Back to Casa Frătilă

Privacy Policy

Last updated: 23 June 2026  ·  In accordance with GDPR (EU Regulation 679/2016)

1. Data controller

Frătilă Daniela P.F.A. (hereinafter "the Controller") processes personal data as data controller, in accordance with EU Regulation 679/2016 (GDPR) and Romanian Law no. 190/2018.

2. What data we collect

We collect personal data that you provide directly to us in connection with your booking or accommodation-related communications:

• Full name
• Phone number
• Email address (if provided)
• Stay details: dates, number of guests
• Communication history (WhatsApp messages, SMS, email, phone calls)

By visiting the website, our server may also record technical access data (IP address, browser type, pages visited, date and time) through standard technical mechanisms.

3. Purpose and legal basis for processing

Purpose	Legal basis (GDPR)
Managing and confirming accommodation bookings	Art. 6(1)(b) — performance of contract
Invoicing and accounting records	Art. 6(1)(c) — legal obligation
Communications about the booked stay (check-in, rules, confirmation)	Art. 6(1)(b) — performance of contract
Informing existing customers about offers or available dates	Art. 6(1)(f) — legitimate interest

4. Retention periods

• Booking and invoicing data: 10 years (as required by tax and accounting legislation).
• WhatsApp / email / SMS communications: maximum 2 years from the last interaction.
• Technical access logs: maximum 90 days.

Upon expiry of retention periods, data is deleted or anonymised.

5. Cookies and technical data

The casafratila.ro website uses the following categories of cookies and analytics tools:

• Technically necessary cookies — required for the proper functioning of the website (Google Fonts loading, browser session). These do not collect personally identifiable data and do not require prior consent under Article 5(3) of Directive 2002/58/EC.
• Google Analytics 4 (Google LLC) — we use Google Analytics (ID: G-1K0BVYLSJF) to analyse traffic and visitor behaviour on the website (pages visited, session duration, device, approximate location). Data is collected anonymously and in aggregate form. Google may transfer data outside the EEA; such transfers are covered by Standard Contractual Clauses approved by the European Commission. You may opt out via the Google Analytics Opt-out Browser Add-on.

The website does not currently use advertising cookies or Meta Pixel. If such tools are added in the future, this policy will be updated accordingly.

6. Recipients of your data

Personal data is not sold or transferred to third parties for marketing purposes. Data may be accessed by:

• The Controller's staff involved in managing bookings;
• Technical service providers (e.g. hosting, email) acting as data processors under agreements compliant with Article 28 GDPR;
• Public authorities, within the limits provided by law.

Data is not transferred outside the European Economic Area.

7. Your rights under GDPR

As a data subject, you have the following rights:

• Right of access (Art. 15) — to obtain confirmation that your data is being processed and a copy of it.
• Right to rectification (Art. 16) — to request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — to request deletion of your data under the conditions provided by law.
• Right to restriction of processing (Art. 18) — to request that processing be limited in certain situations.
• Right to data portability (Art. 20) — to receive your data in a structured format where processing is based on consent or contract.
• Right to object (Art. 21) — to object to processing based on the Controller's legitimate interest.
• Right not to be subject to automated decisions (Art. 22) — we do not make automated decisions with significant legal effects based on your data.

8. How to exercise your rights

You can send a request regarding your rights to casafratila@gmail.com or by post to the Controller's registered address.

We will respond to your request within 30 calendar days of receipt. For complex or extensive requests, this period may be extended by a further 60 days, with prior notification to you.

9. Right to lodge a complaint

If you believe your rights have not been respected, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), which is the competent supervisory authority in Romania:

• Website: dataprotection.ro
• Email: anspdcp@dataprotection.ro
• Address: B-dul Magheru 28-30, Sector 1, Bucharest, Romania

10. Changes to this policy

This policy may be updated periodically to reflect changes in legislation or our processing practices. The updated version will be published on this page with the date of the latest revision. We recommend checking this page periodically.

Last updated: 23 June 2026.