreat.dm.mitscaleup.com

3. What Personal Data We Collect

We collect the following categories of personal data:

3.1. Data you provide directly

• Contact information: your name, email address and phone number — when you contact us via the website contact form, by email, via WhatsApp or by phone
• Booking inquiries: information about requested stay dates, accommodation preferences and number of guests
• Communications: the content of any messages you send to us through any communication channel

3.2. Data collected automatically

• Web analytics data: we use Umami Analytics (self-hosted at umami.zxcpoi.com), a privacy-focused web analytics platform. Umami collects only aggregate and anonymous data, such as: pages visited, visit duration, referrer (traffic source), country of origin (based on IP address, without storing the IP address), device type and browser. Umami does not use cookies, does not track visitors across websites and does not collect personal data.
• Local preferences: we use localStorage in your browser to store your cookie consent preferences (key “cookie-preferences”). This data remains exclusively on your device and is not transmitted to our servers.

3.3. Data we do NOT collect

Our website does not use:

• Google Analytics or other advertising tracking platforms
• Facebook Pixel or other retargeting pixels
• Traditional cookies set by our website
• Cross-site tracking technologies

4. Purposes and Legal Basis for Processing

We process your personal data based on the following legal grounds under Art. 6 of the GDPR:

4.1. Performance of a contract or pre-contractual measures (Art. 6(1)(b))

• Processing booking inquiries and information requests
• Communicating with you regarding requested stays and services
• Providing accommodation and spa services

4.2. Our legitimate interest (Art. 6(1)(f))

• Improving our website and user experience based on aggregate analytics data
• Ensuring the security and proper functioning of the website
• Managing and conducting business operations

4.3. Your consent (Art. 6(1)(a))

• Loading Google Fonts from third-party servers (after consent is granted)
• Any other processing that requires your explicit consent

5. Cookies and Similar Technologies

Our website does not set traditional cookies. We use only localStorage to store your consent preferences. Our web analytics solution, Umami Analytics, is privacy-focused and operates without cookies.

For detailed information about the technologies used on our website, please refer to our Cookie Policy.

6. Third-Party Services

Our website interacts with the following third-party services:

6.1. Umami Analytics

We use Umami Analytics, a privacy-focused web analytics platform self-hosted at umami.zxcpoi.com. Umami does not collect personal data, does not use cookies and does not track visitors across different websites. All collected data is aggregate and anonymous.

6.2. Google Fonts

Our website loads web fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). When these fonts are loaded, your browser establishes a connection with Google servers, which may result in the transmission of your IP address to Google LLC. Google processes this data in accordance with its own privacy policies. Font loading is performed with your consent.

6.3. Booking.com

Our website contains external links to our listing on Booking.com to facilitate online reservations. When you follow these links, you are redirected to the Booking.com platform, which is a separate website with its own privacy policy. We do not integrate or embed Booking.com content on our website.

6.4. Social networks and external services

Our website contains external links to WhatsApp, Instagram, Facebook and Google Maps. These are navigation links only — we do not integrate widgets or scripts from these platforms on our website. When you follow these links, you will be directed to the respective platforms, which have their own privacy policies.

7. Data Retention Periods

We retain your personal data according to the following periods:

• Contact and booking inquiries: data is retained for the duration of the communication and a maximum of 2 years from the last interaction, unless required for ongoing legal or contractual obligations
• Web analytics data (Umami): aggregate and anonymous data is retained indefinitely, as it does not contain personal data
• localStorage preferences: these remain on your device until manually cleared by you in your browser
• Accounting and tax records: in accordance with Romanian law, accounting documents are retained for a period of 10 years

8. Your Rights Under the GDPR

In accordance with the GDPR and Romanian Law No. 190/2018, you have the following rights regarding your personal data:

• Right of access (Art. 15): the right to obtain confirmation that your data is being processed and to receive a copy of it
• Right to rectification (Art. 16): the right to request the correction of inaccurate data or the completion of incomplete data
• Right to erasure (Art. 17): the right to request the deletion of your personal data (the “right to be forgotten”), subject to legal retention obligations
• Right to restriction of processing (Art. 18): the right to request the limitation of the processing of your data in certain circumstances
• Right to data portability (Art. 20): the right to receive your data in a structured, commonly used and machine-readable format
• Right to object (Art. 21): the right to object to the processing of your data based on legitimate interest
• Right to withdraw consent: where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, please contact us at contact@rodnei-retreat.com or at our postal address. We will respond to your request within 30 calendar days.

9. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the GDPR or Romanian data protection legislation, you have the right to lodge a complaint with the supervisory authority:

National Supervisory Authority for Personal Data Processing (ANSPDCP)
Address: B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, 010336, Romania
Website: www.dataprotection.ro

Before lodging a complaint with the ANSPDCP, we encourage you to contact us first to try to resolve the matter directly.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction or accidental disclosure. These measures include:

• Encryption of all communications via HTTPS/TLS across the entire website
• Secure data storage on servers with restricted access
• Restricting access to personal data to authorized personnel who require it for their duties
• Regular monitoring of systems to detect vulnerabilities
• Using privacy-focused analytics solutions that minimize data collection

11. International Data Transfers

By loading fonts from Google Fonts (Google LLC servers, USA), your technical data (such as your IP address) may be transferred outside the European Economic Area. Google LLC participates in appropriate data transfer mechanisms, including the European Commission’s Standard Contractual Clauses, to ensure an adequate level of personal data protection in accordance with Art. 46 of the GDPR.

Umami Analytics is self-hosted and does not involve international data transfers.

12. Changes to This Policy

We reserve the right to update this Privacy Policy to reflect changes in our data processing practices or applicable legislation. Any significant changes will be published on this page with a new update date. We recommend that you review this page periodically.

13. Contact

For any questions, requests or concerns regarding this Privacy Policy or the processing of your personal data, you can contact us at:

Rodnei Retreat & Spa
Address: Strada Pietroasa, nr. 35B, Borșa 435200, Județul Maramureș, Romania
Phone: +40 754 381 996
Email: contact@rodnei-retreat.com
Website: rodnei-retreat.dm.mitscaleup.com