Loading…
APUSENI DIGITAL HUB S.R.L. · CUI 52599906
Version 1.0 — effective from the date of publication on the website
1.1. The data controller is APUSENI DIGITAL HUB S.R.L., CUI 52599906, J2025074412001, with its registered office in Dealu Bajului village, Arieșeni commune, 253A Principală Street, Alba County (“we”). For any personal data question or request: contact@exploreapuseni.ro; telephone 0750 269 246; or write to our registered office.
1.2. We determine the purposes and means of processing necessary to administer the Platform. This capacity is separate from our role as intermediary in the accommodation contract.
1.3. Hosts (Partners) are independent data controllers for processing necessary to provide accommodation and meet their legal obligations, including tourist records, invoicing and local tax. Hosts are responsible for their own processing; we are responsible for ours.
1.4. We have not appointed a data protection officer because that obligation does not apply to our activity. The address above is the channel for personal data requests.
2.1. This policy concerns people who browse the Platform, create accounts, submit booking requests, use messaging, request support or represent a host. Company information is personal data only insofar as it identifies an individual, such as a director, representative, account holder or individual professional.
2.2. We receive data directly from you through forms and messages; from Platform use (technical data); from the host or tourist involved in a booking; from Stripe concerning payment operations; and, where necessary, from public registers (Trade Register, ANAF) to verify hosts.
2.3. If another person provides information about you, such as someone booking for companions or a host's representative, we use only necessary information and inform you at the first communication or within one month at the latest.
3.1. Account and contact: first and last name, email address, telephone number, password (stored encrypted), language preference and account identifier. We do not collect identity document copies to create an account.
3.2. Booking: selected listing, dates, adult and child numbers, message to the host, request status (accepted/rejected/expired), accepted conditions and cancellation policy, price, cancellations and changes, and billing details supplied for the host's fiscal document.
3.3. Payment: transaction value and status, Stripe-generated payment and refund identifiers, card type and last four digits. We do not store the full card number or CVC; these are entered directly into Stripe's secure components.
3.4. Communications: favourites, messages exchanged with the host through Platform messaging, support requests and documents submitted for a complaint. Conversations are not public. We do not record telephone calls.
3.5. Technical data: IP address, access time, browser and device type, page accessed, authentication events and errors strictly necessary for Platform operation and security. Displaying a map does not mean that we track device location; we do not request access to your location.
3.6. Identity documents requested by the host at the property under its legal obligations are not uploaded to the Platform. Please do not send document copies, Romanian personal identification numbers (CNP), card details or medical information through messaging.
4.1. Registration: professional's company name or name, legal form, CUI/CIF and registration number, VAT status, registered office, representative's name and contact details, bank account (IBAN), and requested eligibility documents, such as proof of the right to operate and classification certificate.
4.2. Listing: property name and address, map coordinates, description, photographs, facilities, availability, rates and rules. Hosts must be entitled to supply photographs and avoid unnecessarily exposing people.
4.3. Payments and accounting: Stripe Connect account identifier and verification status, amounts received, commissions, processing costs, refunds, transfers and SmartBill invoices. We cannot access identity documents submitted directly to Stripe for verification.
4.4. Relationship administration: communications with the Operator, listing approvals, booking history, Featured subscription, complaints and account measures.
4.5. For platform operator tax reporting (DAC7, transposed through the Tax Procedure Code), where applicable we process legally required host information: identification, tax residence, tax identifier, property address, amounts paid and booking numbers, reported annually to ANAF.
5.1. Account creation and administration, favourites, requests and bookings, host messaging and service communications (confirmations, changes, cancellations and refunds): performance of our contract with you or pre-contractual steps you request (GDPR Article 6(1)(b)).
5.2. Host contract, listing administration, settlements and Featured subscription: performance of the contract with an authorised individual host (point (b)) or legitimate interest in performing the commercial relationship with the company represented by the contact person (point (f)).
5.3. Payment processing, refunds and settlements: contract performance (point (b)). Issuing and retaining accounting documents, tax reporting including DAC7, and mandatory responses to authorities: legal obligation (point (c)).
5.4. Account or booking support: contract performance. General enquiries from people without accounts: legitimate interest in responding.
5.5. Platform security, prevention of abusive access and fraud, and incident investigation: our and users' legitimate interest in protecting accounts, transactions and systems (point (f)).
