Privacy policy

This policy explains how Aframe Campulung S.R.L. (“the Controller”), through the shop store.malinuluiresort.ro, collects and processes your personal data in accordance with Regulation (EU) 2016/679 (GDPR).

1. The data controller

• Name: Aframe Campulung S.R.L.
• Tax ID (CUI): RO49082410 · Trade Register No.: J03/2412/2023
• Registered office: Bughea de Sus, Strada Râului, Argeș County, Romania
• Personal data contact: campulungchalet@gmail.com

2. What data we collect

• Identification and contact details: surname, first name, email, phone.
• Order details: the products/services chosen, the date and length of the booking, the amount, and any notes you send.
• When paying for a booking with a holiday voucher card: the dates, the cabins chosen and your CNP (Romanian personal numeric code). Reception uses the CNP at check-in; it does not appear on the invoice and we do not use it for anything else.
• Details of a gift voucher recipient: if you choose to give them to us, the name, email address and the message you want us to pass on. We use them only once, to send the voucher, your message and the instructions for using it. We do not send them any other communications and we do not use the address for marketing. By filling in these fields you confirm that you have the consent of the person concerned.
• Technical data: the minimum information needed for the shop to work (e.g. the cart saved locally in your browser). We do not collect or store your card details. Payment is processed directly by Netopia Payments.

3. Purposes and legal bases of processing

• Processing and fulfilling your order. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Issuing tax documents and meeting legal obligations. Legal basis: legal obligation (Art. 6(1)(c)).
• Communications about your order (confirmation, rescheduling, support). Legal basis: performance of a contract.
• Handling requests and any disputes. Legal basis: legitimate interest (Art. 6(1)(f)).

4. Recipients of the data

The data may be shared with:

• Netopia Payments (mobilPay): processing card payments;
• our hosting and email provider: storing the order and sending confirmations;
• the resort's reception staff: to fulfil the order. Orders are visible in an internal resort application, accessible to a limited number of authorised people, each with an individual account. Reception sees only what is needed to hand over the order (name, phone, the products ordered and any notes); billing details, email address and invoices remain accessible to the administrator only;
• public authorities, where there is a legal obligation.

We do not sell or rent your data to third parties for marketing purposes.

5. How long we keep the data

We keep order data for as long as needed to fulfil the order and for the period required by tax and accounting law (usually 10 years for financial documents). Data that is no longer needed is deleted or anonymised.

6. Your rights

Under the GDPR, you have the right of access, rectification, erasure (“the right to be forgotten”), restriction, objection and data portability, as well as the right to withdraw your consent. To exercise these rights, write to us at campulungchalet@gmail.com.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) (dataprotection.ro).

7. Security

We apply reasonable technical and organisational measures to protect the data (secure HTTPS connection, restricted access to orders). Card payments take place in the secure environment of the payment processor, which is PCI-DSS certified.

8. Cookies

How we use cookies is described in the Cookie policy.

9. Changes

We may update this policy. The version in force is the one published on this page.