Data protection statement

1. Data protection in brief

General remarks

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that personally identifies you. Detailed information on data protection can be found in this data protection declaration.

Data collection on this website

Who is responsible for data collection on this site?

Data processing on this website is carried out by the website operator. Its contact details can be found in the “Note on the responsible entity” section of this data protection declaration.

How do we collect your data?

On the one hand, your data is collected when you provide it to us, e.g. by filling in a contact form or when you contact us by e-mail/phone. On the other hand, certain data is automatically collected by our IT systems when you visit the website (e.g. technical data about your browser or operating system).

What do we use your data for?

Some data is collected to ensure the error-free provision of the website. Other data may be collected to facilitate communication with you, for example when you contact us. If contracts are initiated or concluded on the site, the data submitted will also be processed for the purpose of offers, orders or other requests for services.

What rights do you have in relation to your data?

You have at any time the right to obtain, free of charge, information about the origin, recipients and purpose of the processing of your personal data. You also have the right to request the correction or erasure of such data. If you have given your consent to the processing of certain data, you may withdraw it at any time with effect for the future. In addition, you have the right, in certain circumstances, to request restriction of the processing of your data. You also have the right to lodge a complaint with the competent supervisory authority in Romania.

You can contact us at any time about these rights, as well as for other data protection questions.

2. Hosting

We host our website content with the following external provider:

External hosting

This website is hosted externally. Personal data collected on this website is stored on the hosting provider’s servers. This may include, in particular, IP addresses, contact requests, meta and communication data, contractual data, contact data, names and website hits.

External hosting takes place for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. (1) lit. b of Regulation (EU) 2016/679 – GDPR) and in the interest of the secure and efficient provision of our online offer (Art. 6 para. (1) lit. f GDPR). The hosting provider will process your data only insofar as this is necessary for the fulfillment of its service obligations and will comply with our instructions regarding this data.

We use the following hosting provider:

ALL-INKL.COM – Neue Medien Münnich Inh. René Münnich Hauptstraße 68, 02742 Friedersdorf, Germany

Further details on data protection at All-Inkl are available at: https://all-inkl.com/datenschutzinformationen/

Processing under a contract

We have concluded a processing contract with the provider on the basis of a power of attorney, whereby the provider undertakes to process personal data only in accordance with our instructions and in compliance with the GDPR.

3. General information and mandatory information

Data protection

The operators of this website take the protection of your personal data seriously. We process your data confidentially and in accordance with the legal provisions on data protection, in particular Regulation (EU) 2016/679 (GDPR) and relevant national legislation (e.g. Law No. 190/2018, Law No. 506/2004), as well as this data protection statement.

When using this website, various personal data may be collected. This data protection declaration explains what data we collect and for what purpose we use it. It also describes how and for what purpose this processing takes place.

Please be aware that the transmission of data over the Internet (e.g. by e-mail) may present security vulnerabilities. Absolute protection against unauthorized access by third parties cannot be guaranteed.

Note on responsible entity

The entity responsible for data processing on this website is:

SC RITZ TOUR SRL
Strada Oltului 67
535100 Băile Tușnad, Romania

Phone: 0724210739
E-mail: contact@pensiunea-ritz.ro

The responsible entity is the natural or legal person who decides alone or jointly with others on the purposes and means of processing personal data.

Storage duration

If no concrete storage period is specified in this data protection declaration, your personal data will be kept for as long as necessary to fulfill the purpose for which it was collected. If you make a justified deletion request or withdraw your consent, the data will be deleted, unless there are other legal grounds that require storage (e.g. legal retention obligations). In such cases, deletion takes place after the cessation of those grounds.

Legal bases

The processing of your personal data is based, depending on the situation, on the following legal grounds:

Art. 6 para. (1) lit. b GDPR : If the processing is necessary for the performance of a contract or for pre-contractual measures.
Art. 6 para. (1) lit. c GDPR : If we are obliged by law to process data (e.g. tax obligations).
Art. 6 para. (1) lit. f GDPR : On the basis of our legitimate interest, e.g. to ensure the security and functionality of the website.
Art. 6 para. (1) lit. a GDPR : If you request your explicit consent for a particular processing (does not apply to technical cookies, where consent is not required).