5.6. Resolving complaints, damage claims and disputes, and preserving evidence: legitimate interest in establishing, exercising or defending a right (point (f)).
5.7. Host eligibility verification and content moderation: legitimate interest in ensuring safe, accurate offers and, where applicable, legal obligations governing online platforms.
5.8. Usage statistics (Google Analytics) and any marketing tools: only with your consent expressed through the cookie banner (point (a)), under the Cookie Policy. We send no newsletter without express subscription; booking service communications are not marketing.
5.9. Evidence of acceptance of conditions, privacy choices and handling GDPR requests: legal obligation (point (c)).
6.1. Required fields are marked in forms. Without data strictly necessary for an account, booking or payment, we cannot provide the requested operation. Declining an optional field does not prevent access to the core service.
6.2. Refusing statistical or marketing consent does not affect the ability to book. Accepting the Terms is not blanket consent to all processing.
6.3. We do not request tourists' CNP or identity document copies. From hosts we request only documents necessary to verify eligibility, retained under Article 9.
6.4. If we used data for a new purpose, we would assess compatibility and legal basis and inform you before the new processing.
7.1. From submission of a request, the host receives information necessary to assess it, provide accommodation and communicate with the tourist: name, telephone, email, dates, guest numbers, messages and billing information for the fiscal document. Card details are not sent to the host.
7.2. In the booking confirmation, the tourist receives host information necessary for legal information requirements and performance of the stay: identity, address and contact details.
7.3. Stripe (Stripe Payments Europe, Ltd., Ireland, and, for Connect accounts, Stripe Technology Europe, Ltd.) processes payments, refunds and hosts' Connect accounts. For host verification and fraud prevention, Stripe acts as an independent controller; information: https://stripe.com/privacy.
7.4. SmartBill (Intelligent IT S.R.L., Romania) is used as a processor to issue commission and promotion invoices to hosts; information: https://www.smartbill.ro/termeni-si-conditii.
7.5. Technical providers processing data on our behalf under data processing agreements (Article 28 GDPR) are Vercel Inc. (USA), for application hosting; Databricks, Inc. (USA), through the Neon service and affiliate Neon, LLC, for the Postgres database; Cloudflare, Inc. (USA), for R2 file storage and delivery; and Plus Five Five, Inc. (USA), operating Resend, for transactional emails. The development and maintenance company has limited technical access under confidentiality obligations. Details: Vercel DPA, Neon, Cloudflare DPA, Resend DPA.
7.6. Google Ireland Ltd. (Ireland) provides Google Maps and, only with analytics consent, Google Analytics 4. Meta Platforms Ireland Limited (Ireland) provides campaign measurement through Meta Pixel and Conversions API only with marketing consent. Google Ads is activated only with marketing consent and when campaigns are configured. Contact details for conversion matching are transformed with SHA-256 before transmission. Details: https://policies.google.com/privacy and https://www.facebook.com/privacy/policy/.
7.7. Accountants, auditors, lawyers and other advisers receive only data necessary for their duties, under confidentiality obligations. Tax authorities, courts and other authorities receive data where there is a legal basis and an applicable request or obligation.
7.8. AFIR/LEADER funding control and monitoring bodies may receive aggregate data and supporting documents during project checks, without general access to the tourist database, messaging or payment data.
7.9. Staff and collaborators have access only according to their duties. We do not sell or rent personal data.
8.1. Vercel, the Neon service, Cloudflare R2, Resend, Google and Meta may involve US processing or access from outside the EEA for service delivery and support. Contracting entities and countries are identified in Article 7; an entity’s country does not guarantee that all processing takes place there. Transfers rely, as applicable, on the adequacy decision for entities certified under the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses and supplementary measures in the data processing agreements.
8.2. Stripe processes data in the EEA; for any intra-group transfers, Stripe applies its own safeguards described in its privacy policy.
8.3. You may request further information and a copy of applicable safeguards at contact@exploreapuseni.ro.
9.1. Retention depends on purpose, legal obligations and evidentiary needs. Unnecessary data are deleted or anonymised.
9.2. Account data and favourites: for the account's lifetime. On closure, profile data with no other purpose are deleted within 30 days; only data necessary for legal obligations or disputes are retained separately.
9.3. Accounts inactive for more than 24 months are reviewed; we notify you by email before closure.
9.4. Booking records, accepted conditions, booking messages and complaint evidence: 3 years from the end of the stay, cancellation or resolution, corresponding to the general limitation period; longer selectively if litigation is ongoing.
