Privacy Policy – Harmony Hill Chalet
Last updated: 22.10.2026
1. Controller
ALESSDARI BUCOVINA S.R.L., tax ID (CUI) 51012204, trade register no. J2024047978007, registered office: Glodu village, Panaci municipality, no. 49A, Suceava County, e-mail: [email protected], phone: +40 764 954 785.
2. What data we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, e-mail, phone, dates of stay, number of guests, notes | Booking, payment, communication, carrying out the stay | Art. 6(1)(b) – performance of a contract |
| Payment data (amount, payment status; card data stays with Stripe) | Payment processing, accounting records | Art. 6(1)(b) and (c) – legal obligations |
| Messages sent by e-mail, phone, WhatsApp or social media | Answering enquiries | Art. 6(1)(f) – legitimate interest |
| Anonymous statistics without cookies (Cloudflare Web Analytics: pages viewed, country, device type; no personal profile) | Visitor numbers, improving the site | Art. 6(1)(f) – legitimate interest |
| Website usage data (Google Analytics) | Statistics, improving the site | Art. 6(1)(a) – consent |
| Technical data (IP address, browser type) when the Google Maps map is shown | Showing the map | Art. 6(1)(a) – consent |
| Basic technical data (IP address, server logs) | Security and operation of the site | Art. 6(1)(f) – legitimate interest |
We do not ask for more data than needed. Providing booking data is necessary to conclude the contract.
3. Recipients
- Stripe (payment processor) – online payment. Stripe has its own privacy policy and also acts as an independent controller for its legal obligations.
- Cloudflare – website hosting, content delivery and the technical booking database.
- Google (Analytics, Maps) – only with your consent.
- Accountant/authorities – where required by law.
- Resend (sending confirmation e-mails; servers in the EU, Ireland).
We do not sell your data.
4. Transfers outside the EEA
Some recipients (Stripe, Cloudflare, Google) may also process data outside the European Economic Area, based on appropriate safeguards (standard contractual clauses or the EU–US data privacy framework adequacy decision, where applicable).
5. Retention
- Booking and payment data: 5 years after the end of the financial year, as required by accounting law.
- Messages without a booking: 12 months.
- Cookies and analytics data: see the cookie policy.
- Where deletion would breach a legal obligation, data is kept only as long as necessary.
6. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time (without affecting earlier processing). Write to [email protected]; we reply within one month.
You may lodge a complaint with the Romanian data protection authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro.
7. Cookies
See the Cookie Policy. You can change your choice at any time via "Cookies" in the page footer.
8. Security
The site uses an encrypted connection (HTTPS). Payments are made on Stripe's secure page.
9. Changes
We may update this policy; the current version is published on the site.