PRIVACY POLICY

1. What data do we process and why?

Enquiries and quotation requests

We process your name, email address, telephone number, company name for a corporate event, and the proposed date, number of attendees and message content, so that we can respond, prepare a quotation and take steps at your request before entering into a contract. Our legal basis is Article 6(1)(b) GDPR; for a general enquiry, we rely on our legitimate interest in responding under Article 6(1)(f) GDPR.

Booking and provision of the service

We process the identification and contact details of the guest and contact person, stay dates, selected services, number of guests, payment status, billing details and any special requests you communicate to us, in order to manage the booking, perform the contract, issue invoices and comply with legal obligations. Our legal basis is Article 6(1)(b) and (c) GDPR.

Payment and accounting

We process the payment amount, status, date and transaction reference to verify payment, perform the contract, prevent fraud and comply with our accounting obligations. We do not receive or store full bank-card details or the security code.

Website security and troubleshooting

The server and security systems may record technical logs, such as the IP address, date and time, requested page, and browser and device information, to maintain website security, prevent abuse and diagnose errors. Our legal basis is our legitimate interest in information security.

2. Where do we obtain the data?

We usually obtain data directly from you through forms, by email or telephone, via the booking interface or at the property. We may also receive data from someone booking on behalf of other guests or from the booking intermediary you use. If you provide another person’s data, please inform them of this policy in advance.

Without the data marked as required, we cannot respond to your enquiry or process your booking. Please do not include health information or other special-category data in the general message field unless it is strictly necessary to arrange the requested service safely.

3. Contact and quotation-request forms

The forms are handled by Contact Form 7. The source-page address, IP address and browser identifier may be associated with a submission for security and abuse-prevention purposes. Submissions are also recorded in the WordPress administration area through the Flamingo plugin and forwarded by email to Castor’s Gmail mailbox. FluentSMTP may retain technical email logs for up to 14 days to investigate delivery failures.

We retain closed enquiries that did not lead to a booking or contract for up to 12 months. If the discussion leads to a booking or contract, we may retain the related correspondence for as long as contractual or legal claims can be established, exercised or defended.

4. Online booking and payment

The online room-booking interface is provided by 5stardesk. When you open the service, the booking system receives technical information about the internet connection and may use session and preference cookies to operate. The provider sends the booking details entered in the interface to Castor so that the booking can be fulfilled.

Online card payments take place on the secure Raiffeisen Bank / EuPlătesc interface. The payment service provider independently processes the card details and performs authentication, authorisation and fraud-prevention checks. We receive only the transaction result and the information needed for settlement.

5. Cookies and external content

The website may use technical storage needed for its essential operation and language settings. We load the booking interface only after your express choice; at that point, 5stardesk may use session and language cookies and longer-lived technical identifiers. The external service processes data under its own rules.

• 5stardesk PHPSESSID: maintains the booking session until the browsing session ends.
• 5stardesk lang: remembers the selected language for up to 30 days.
• 5stardesk t and tid: technical identifiers used by the booking system for up to 360 days.

Some pages can display Google Maps. We load the external map only after your express choice. When it loads, Google receives information including your IP address, browser details and the address of the page visited, and may use its own cookies or similar technologies. The introduction video shown on the event pages is served from our own server, so playing it does not involve YouTube.

We do not currently use Google Analytics, Meta Pixel or similar traffic-analysis or advertising-tracking systems. If we introduce consent-based analytics or marketing technologies in the future, we will activate them only after your prior choice and will update this policy.

6. Recipients, processors and international transfers

Data is accessible only to staff who need it for booking, hospitality, event organisation, invoicing or customer service. Where necessary, we use web-hosting and maintenance, email, booking, payment, accounting and information-security providers that act under contract and appropriate confidentiality and data-protection obligations.

When Google provides international services, data may also be processed outside the European Economic Area. In such cases, the transfer may be covered by an adequacy decision applied by the provider, the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Current details are provided in the provider’s privacy policy.

We disclose data to a public authority, court or other authorised body when required by law or where necessary to establish, exercise or defend a legal claim.

7. How long do we retain the data?

• Unsuccessful or closed enquiries: up to 12 months.
• Booking and contract data: for the period of performance and then for the applicable limitation period.
• Accounting records: for the period required by Romanian accounting law, generally 5 years from 1 July of the year following the relevant financial year.
• Web-server and security logs: generally up to 30 days, unless investigating a security incident requires longer retention.
• FluentSMTP technical email logs: up to 14 days.

When the retention period expires, we delete or irreversibly anonymise the data unless further retention is justified by law or an ongoing legal claim.

8. Data security and automated decision-making

To protect data, we use access controls, up-to-date software, secure connections, backups and other technical and organisational measures appropriate to the risk. Complete security cannot be guaranteed when data is transmitted over the internet, but we seek to reduce known risks and handle incidents appropriately.

We do not carry out solely automated decision-making that produces legal or similarly significant effects, and we do not build a marketing profile about you on the website.

9. Your data-protection rights

Subject to the GDPR’s conditions, you may request access to your personal data, rectification or erasure, restriction of processing and, where applicable, data portability. You may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

You may send your request to our data-protection contact. To protect your identity, we may ask for reasonable verification. We respond without undue delay, normally within one month; for complex or numerous requests, this may be extended by a further two months, and we will inform you of the extension within one month.

10. Contact, complaints and changes to this policy

For a data-protection question or request, email castorharghita@gmail.com or write to the registered office of MARTVAR SRL.

You may lodge a complaint with the Romanian data-protection supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), Bd. G-ral Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro.

We may update this policy when services, technologies or laws change. The current version is available on this page together with its effective date.