Politica de confidențialitate

Last updated: 24.07.2026

1. Data controller

Ecvestria Ranch
Str. Ganjulești, nr. 35, Ocnele Mari, jud. Vâlcea, 245700
Phone: +40 376 441 115
Email: office@ecvestriaranch.ro

For GDPR requests, write to office@ecvestriaranch.ro, subject “Personal data”.

2. What data we process

• Identity and contact: name, phone, email.
• Booking data: period, number of adults/children, children's ages (if provided), room / package type, free-text messages.
• Group data (school trips): school/group name, number of teaching staff / parents, where applicable.
• Payment data: transaction status, amount, reference (via the processor; we do not store CVV or the full card number).
• Technical data: IP address, browser type, pages visited, cookies — see Cookie policy.
• Communications: content of messages sent by email, phone, WhatsApp or the site chat.

3. Purposes and legal bases (GDPR)

• Performance of the contract — taking, confirming and running the booking / stay.
• Legal obligation — invoicing, accounting records, handling complaints, cooperation with authorities.
• Legitimate interest — site security, fraud prevention, service improvement, defending legal rights.
• Consent — marketing communications (if requested) and non-essential cookies where applicable. Consent may be withdrawn anytime.

4. Recipients / processors

Data may be accessed, as needed, by:

• the payment processor (e.g. NETOPIA Payments);
• the hosting / IT maintenance provider;
• email / operational messaging services;
• accounting and legal advisers, within their mandate;
• public authorities when required by law.

We do not sell personal data to third parties for marketing purposes.

5. Transfers outside the EEA

As a rule, data is processed in Romania / the European Union. If a provider transfers data outside the EEA, we will use appropriate safeguards (e.g. standard contractual clauses), under the GDPR.

6. Retention period

• Booking / customer data: for the relationship and thereafter as required by law (typically up to 5–10 years for accounting documents).
• Unresolved requests / leads without a booking: typically up to 24 months, unless a longer legitimate interest or retention duty applies.
• Technical logs: short periods needed for security.

7. Your rights

Under the GDPR you may request: access, rectification, erasure (“right to be forgotten”, within legal limits), restriction, objection, portability, and withdrawal of consent. You may complain to the Romanian DPA (ANSPDCP) — www.dataprotection.ro.

We will reply within the legal timeframe (typically 30 days), after verifying the requester's identity.

8. Security

We apply reasonable technical and organisational measures (HTTPS, access control, backups). No internet transmission is 100% secure; please do not send unsolicited sensitive data over insecure channels.

9. Minors

The site is not aimed at children creating accounts. Data about minors appears only in bookings made by a responsible adult (parent / guardian / teacher).

10. Updates

We may update this policy. The version published on the site, with the header date, is the applicable one.