Recipients of personal data

In carrying out our business, we cooperate with various external entities (e.g. IT service providers, accounting, hosting). Personal data is only transmitted to them if it is necessary for the performance of a contract, if there is a legal obligation or if we have a legitimate interest. When we use processors, we sign appropriate processing contracts (Art. 28 GDPR).

Withdrawal of consent

If certain data processing operations are based on your consent, you may revoke that consent at any time with effect for the future. The lawfulness of previous processing remains unaffected by the revocation.

Right to object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, to the processing of personal data based on Art. 6 para. (1) lit. e or f GDPR, including profiling based on these provisions. If you object, we will no longer process that data, unless we can demonstrate legitimate grounds overriding your interests, rights and freedoms or the processing serves the establishment, exercise or defense of legal claims.

Right to complain

If you believe that your data processing rights have been violated, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. G-ral Gheorghe Magheru 28-30, 010336 Bucharest, Romania, telephone +40 318 059 211, e-mail anspdcp@dataprotection.ro, www.dataprotection.ro.

Right to data portability

You have the right to receive data that we process automatically, on the basis of your consent or for the performance of a contract, in a commonly used machine-readable format for transfer to you or to another controller.

Right to information, rectification and erasure

In accordance with the law, you have the right to obtain information about your data free of charge and, where appropriate, the right to have it rectified or erased.

Right to request restriction of processing

In certain situations, you have the right to request restriction of the processing of your data, e.g. while the accuracy of the data is being checked or if the processing is unlawful but you do not want it to be erased.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential data (e.g. requests, orders) that you send to us through the site, we use SSL/TLS encryption. An encrypted connection is recognized by the change in the browser address bar from “http://” to “https://” and the padlock symbol.

Opposition to unsolicited advertising emails

We object to the use of contact data published in the context of legal obligation (e.g. contact data in the “Imprint/Legal Information” section) for the transmission of unsolicited advertising. We reserve the right to take legal action in the case of unsolicited sending of advertising information (e.g. spam e-mails).

4. Data collection on this website

Cookies

We only use technical (strictly necessary) cookies, which are essential for the proper functioning of the website. These cookies do not collect or store information for analysis, advertising or marketing purposes. According to art. 6 para. (1) lit. f GDPR and Law no. 506/2004, our legitimate interest is to ensure the functionality and security of the website.

These cookies are usually session cookies and are automatically deleted when you close your browser. You can set your browser to block cookies, but some site functions may be affected.

Server log files

The site provider automatically collects and stores information in server log files, which your browser automatically transmits. This includes: browser type and version, operating system, referring URL, host name of the accessing device, server request time and IP address. This data is processed solely to ensure the functionality and security of the website (Art. 6 para. (1) lit. f GDPR). There is no combination of this data with other data sources.

Contact form

If you send us enquiries via the contact form, the data in the form, including your contact details, will be processed in order to respond to the enquiry and, where appropriate, for further enquiries. The legal basis may be Art. 6 para. (1) lit. b GDPR (when the request is related to a contract) or our legitimate interest in responding to requests (Art. 6 para. (1) lit. f GDPR).

Request by e-mail, phone or fax

If you contact us by e-mail, telephone or fax, we will store and process the resulting data (e.g. name, content of the request) in order to respond to your request. The legal basis is Art. 6 para. (1) lit. b or f GDPR. This data will not be passed on to third parties without your consent, except for legal obligations.

Communicating by WhatsApp

We also use the WhatsApp messaging service (WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Grand Canal Harbour, Dublin 2, Ireland) to communicate with customers or potential customers. Messages are end-to-end encrypted, but WhatsApp may have access to metadata (e.g. sender, recipient, time). Chat content will be stored with us for as long as necessary for the purpose of communication and then deleted. More details about WhatsApp’s privacy policy: https://www.whatsapp.com/legal/#privacy-policy.

Please be aware that your use of WhatsApp involves the transfer of data to servers outside the EU, in line with WhatsApp’s commitments to comply with European data protection standards. If you prefer not to use WhatsApp, you can contact us by email, phone or contact form.

Updated version valid from February 2025. For further questions or clarifications, please contact us.