Effective date: 06 November 2025
Data Controller: Csorgókő Guesthouse
Address: Vărșag 537350
E-mail: molnr_helga@yahoo.com
Phone: +40 740 683 256

1. Introduction

This Privacy Notice explains how Csorgókő Guesthouse collects, uses, and protects personal data submitted through its website and related services (e.g., contact form). The processing of personal data complies with the EU General Data Protection Regulation (GDPR) and applicable Romanian data protection laws.

2. Purpose and Legal Basis of Data Processing

The personal data collected through the website are processed for the following purposes:

• Handling inquiries: Processing the name, email, phone number, and message provided via the contact form to respond to inquiries.
  Legal basis: consent of the data subject and/or the legitimate interest of the controller (customer service).
• Website operation and security: Processing technical and operational data required to operate and secure the website (e.g., hosting, error diagnostics).
  Legal basis: legitimate interest of the controller.

3. Categories of Personal Data Processed

Depending on the services used, we may process the following data:

• Contact form: name, email address, phone number, message content, optional booking-related details.
• Technical data: IP address (may be anonymized), browser type, device type, time of visit, statistical data collected by analytics cookies.
• Cookies: cookie identifiers and expiration dates (see Cookie section).

Note: We do not request or intentionally process special categories of personal data (e.g., health or religion). If such information is voluntarily provided, processing is subject to separate legal considerations.

4. Data Retention

We retain data only for the necessary period:

• Contact form messages: up to 3 years after the inquiry is closed (unless deletion is requested earlier).
• Technical logs and security logs: 6 months to 2 years, depending on hosting and security requirements.
• Analytics data: based on provider settings (e.g., Google Analytics up to ~26 months or as configured).

If other legal retention obligations apply, those timeframes take precedence.

5. Data Transfers and Processors

We may use third-party service providers (data processors) such as:

• Website hosting provider: (WordPress hosting)
  These providers process data according to their own privacy policies.

If data is transferred outside the EU (e.g., to US-based cloud services), we ensure proper safeguards (e.g., EU–US Data Privacy Framework or Standard Contractual Clauses) and inform users accordingly.

6. Cookies

We use cookies for the following purposes:

• Necessary cookies: required for the basic functioning of the website (session management). No consent required.
• Analytics cookies: measure website visits (e.g., Google Analytics).
  Used only with user consent, managed via the cookie banner.

Users can manage cookie preferences at any time via the cookie settings tool (e.g., CookieYes).

7. Rights of the Data Subject

Data subjects have the right to:

• Access their personal data
• Request correction
• Request deletion (“right to be forgotten”)
• Restrict processing
• Data portability
• Object to processing, especially profiling or marketing
• Withdraw consent at any time (without affecting prior lawful processing)

Complaints may be submitted to the Romanian Data Protection Authority (ANSPDCP).

Requests should be sent to: molnr_helga@yahoo.com

8. Data Security

We apply appropriate technical and organizational security measures (encryption, access control, regular updates, backups). However, no system provides absolute security; users are advised not to send sensitive information through open forms.

9. Data Breach Notification

If a personal data breach occurs, we will investigate and notify affected individuals and supervisory authorities if required by law.

10. Amendments

This notice may be updated periodically. Changes will be posted on the website with the updated effective date.