9.5. Supporting documents and accounting registers (invoices, collection and refund records): 5 years from 1 July of the year following the financial year in which they were prepared (Article 25 of Accounting Law no. 82/1991). DAC7 reported data: 10 years under tax legislation.
9.6. Support requests from people without bookings: 12 months from closure. Technical security logs: 90 days, with limited retention of incident evidence. Evidence of GDPR request handling: 3 years.
9.7. Host verification documents: during the relationship and for 3 years after termination; where sufficient, we retain the verification result rather than a complete copy.
9.8. Backups are removed within 90 days of deletion from active systems; necessary deletions are reapplied on restoration.
9.9. Cookie durations appear in the Cookie Policy. Consent evidence is retained for 3 years, without continued tracking after withdrawal.
10.1. Access: confirmation of processing, a copy of data and information on its use.
10.2. Rectification: correcting inaccurate and completing incomplete data. Most account data can be corrected directly from your account.
10.3. Erasure under GDPR conditions. Erasure is not absolute: data needed for a legal obligation, such as accounting records, or defence of a right may remain; we explain the exception applied.
10.4. Restriction of processing in legally specified situations.
10.5. Objection to processing based on legitimate interests for reasons relating to your particular situation; for direct marketing, objection ends that processing.
10.6. Portability: receiving data you provided, processed automatically on the basis of contract or consent, in a structured, commonly used format.
10.7. Withdrawal of consent at any time, as easily as it was given (for cookies, through “Cookie settings” in the footer), without affecting the lawfulness of earlier processing.
10.8. We make no decisions based solely on automated processing that produce legal effects on you: hosts accept or reject booking requests, and a person decides account measures. Stripe's payment fraud checks are described in Stripe's policy.
11.1. Write to contact@exploreapuseni.ro or our registered office, describing the right exercised and relevant information. No special form or active account is required.
11.2. If there are reasonable identity doubts, we request only additional information necessary for verification, such as confirmation from the account's email address. We do not request a full identity document copy or passwords.
11.3. We respond without unjustified delay and within one month of receipt at the latest. For complex or numerous requests, this may be extended by two months, with notification during the first month. If we do not act on a request, we explain why and available challenge routes.
11.4. Exercising rights is free. Only for manifestly unfounded or excessive requests may we charge a reasonable fee or refuse, with justification. We protect others' rights when supplying conversation copies.
11.5. You may complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28–30 General Gheorghe Magheru Boulevard, Bucharest; https://www.dataprotection.ro/?page=Plangeri_pagina_principala. You may also contact the authority in your state of residence or a court. A prior complaint to us is not required.
11.6. For independent processing by the host or Stripe, address the request to them as well; we help identify the appropriate controller.
12.1. Accounts and bookings are intended for people aged at least 18. Minors may join a stay booked by an adult; we process only their number and, if the rate requires it, age. We do not profile children.
12.2. If we learn that a minor uses an account, we investigate and delete data lacking a legal basis, taking existing bookings into account.
12.3. We do not request health, religion or other special-category data. Describing accessibility needs, an incident or a cancellation reason may reveal such data; please provide only what is necessary, without diagnoses or full medical documents. Irrelevant data are removed.
13.1. We apply technical and organisational measures proportionate to risk: role-based access (tourist, host, administrator), authentication with a password stored encrypted, encrypted transmission (HTTPS), payment processing exclusively through PCI DSS-certified Stripe, security updates, backups and limited staff and maintenance-provider access.
13.2. No system offers absolute security. In a personal data breach posing a risk to your rights, we notify ANSPDCP within 72 hours and inform you without delay under the law. Suspected unauthorised access may be reported to contact@exploreapuseni.ro without transmitting secret details.
14.1. This policy identifies its version and effective date. Important changes are communicated by email and through the Platform; for new purposes requiring consent, we request it before processing. Continued Platform use does not replace legally required consent.
Request deletion in My account → Delete account after resolving active bookings and financial obligations. For help, email contact@exploreapuseni.ro. Payment and invoicing providers apply their own document-retention obligations.
Your profile, sign-ins, messages, favourites and drafts are erased. The account becomes “Utilizator șters”, and the email can be used for a new account. Identity and billing data needed for accounting documents are retained separately for 10 years after the document year ends, then anonymised. We retain the consent and deletion audit records.
A place for your plans