This is an English translation provided for convenience. In case of any discrepancy, the Romanian version prevails. Read the Romanian version
Who processes the data
LA MAISON DE CAROLINE S.R.L., CUI RO29092584, Trade Reg. No. J2011000648017, with its registered office at Str. Primăverii nr. 11, Alba Iulia 510101, jud. Alba, Romania (“we”), is the controller of the personal data collected through lmdc.ro and at the reception of La Maison de Caroline guesthouse. For any question or request regarding your data: contact@lmdc.ro, 0752 624 766.
We process data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), Law no. 190/2018 implementing the GDPR and Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.
What data we collect, why and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| First name, surname, email, telephone, country, city, arrival time, booking notes | Receiving, confirming and managing your booking; contacting you before and during your stay | Performance of the contract |
| Identity document details, at check-in | Register of accommodated guests | Legal obligation |
| Amount, payment result, transaction code; billing details | Collecting payment and issuing tax documents | Performance of the contract and legal obligation |
| Name, telephone, email, date, number of guests and notes for a restaurant reservation | Reserving your table | Steps taken at your request before entering into a contract |
| Name, email, telephone and the message sent through the contact form | Replying to your message | Legitimate interest (replying to you) |
| Email address, if you ticked that you would like to receive offers | Sending occasional offers | Consent, which you may withdraw at any time |
| Website usage data (pages visited, device, approximate city), through Google Analytics | Visit statistics, so that we can improve the website | Consent (cookie banner), which you may withdraw at any time |
| IP address, technical logs | Website security, prevention of fraud and abuse | Legitimate interest |
The details marked as mandatory in the forms are required for the booking: without them, we cannot confirm it. If you tell us in the notes about allergies or medical needs, we use this information strictly to look after you properly.
Card details never reach us: they are entered directly on the secure page of the payment processor (NETOPIA Payments). We receive only the payment result and a reference code.
Who we share the data with
- the payment processor NETOPIA Payments, for card payments;
- the provider that hosts and manages the website and the booking system (ARTON MEDIA S.R.L., Alba Iulia);
- the email service provider through which we send confirmations;
- Google Ireland Ltd., for Google Analytics statistics, only if you have given your consent;
- our accountants, for tax obligations;
- the authorities, where the law requires us to.
Our providers process the data on our behalf, under contract, and only for the purposes above. We do not sell the data and do not use it for other companies’ advertising.
Transfers outside the European Economic Area
With your consent, Google Analytics data may also be processed by Google in the USA, on the basis of the EU–US adequacy decision (Data Privacy Framework). Otherwise, we do not transfer data outside the EEA. The map on the website (OpenStreetMap) loads only if you press “Show map”; your browser then connects to the OpenStreetMap servers, which can see your IP address.
How long we keep the data
- bookings and tax documents: for the period required by financial and accounting legislation;
- data in the register of accommodated guests: for the period required by law;
- restaurant reservation requests and messages sent through the contact form: no longer than 12 months;
- the address for offers: until you unsubscribe;
- technical logs: no longer than 12 months.
Your rights
You have the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability and the right to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal. We do not take decisions based solely on automated processing that produce legal effects concerning you.
Requests should be sent to contact@lmdc.ro; we reply within one month of receipt (a period that may be extended under the conditions laid down in the GDPR, in which case we will inform you).
You may lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. G-ral Gheorghe Magheru nr. 28-30, sector 1, București, Romania, www.dataprotection.ro.
Data security
The website uses an encrypted connection (HTTPS), and access to the booking system is restricted to the staff who need the data in order to serve you.
Minors
Bookings must be made by persons aged 18 or over. The data of children staying with their parents is processed only to the extent required by law, at check-in.
Cookies
Details in the Cookie policy.
Changes
We may update this policy; the date of the last update appears at the top of the page.