Privacy policy

1. Who we are

The data controller is Vatra Pro Concept SRL, registered office at Sat Rogojel, nr. 31, com. Săcuieu, jud. Cluj, România, tax ID (CUI) 46110478, trade register no. J2022002638122, which operates Vatra Village.

For any question about your data, contact us at contact@vatravillage.com or by phone at +40 742 466 611.

2. What data we collect and why

We only collect the data you give us through forms or messages, plus the minimum technical data needed to run the website:

• Booking request: the cabin, dates, number of guests, your name, email, phone, the website language and your notes — to check availability, contact you and complete the booking.
• Contact form: name, email, phone (optional), subject and message — to reply to you.
• Event enquiries at Vatra and local producer applications: your name, contact details and the details you send — to reply and arrange the collaboration.
• Newsletter: email address and language — to send you news about Vatra Village, only if you subscribe.
• Bookings made through Booking.com, Airbnb or other platforms: through our booking management system (Smoobu) we receive your name, contact details, dates and number of guests — to prepare your stay.
• WhatsApp or phone messages: the data you share with us — to reply and, where relevant, record your booking.
• Technical data: aggregated visit statistics (Vercel Web Analytics, cookie-free and without identifying you) and server logs, kept temporarily for security and troubleshooting.

Vatra Village is an adults-only retreat. We do not knowingly collect data about people under 18.

3. Legal basis

• Entering into and performing the accommodation contract, including pre-contractual steps (Art. 6(1)(b) GDPR) — for booking requests and bookings.
• Legal obligations (Art. 6(1)(c)) — for example tax and accounting records or the guest register.
• Our legitimate interest (Art. 6(1)(f)) — to answer messages, protect the website against abuse and understand, in aggregate, how the website is used.
• Your consent (Art. 6(1)(a)) — for the newsletter, statistics cookies and Google maps. You can withdraw it at any time.

4. Who we share data with

We do not sell or rent your data. We share it only with providers who help us operate, under contract and only as far as necessary:

• Supabase — database and authentication; servers located in the European Union (Frankfurt, Germany).
• Vercel Inc. (USA) — website hosting and cookie-free visit statistics.
• Smoobu GmbH (Germany) — booking management and calendar sync with booking platforms.
• Resend (USA) — sending confirmation and notification emails, when these are active.
• Google (Ireland/USA) — embedded maps and, if enabled, Google Analytics statistics; only with your consent.
• WhatsApp / Meta — only if you choose to message us on WhatsApp; WhatsApp's own policy then also applies.
• Booking.com, Airbnb and other platforms — if you book through them; they are independent controllers with their own privacy policies.
• Public authorities — only when required by law.

5. Transfers outside the European Economic Area

Some providers (Vercel, Resend, Google, Meta) may process data in the USA. Transfers rely on the EU-US Data Privacy Framework, where the provider is certified, or on standard contractual clauses approved by the European Commission.

6. How long we keep data

• Booking requests that did not turn into a booking: up to 12 months.
• Completed bookings: for the duration of the stay and then as long as tax and accounting law requires.
• Contact messages, event enquiries and producer applications: up to 24 months after the last communication.
• Newsletter: until you unsubscribe.
• Technical logs: a few days or weeks, according to the hosting provider's settings.

7. Your rights

You have the right to access your data, have it corrected or erased, restrict processing, receive it in a portable format and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time without affecting earlier processing.

To exercise any of these rights, write to us at contact@vatravillage.com. We reply within one month at the latest.

If you believe your rights have been infringed, you can lodge a complaint with the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, www.dataprotection.ro, anspdcp@dataprotection.ro.

8. Security

We use encrypted connections (HTTPS), access restricted to authenticated administrators and database-level security rules. No system is entirely risk-free, but we take reasonable measures to protect your data.

9. Automated decisions

We do not make decisions based solely on automated processing and we do not profile you.

10. Cookies

Details about cookies and similar technologies are in our Cookie policy. You can change your choice at any time using the "Cookie settings" link in the website footer.

11. Changes

We may update this policy when we change how we process data. The current version is always on this page, with the date of the last update.