1. General information

   The confidentiality of your personal data is one of the main concerns of HOTEL CINDREL, based in STATIUNEA PALTINIS, Sibiu County, as a data operator.
   This document is intended to inform you about the processing of your personal data, in the context of using the website www.hotelcindrel.ro.

   Categories of personal data processed

   II.1. If you are a customer of the Website, www.hotelcindrel.ro will process your personal data, such as name and surname, telephone, e-mail address, as well as any other categories of data that you provide directly in the context, in the context of placing a booking through the website or in any other way resulting from the use of the website.

   II.2. If you are a visitor to the Site, HOTEL CINDREL will process your personal data that you provide directly in the context of using the Site, such as the data that you provide in the contact / questions / complaints section, in the extent to which you contact us in this way.

   III. Purposes and grounds of processing

   If you are a customer of the Website, HOTEL CINDREL processes your personal data as follows:
   for booking a visit to Hotel Cindrel, respectively for taking over, validating, informing you about the status of the reservation and organizing the visit.

   Basis: The processing of your data for this purpose is based on the contract concluded between you and [website owner], defined in the Terms and Conditions [hyperlink to T&Cs].

   The provision of your personal data is necessary for the execution of this contract. The refusal to provide the data may result in the impossibility of developing the contractual relationship between you and [website owner].

   You can express your consent to the processing of data for this purpose by checking the appropriate box at the time of account creation, or after account creation, in the My Account Information section.

Providing your data for this purpose is voluntary. The refusal to provide consent for the processing of your data for this purpose will not have negative consequences for you.

If you are a visitor to the Site, Hotel Cindrel processes your personal data as follows:
to resolve complaints, complaints and to monitor traffic and improve your experience on the Site.

Grounds: The processing of your data for this purpose is based on the legitimate interest of [website owner] to ensure the proper functioning of the Site, as well as to permanently improve the experience of the Site’s visitors, including by solving various comments, questions or complaints.

Providing your data for this purpose is voluntary. Refusal to provide data for this purpose will have no negative consequences for you.

The duration for which we process your data

As a principle, HotelCindrel will process your personal data as much as is necessary to achieve the processing purposes mentioned above.

If you withdraw your consent for data processing for marketing purposes, [website owner] will stop processing your personal data for this purpose, without affecting the processing carried out by [website owner] based on your consent before its withdrawal.

1. Disclosure of personal data

   To fulfill the processing purposes, HOTEL CINDREL may disclose your data to partners, to third parties or entities that support [the website owner] in carrying out the activity through the Website (for example courier companies, IT service providers), or to the central/local public authorities, in the following exemplary cases listed:

   for the administration of the Site;
   in situations where this communication would be necessary for the awarding of prizes or other facilities to the persons concerned, obtained as a result of their participation in various promotional campaigns organized by the [website owner] through the Site;
   to maintain, customize and improve the Site and the services provided through it;
   to perform data analysis, testing and research, monitor usage and activity trends, develop security features and authenticate users;
   for the transmission of commercial marketing communications, under the conditions and limits provided by law;
   when the disclosure of personal data is provided by law, etc.
   Transfer of personal data

   Personal data provided to [website owner] may be transferred outside of Romania, but only to European Union states. [Note: If transferred outside the EU, states must be mentioned and what are the safeguards for data protection in the context of the transfer.]

ARE YOU COMING. Your rights

Under the conditions provided by the legislation on the processing of personal data, as data subjects, you benefit from the following rights:

• the right to information, respectively the right to receive details regarding the processing activities carried out by the [website owner], as described in this document;
• the right of access to the data, respectively the right to obtain confirmation from the [website owner] regarding the processing of personal data, as well as details regarding the processing activities such as the way in which the data are processed, the purpose for which the processing is done , recipients or categories of data recipients, etc.;
• the right to rectification, respectively the right to obtain the correction, without justified delay, by the [website owner] of inaccurate/unjustified personal data, as well as the completion of incomplete data;
• The correction/completion will be communicated to each recipient to whom the data were sent, unless this proves impossible or involves disproportionate efforts.
• the right to delete data, without undue delay, (“the right to be forgotten”), if one of the following reasons applies:
  they are no longer necessary to fulfill the purposes for which they were collected or processed;
  if consent is withdrawn and there is no other legal basis for processing;
  if the data subject objects to the processing and there are no overriding legitimate reasons;
  if the personal data were processed illegally;
  if personal data must be deleted to comply with a legal obligation;
  personal data were collected in connection with the provision of information society services according to Union law or internal law under which the operator is subject.

It is possible that, following the request to delete the data, the [website owner] will anonymize this data (thereby depersonalizing it) and continue the processing for statistical purposes under these conditions;

• the right to restrict processing to the extent that:
  the person contests the accuracy of the data, for a period that allows us to verify the correctness of the data;
  the processing is illegal and the data subject opposes the deletion of personal data, requesting instead the restriction of their use;
  the operator no longer needs the personal data for the purpose of processing, but the data subject requests them for establishing, exercising or defending a right in court; or
  the data subject has objected to the processing (other than those for direct marketing), for the time interval in which it is verified whether the legitimate rights of the operator prevail over those of the data subject.
• the right to data portability, namely (i) the right to receive personal data in a structured way, commonly used and in an easy-to-read format, as well as (ii) the right to have this data transmitted by [website owner] to another data operator, to the extent that the conditions provided for by law are met;
  the right to opposition – regarding processing activities can be exercised by submitting a request as indicated below;
  at any time, for reasons related to the particular situation in which the data subject is, that the data concerning him/her be processed on the basis of the legitimate interest of the [website owner] or on the basis of the public interest, except in cases where the [website owner -ului] can demonstrate that it has legitimate and compelling reasons that justify the processing and that prevail over the interests, rights and freedoms of the data subjects, or that the purpose is to establish, exercise or defend a right in court;
  at any time, free of charge and without any justification, that the data concerning it be processed for direct marketing purposes.
• the right not to be subject to an automated individual decision, i.e. the right not to be the subject of a decision taken solely on the basis of automated processing activities, including the creation of profiles, which produce legal effects concerning the data subject or similarly affect him in -a significant measure;
  the right to address the National Supervisory Authority for the Processing of Personal Data or the competent courts, to the extent you consider necessary.