Privacy Policy

This policy explains what personal data we collect through the casalasaal.ro website and our contact channels (WhatsApp, telephone), why we collect it, how long we keep it and what your rights are, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.

1. Who the data controller is

The company operates the Casa La Saal guest house in Șeica Mare, Sibiu County, and is the data controller for the personal data collected through the website and the booking channels.

2. What data we collect

We collect personal data only when you provide it to us directly, for example through a booking request or a contact message:

• Identification and contact details: first and last name, phone number, email address.
• Booking details: the room requested, the dates of your stay (check-in / check-out), the number of guests.
• Content of your messages: what you send us via WhatsApp, by phone or through the website.

We do not collect bank card details through the website — any payments are discussed directly, through the contact channels above.

3. Purpose and legal basis

• Handling bookings and communicating with guests — basis: performance of a contract or pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Meeting legal obligations regarding the register of accommodated tourists — basis: legal obligation (Art. 6(1)(c) GDPR).
• Improving our services and answering questions — basis: legitimate interest (Art. 6(1)(f) GDPR).

4. Who we share data with

Your data is never sold and is not used for marketing purposes without your explicit consent. We may share it with:

• Technical infrastructure providers hosting the website and the booking database (Vercel and Upstash), strictly so that the site can function.
• WhatsApp / Meta Platforms, when you choose to contact us via WhatsApp — subject to that service's own privacy policy.
• Public authorities, when required by law (for example tourism records or tax authorities).

5. Transfers outside the European Economic Area

Our technical infrastructure providers (Vercel, Upstash) and the communication services you may use to reach us (WhatsApp / Meta) are companies that can store or process data on servers outside the European Economic Area, in particular in the United States.

Where such a transfer takes place, it relies on the safeguards set out in Chapter V of the GDPR — usually the Standard Contractual Clauses adopted by the European Commission, or an adequacy decision applicable to that provider (for example the EU–U.S. Data Privacy Framework). You can request further details about these safeguards by writing to the contact address below.

6. How long we keep data

We keep booking-related data for as long as the booking requires, plus the period imposed by tax and tourism-record legislation (as a rule up to 5 years from the end of the fiscal year in which the stay took place). Contact messages that did not lead to a booking are kept for as long as they remain relevant to our correspondence with you, and are deleted afterwards.

7. Cookies and similar technologies

The casalasaal.ro website does not use advertising, analytics or visitor-tracking cookies. We have no Google Analytics, no Meta pixel and no other profiling tools, and browsing the site does not build a profile of you.

The only technical elements involved are:

• Google Fonts, loaded from Google's servers so the page displays correctly. When a page loads, your IP address becomes visible to that service — this is a technical requirement of displaying the fonts, not tracking on our part.
• Server logs kept by our hosting provider (Vercel), which temporarily retain technical data such as IP address and browser type, for security and operation — basis: legitimate interest (Art. 6(1)(f) GDPR).
• Local storage in the admin panel (localStorage), used solely for the guest house administrator's session on a password-protected page. It is not accessible to site visitors and contains no data about them.

Because we use no cookies that require consent, the site displays no cookie banner. Should this change, we will update this policy and ask for your consent beforehand.

8. Automated decision-making and profiling

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Every booking request is reviewed and confirmed by a person.

9. Children's data

The website is not directed at minors and we do not knowingly collect data directly from them. When a booking includes children, their details (as a rule only the number and ages, so we can prepare the accommodation) are provided to us by the parent or legal guardian making the booking, under their responsibility.

If you become aware that a minor has sent us personal data without parental consent, please contact us at the address below and we will delete that information.

10. Your rights

Under the GDPR, you have the right to request:

• Access to the data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data, where there is no longer a legal basis for keeping it.
• Restriction of, or objection to, processing, under certain conditions.
• Portability of the data you provided to us directly.
• Lodging a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro.

To exercise any of these rights, contact us at ssmsibiu@gmail.com or on 0787 292 633. We reply free of charge within one month of receiving your request; if the request is complex, we will let you know and the deadline may be extended by up to two further months, in line with Art. 12 GDPR.

11. Data security

We take reasonable technical and organisational measures to protect data against unauthorised access, loss or accidental disclosure, using hosting providers with internationally recognised security practices. The site is served exclusively over an encrypted connection (HTTPS), and the guest house admin panel is password-protected and accessible only to authorised staff.

In the unlikely event of a security breach that could result in a high risk to your rights, we will inform you and notify the ANSPDCP within the deadlines set out in Art. 33–34 GDPR.

12. Changes to this policy

We may update this policy from time to time. The date of the latest update is shown at the top of the page. We recommend checking it occasionally.

13. Contact and complaints

For any question about this policy or about your data, write to us at ssmsibiu@gmail.com or call 0787 292 633.

We are not legally required to appoint a Data Protection Officer (DPO), as we neither process data on a large scale nor systematically monitor data subjects. Requests concerning personal data are handled directly by the management of SAXONIA TUR S.R.L.

If you believe we have infringed your rights, you may at any time contact the Romanian National Supervisory Authority for Personal Data Processing: