{"id":1728,"date":"2023-12-06T12:27:17","date_gmt":"2023-12-06T12:27:17","guid":{"rendered":"https:\/\/telefericgrandhotel.ro\/?page_id=1728"},"modified":"2026-10-02T14:47:56","modified_gmt":"2026-10-02T11:47:56","slug":"politica-de-confidentialitate","status":"publish","type":"page","link":"https:\/\/telefericgrandhotel.ro\/en\/politica-de-confidentialitate\/","title":{"rendered":"Confidentiality Policy"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

PRIVACY POLICY<\/strong><\/h1>

\u00a0<\/p>

Respect for the right to the protection of personal data, as well as the right to privacy, is one of the fundamental commitments of TINT S.R.L. (Teleferic Grand Hotel).<\/p>

Accordingly, we take the necessary steps to process your personal data in accordance with the principles established by the legislation applicable in Romania, including Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (\"GDPR\").<\/p>

Personal data means any information relating to an identified or identifiable natural person (\"data subject\"). An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity.<\/p>

Personal data is processed by TINT S.R.L., with registered office at 243 Poiana Soarelui Street, Poiana Brasov, Brasov Municipality, Brasov County, postal code 500001, registered with the Trade Register under no. J08\/1892\/2013, Tax Identification No. (CUI) RO13694214, the controller operating Teleferic Grand Hotel and Teleferic Spa Center.<\/p>

For questions regarding data protection or to exercise your rights, you may contact us at dpo@telefericgrandhotel.ro. For operational requests regarding reservations and Hotel services, you may use frontoffice@telefericgrandhotel.ro.<\/p>

This Policy provides general information regarding the processing activities carried out by TINT S.R.L. For certain operations, it is supplemented by specific Privacy Notices made available at the time or place where data is collected, including for reservations, accommodation, payments and guarantees, Teleferic Grand Privilege, SPA, fitness and massage services, the children's play area, sports equipment rental, recruitment, social media, reviews, photo\/video activities, premises security and video surveillance. Information specific to a particular process supplements this Policy for that operation.<\/p>

PRIVACY NOTICE REGARDING THE PROCESSING OF THE ROMANIAN PERSONAL NUMERICAL CODE (CNP) FOR PAYMENTS MADE WITH HOLIDAY CARDS\/VOUCHERS<\/strong><\/p>

If you pay for eligible tourist services using holiday cards or vouchers, TINT S.R.L. may process the holder's Romanian Personal Numerical Code (CNP) and the data necessary to verify the holder's identity only to the extent required by the rules applicable to the payment instrument used and the related legal obligations.<\/p>

The CNP is not automatically requested solely for the purpose of issuing an invoice. Where processing is required by the rules applicable to holiday vouchers, the legal basis is compliance with a legal obligation, and the data is used to verify the holder, accept and settle the payment, and prepare the mandatory financial and accounting records. The identity document may be checked to confirm the holder's identity, without retaining a copy unless there is an express legal obligation or a specific and justified reason to do so.<\/p>

The data may be disclosed to the issuer of the holiday payment instrument, technical providers involved in processing the transaction, financial and accounting service providers, and competent authorities, strictly to the extent necessary. The data is retained for the periods required by applicable law and for as long as necessary to resolve any complaints or disputes.<\/p>

CONTENTS OF THE PRIVACY POLICY<\/strong><\/p>

  • What personal data do we process?<\/li>
  • Personal data relating to minors<\/li>
  • Special categories of personal data<\/li>
  • For what purposes and on what legal grounds do we process your personal data?<\/li>
  • To whom do we disclose your personal data?<\/li>
  • Do we collect personal data from third parties?<\/li>
  • Do we transfer your data outside the EU\/EEA?<\/li>
  • Personal data of other individuals provided by you<\/li>
  • How long do we retain your personal data?<\/li>
  • What are your rights?<\/li>
  • Is your data secure?<\/li>
  • Cookies and similar technologies<\/li>
  • Links to other websites<\/li>
  • Questions or complaints<\/li>
  • Changes to this Policy<\/li><\/ul>

    WHAT PERSONAL DATA DO WE PROCESS?<\/strong><\/p>

    If you are a customer or prospective customer<\/strong><\/p>

    We collect personal data through our interactions with you and in connection with the services offered by Teleferic Grand Hotel. Depending on the service requested, we may process the following categories of data:<\/p>

    • data required for reservations and requests for quotations, such as first name, last name, email address, telephone number, stay dates, room type, number and category of guests, selected rate\/package and services;<\/li>
    • data included in the Arrival and Departure Notification Form and required for check-in formalities under applicable law, including name, date and place of birth, citizenship, home address, identity document details, arrival and departure dates, purpose of travel, room number and signature, to the extent required by the statutory form;<\/li>
    • data relating to payment and reservation guarantees: amount, currency, transaction status and identifier, information regarding pre-authorisation, charging, cancellation or refund and, where available in the Hotel's systems, masked card information. Full card details used online are entered in the secure environment of the payment service provider, and TINT S.R.L. does not store the CVV\/CVC security code;<\/li>
    • data relating to the guarantee provided at check-in by POS pre-authorisation, including the amount, transaction status and information required for its settlement or release;<\/li>
    • information about the stay, including arrival and departure dates, services used, special requests and preferences communicated by you;<\/li>
    • billing, financial and accounting data, including details of the individual or company in whose name a fiscal document is requested;<\/li>
    • vehicle information, such as the registration number, where necessary for managing access or parking;<\/li>
    • data generated by access systems, including the date and time of access, where such records are generated by the systems used;<\/li>
    • data received from travel agencies, online booking platforms, event organisers, persons making reservations for other guests or other partners, such as rooming lists and participant lists;<\/li>
    • data required for additional services, such as Teleferic Spa Center, fitness, massage, the children's play area, Ski\/Bike Rental and other requested facilities;<\/li>
    • for sports equipment rental, where applicable: age, experience, shoe size, weight, height, and information about the equipment and rental period;<\/li>
    • for Teleferic Grand Privilege: member account data, member identifier, history of eligible transactions, points earned\/used, membership level, benefits, bonuses and discounts;<\/li>
    • preferences regarding commercial communications and data provided for newsletter subscription;<\/li>
    • reviews, ratings, comments and opinions regarding our services;<\/li>
    • photographs, video materials, voice recordings and, where applicable, the person's name or capacity\/role in materials created during events or activities;<\/li>
    • any other information you choose to provide to us that is relevant to the service requested.<\/li><\/ul>

      Surveillance cameras installed in monitored areas may capture your image, the date and time of the recording, and the area\/camera from which the image originates. The CCTV system does not record sound, does not use facial recognition and does not perform automated biometric identification.<\/p>

      You may choose which optional data you wish to provide. However, where certain data is required to comply with a legal obligation, to enter into or perform a contract, or to safely provide a requested service, failure to provide that data may make it impossible to provide the relevant service or complete the relevant formality.<\/p>

      If you are a prospective employee<\/strong><\/p>

      We process information contained in your CV, cover letter, application forms, information provided during interviews and other data you submit during the recruitment process, as well as data received through recruitment platforms or recruitment partners where you apply through those channels.<\/p>

      If you are a visitor to our premises<\/strong><\/p>

      We may process your first and last name and, only where the security procedure applicable to the area accessed justifiably requires it, the series and number of your identity document. In monitored areas, the CCTV system may record your image, the date, time and the area in which you are present.<\/p>

      If you are a user of the website www.telefericgrandhotel.ro<\/strong><\/p>

      Simply viewing the public information on the Website does not require you to voluntarily provide personal data. For the purposes of operating, securing and technically diagnosing the Website, technical data such as the IP address, date and time of access, log information, browser or device information may be generated, to the extent collected by the systems used.<\/p>

      To use certain services, such as online reservations, contact forms or job applications, data specific to the relevant operation is required. Viewing the Website is not conditional upon being 18 years old; however, making a reservation or entering into a contract through the Website must be carried out by a person who is at least 18 years old and has the legal capacity required, in accordance with the Website Terms and Conditions.<\/p>

      If you are a representative or contact person of a supplier, partner or corporate customer<\/strong><\/p>

      We may process your first and last name, position, the organisation you represent, professional contact details and the information necessary to manage the business relationship, requests for quotations, contracts, orders, events, payments and related communications.<\/p>

      If you are an employee<\/strong><\/p>

      Please refer to the privacy policy applicable to employees, which is brought to your attention at the time of employment and is available from the Human Resources Department.<\/p>

      PERSONAL DATA RELATING TO MINORS<\/strong><\/p>

      We take particular care to protect the data of children and adolescents. Depending on the circumstances, minors' data may be processed in connection with accommodation, verification of documents and the accompanying person, use of the children's play area, access to certain facilities, age-appropriate SPA services, activities, events or photo\/video materials. The legal basis depends on the specific operation and may be a legal obligation, performance of the requested service, legitimate interest or consent, as applicable.<\/p>

      Where processing is based on consent and the law requires the consent of a parent or legal representative, such consent will be obtained in accordance with the applicable requirements. The rule concerning a child's consent in relation to information society services offered directly to a child applies only in the situations covered by Article 8 GDPR and the relevant national legislation.<\/p>

      In accordance with the operating rules of Teleferic Spa Center, SPA treatments are intended for persons aged 16 and over; guests aged between 16 and 18 may receive treatments under the conditions set out in the SPA rules and with the involvement of a parent\/legal guardian. Children may use the pool and jacuzzi area only under adult supervision, while the sauna and relaxation area is reserved for adults. These operating rules do not alter data protection requirements and apply together with the relevant specific Privacy Notices.<\/p>

      SPECIAL CATEGORIES OF PERSONAL DATA<\/strong><\/p>

      The term \"special categories of personal data\" includes, among other things, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for the purpose of uniquely identifying a person, data concerning health, a person's sex life or sexual orientation.<\/p>

      As a rule, we do not request such data unless it is relevant and necessary for a specific service or situation. Within Teleferic Spa Center, and in connection with fitness, massage, relaxation, cosmetic treatments or the children's play area, health information strictly relevant to safety and to the assessment of contraindications, allergies, restrictions or circumstances that may affect the provision of the service may be collected. Prior to the first SPA visit, a health status form may be used in accordance with the SPA procedure.<\/p>

      Where we process health data on the basis of consent, we obtain explicit consent in accordance with Article 9(2)(a) GDPR. Refusal to provide optional medical information will not affect other services; however, where the information is strictly necessary to safely assess a procedure, we may be unable to provide that particular procedure. Health data is not used for marketing, and access to such data is limited to personnel who need it for the relevant service.<\/p>

      Ordinary photographs and video recordings are not automatically considered biometric data. They become biometric data within the meaning of the GDPR only where they are subject to specific technical processing for the purpose of uniquely identifying a person. TINT S.R.L. does not use the CCTV system for facial recognition or automated biometric identification.<\/p>

      FOR WHAT PURPOSES AND ON WHAT LEGAL GROUNDS DO WE PROCESS YOUR PERSONAL DATA?<\/strong><\/p>

      If you are a customer or prospective customer<\/strong><\/p>

      1. Hotel and restaurant reservations and requests for quotations<\/strong><\/li><\/ol>

        Purpose: managing the reservation, responding to requests, checking availability, sending confirmations and preparing the requested services. Reservations may be made through the Website, by telephone\/email, through travel agencies or online booking platforms. Legal basis: Article 6(1)(b) GDPR - steps taken at the request of the data subject prior to entering into a contract and performance of the contract; where applicable, Article 6(1)(f) GDPR for the reasonable management of requests and the establishment, exercise or defence of legal claims.<\/p>

        1. Payments, pre-authorisations and reservation guarantees<\/strong><\/li><\/ol>

          Purpose: processing payments, guaranteeing reservations, pre-authorising amounts, applying cancellation\/no-show conditions, settling amounts, preventing fraud and complying with financial and accounting obligations. For certain pay-at-property reservations, we may use a secure EuPl\u0103tesc.ro link for pre-authorisation; full card details are entered by the customer in the payment provider's secure environment. At check-in, depending on the conditions applicable to the stay, a guarantee may be provided by POS pre-authorisation. Legal basis: Article 6(1)(b), (c) and, for fraud prevention and the establishment, exercise or defence of legal claims, (f) GDPR, as applicable.<\/p>

          1. Check-in, accommodation and guest registration<\/strong><\/li><\/ol>

            Purpose: registration and accommodation, identity verification, completion of the Arrival and Departure Notification Form, management of the stay and compliance with legal obligations applicable to accommodation establishments. Legal basis: Article 6(1)(c) GDPR for data required by law and Article 6(1)(b) GDPR for performance of the accommodation service.<\/p>

            1. Customer service and management of the stay<\/strong><\/li><\/ol>

              Purpose: providing the requested services, including transport, housekeeping, laundry, room service, management of special requests, parking and other hotel services. Legal basis: performance of the contract, Article 6(1)(b) GDPR; for complaints, incidents and the establishment, exercise or defence of legal claims, legitimate interest under Article 6(1)(f) GDPR may be relied upon.<\/p>

              1. Additional services, including Ski\/Bike Rental<\/strong><\/li><\/ol>

                Purpose: providing the service and selecting suitable equipment, managing the rental, payments, returns, any damage and complaints. Legal basis: Article 6(1)(b) GDPR; legal obligations and legitimate interests, as applicable.<\/p>

                1. Teleferic Spa Center, fitness, massage, relaxation and cosmetic services<\/strong><\/li><\/ol>

                  Purpose: scheduling and managing services, providing non-medical treatments and procedures, managing subscriptions, checking contraindications and ensuring safe service delivery. For ordinary personal data, the main legal basis is Article 6(1)(b) GDPR; for financial and accounting obligations, Article 6(1)(c); for complaints and the establishment, exercise or defence of legal claims, Article 6(1)(f). Where health data is required, the conditions of Article 9 GDPR also apply, including explicit consent where this is the appropriate legal basis.<\/p>

                  1. Children's indoor play area<\/strong><\/li><\/ol>

                    Purpose: managing access and activities, identifying and contacting the parent\/legal representative, supervising the child, managing incidents and, where necessary, using information relevant to the child's safety. Legal basis: Article 6(1)(b), (c) or (f) GDPR, as applicable; Article 9 GDPR also applies to health data. The child's data is not used for direct marketing.<\/p>

                    1. Teleferic Grand Privilege<\/strong><\/li><\/ol>

                      Purpose: creating and managing the member account, identifying eligible transactions, calculating and using points, determining membership level, granting benefits, preventing fraudulent use and handling requests concerning the programme. Legal basis: Article 6(1)(b) GDPR for administration of the programme and Article 6(1)(f) GDPR for security, fraud prevention and the establishment, exercise or defence of legal claims. Enrolment in the programme does not automatically constitute consent to marketing.<\/p>

                      1. Payment with holiday cards\/vouchers<\/strong><\/li><\/ol>

                        Purpose: verifying the holder, accepting and processing payment for eligible tourist services and complying with specific legal obligations. The CNP and identity document details are processed only to the extent required under the rules applicable to the holiday payment instrument used. Legal basis: Article 6(1)(b) and (c) GDPR, as applicable.<\/p>

                        1. Preferences and personalisation of services<\/strong><\/li><\/ol>

                          Purpose: where justified and permitted, retaining preferences such as preferred floor, type of bedding, service preferences or other options communicated by you, so that we can more easily provide the services you prefer during a future visit. The legal basis depends on the context and may be performance of the service, legitimate interest or consent, where required. We do not use such preferences to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.<\/p>

                          1. Feedback, reviews and service improvement<\/strong><\/li><\/ol>

                            Purpose: analysing guest experience, complaints, suggestions and reviews in order to improve our services and respond to public comments. Legal basis: TINT S.R.L.'s legitimate interest in maintaining and improving service quality, Article 6(1)(f) GDPR. Reviews published on Google, TripAdvisor or other platforms may also be processed by the operators of those platforms.<\/p>

                            1. Marketing and commercial communications<\/strong><\/li><\/ol>

                              Purpose: sending newsletters, offers and other commercial communications. These communications are sent in accordance with applicable law. Where the law requires prior consent, communications are sent only after such consent has been given; where the law permits another legal basis, that basis will be used only in compliance with the applicable conditions and the right to object. You may unsubscribe or withdraw consent at any time. Data collected for a SPA service, in relation to a child, for security purposes, for a guarantee or for a payment is not automatically used for marketing.<\/p>

                              1. Photographs and video materials at events and activities<\/strong><\/li><\/ol>

                                Purpose: documenting events, public communications and, where an appropriate legal basis exists, promoting the Hotel and its services. Legitimate interest may be relied upon for general atmosphere shots, subject to an assessment of necessity and proportionality. For portraits, interviews, testimonials, materials in which a person is the main subject, or other situations where consent is appropriate, processing is based on consent. Where a minor is identified as the main subject of promotional material, the consent of the parent\/legal representative is obtained in accordance with the applicable requirements.<\/p>

                                1. Video surveillance and premises security<\/strong><\/li><\/ol>

                                  Purpose: protecting the life, physical integrity and safety of individuals, protecting property, controlling access, preventing and investigating incidents, and protecting legal rights. Legal basis: Article 6(1)(f) GDPR and, where a legal obligation regarding guarding and security applies, Article 6(1)(c) GDPR. The CCTV system is not used for marketing and is not intended for the general monitoring of employees' professional performance. Where monitoring takes place in the workplace, the special conditions laid down by Romanian Law No. 190\/2018 are also observed.<\/p>

                                  1. Operational communications by email, telephone, SMS or other channels<\/strong><\/li><\/ol>

                                    Purpose: responding to requests, confirming or changing reservations and appointments, sending information necessary for performance of the service, resolving complaints, and communicating about incidents or contractual obligations. Legal basis: Article 6(1)(b) GDPR and, for complaint handling or the establishment, exercise or defence of legal claims, Article 6(1)(f) GDPR. Operational communications are not automatically treated as marketing.<\/p>

                                    1. Analysis, improvement and research<\/strong><\/li><\/ol>

                                      Purpose: carrying out analyses and preparing reports regarding service quality, recurring issues and operational performance. Wherever possible, we use aggregated or anonymised data. Legal basis: the legitimate interest in improving services and processes, Article 6(1)(f) GDPR.<\/p>

                                      1. Social media and online platforms<\/strong><\/li><\/ol>

                                        Purpose: managing official pages and profiles, responding to comments, mentions, messages and requests, and managing public content, statistics and campaigns, as applicable. We may use Facebook, Instagram, LinkedIn, TikTok, X, Google Business\/Maps and other platforms. Following a page or interacting publicly does not, by itself, constitute consent to newsletters or other commercial communications outside the platform. For reservations or payments initiated through messaging, we may direct you to the Hotel's secure channels; we do not ask you to send PINs, CVV\/CVC security codes or full card details by message.<\/p>

                                        1. Trade fairs, exhibitions and B2B commercial activities<\/strong><\/li><\/ol>

                                          Purpose: responding to requests received at our stand, preparing offers, continuing commercial discussions and managing B2B relationships. Data may come from a form completed by you, your business card, the organiser's badge\/QR systems, or information lawfully provided by the organiser. Providing a business card or requesting an offer does not automatically constitute consent to receive newsletters; marketing is handled separately.<\/p>

                                          1. Operational procedures and incidents<\/strong><\/li><\/ol>

                                            Purpose: documenting specific operational situations, complaints, incidents, damage or claims. For example, for the form concerning food products or beverages brought into the Hotel from outside, we use only the data strictly necessary, such as the name and room number, without requesting the CNP, full identity document details, telephone number, email address or vehicle registration number unless such data is necessary for the process. Legal basis: the legitimate interest in managing the procedure, documenting incidents and protecting legal rights, Article 6(1)(f) GDPR.<\/p>

                                            If you are a visitor to our premises<\/strong><\/p>

                                            Purpose: managing access and ensuring the security of persons and property. Legal basis: TINT S.R.L.'s legitimate interest, Article 6(1)(f) GDPR, and the legal obligations applicable to guarding and security, where relevant. Identity document details are not automatically collected from every visitor, but only where a justified access procedure requires them.<\/p>

                                            If you are a user of the website www.telefericgrandhotel.ro<\/strong><\/p>

                                            Purpose: operating and securing the Website, diagnosing errors, preventing fraud, and providing the requested reservation and form functionalities. Legitimate interest under Article 6(1)(f) GDPR may be relied upon for technical data strictly necessary for operation and security. Cookies and similar technologies that are not strictly necessary are used in accordance with the choices expressed through the consent management mechanism and the Cookie Policy available on the Website.<\/p>

                                            If you are a representative or contact person of suppliers, partners or corporate customers<\/strong><\/p>

                                            Purpose: initiating and managing the business relationship, negotiating and performing contracts, invoicing, payments, operational communications and protecting legal rights. Where the natural person is themselves a party to the contract, the legal basis may be Article 6(1)(b) GDPR. For employees, representatives or contact persons of a legal entity, the processing of professional data necessary for the B2B relationship is generally based on the parties' legitimate interest in managing the business relationship, Article 6(1)(f) GDPR. Financial and accounting obligations are based on Article 6(1)(c) GDPR.<\/p>

                                            If you are a prospective employee<\/strong><\/p>

                                            Purpose: assessing your application, communicating with you, arranging interviews and managing the selection stages. Legal basis: Article 6(1)(b) GDPR - steps taken at the request of the data subject prior to entering into a contract; where applicable, Article 6(1)(c) GDPR for legal obligations and Article 6(1)(f) GDPR for resolving complaints or the establishment, exercise or defence of legal claims. Data may be obtained directly from you or through recruitment platforms and partners such as LinkedIn, BestJobs, Hipo or specialised agencies where you apply through those channels.<\/p>

                                            If you are an employee<\/strong><\/p>

                                            The processing of employee data is described in the privacy policy specific to personnel and in the applicable internal procedures.<\/p>

                                            For all categories of persons referred to above<\/strong><\/p>

                                            1. Restructuring, internal reorganisations or transactions involving assets or equity interests<\/strong><\/li><\/ol>

                                              Purpose: analysing and carrying out such operations where they necessarily involve the processing of personal data. Legal basis: the legitimate interest in carrying out the relevant operations, subject to appropriate confidentiality and data minimisation measures.<\/p>

                                              1. Security<\/strong><\/li><\/ol>

                                                Purpose: protecting property, systems and the physical integrity of individuals. Legal basis: legitimate interest and, where applicable, a legal obligation.<\/p>

                                                1. Legal matters<\/strong><\/li><\/ol>

                                                  Purpose: resolving disputes and complaints, conducting investigations, complying with applicable regulations, enforcing contracts and responding to lawful requests from public authorities. Legal basis: compliance with a legal obligation, Article 6(1)(c) GDPR, or legitimate interest in the establishment, exercise or defence of legal claims, Article 6(1)(f) GDPR, as applicable.<\/p>

                                                  TO WHOM DO WE DISCLOSE YOUR PERSONAL DATA?<\/strong><\/p>

                                                  In order to provide the requested services and fulfil our obligations, personal data may be made accessible or disclosed, strictly to the extent necessary, to the following categories of recipients:<\/p>

                                                  • providers of software, PMS, booking engines, CRM, loyalty platforms, IT services, hosting, security, emailing and other technology services;<\/li>
                                                  • payment service providers, including EuPl\u0103tesc.ro, banks, card schemes, processors and POS terminal providers, depending on the payment operation;<\/li>
                                                  • travel agencies, online booking platforms and other intermediaries where the reservation is made through them;<\/li>
                                                  • organisers of events, groups, conferences or meetings, to the extent necessary to organise the services and only in relation to the relevant persons;<\/li>
                                                  • business partners involved in providing a service requested by you;<\/li>
                                                  • financial and accounting service providers, auditors, consultants, lawyers, insurers and other professionals, within the scope of their duties;<\/li>
                                                  • photo\/video providers, agencies and social media platforms where they are used for the relevant materials or communications;<\/li>
                                                  • recruitment providers or partners and occupational medicine providers, where relevant to the recruitment\/employment process;<\/li>
                                                  • the security company, authorised CCTV system providers and TINT S.R.L. personnel authorised to manage security and incidents;<\/li>
                                                  • the Romanian Police, public prosecutors, courts, tax authorities, tourism authorities, the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), and other competent public authorities or institutions where there is a legal obligation or a valid lawful request.<\/li><\/ul>

                                                    The legal role of each recipient is determined according to the specific activity. Not all providers or partners automatically act as processors; some may act as independent controllers or, in certain situations, jointly with TINT S.R.L. Where a recipient acts as a processor, the requirements of Article 28 GDPR apply. We do not sell your personal data.<\/p>

                                                    DO WE COLLECT PERSONAL DATA FROM THIRD PARTIES?<\/strong><\/p>

                                                    In order to manage reservations and provide the requested services, we may receive personal data about you from:<\/p>

                                                    • travel agencies and online booking platforms, including Booking.com and other OTAs, where you make your reservation through them;<\/li>
                                                    • organisers of events, groups, conferences or companies that provide us with rooming lists or participant lists;<\/li>
                                                    • the person making a reservation for you or providing the details of other guests included in the reservation;<\/li>
                                                    • business partners, suppliers and organisers of trade fairs\/exhibitions, to the extent that the disclosure is lawful and relevant;<\/li>
                                                    • social networks and online platforms through which you interact with us, within the limits of the data you make available and the platform's settings;<\/li>
                                                    • recruitment platforms and partners where you choose to apply through them.<\/li><\/ul>

                                                      Where personal data has not been obtained directly from you, we provide the information required by Article 14 GDPR within the time limits and under the conditions laid down by law, including, where applicable, at the time of our first communication with you.<\/p>

                                                      DO WE TRANSFER YOUR PERSONAL DATA OUTSIDE THE EU\/EEA?<\/strong><\/p>

                                                      Some providers, online platforms or partners may process data in countries outside the European Union or the European Economic Area. Such transfers are carried out only in accordance with the GDPR and on the basis of an appropriate legal transfer mechanism, such as an adequacy decision of the European Commission, Standard Contractual Clauses or another mechanism recognised by law, together with any necessary supplementary measures, as applicable.<\/p>

                                                      We do not currently make international transfers of CCTV recordings or access logs. Publication or interaction through platforms such as Facebook, Instagram, LinkedIn, TikTok, X, Google or other global services may involve transfers carried out by the platform operators in accordance with their own data protection mechanisms.<\/p>

                                                      PERSONAL DATA OF OTHER INDIVIDUALS PROVIDED BY YOU<\/strong><\/p>

                                                      If you provide us with personal data relating to other individuals, for example when making a reservation for other guests, submitting a rooming list, registering a participant for an event or providing data relating to a minor, please ensure that you have the right to provide us with that data and that the relevant individuals are informed, as applicable, about how their data will be processed. TINT S.R.L. will use the data only for legitimate purposes connected with the relevant service and will provide the information required by law where necessary.<\/p>

                                                      HOW LONG DO WE RETAIN YOUR PERSONAL DATA?<\/strong><\/p>

                                                      Personal data is retained only for as long as necessary for the purposes for which it was collected, to comply with legal obligations, resolve complaints and establish, exercise or defend legal claims. The retention period varies depending on the category of data and the relevant process. We do not retain data indefinitely in our systems merely because it has been collected.<\/p>

                                                      By way of example, and in order to align this Policy with the specific Privacy Notices:<\/p>

                                                      • CCTV recordings are ordinarily retained for 20 days and are then automatically deleted or overwritten; footage relevant to an incident may be extracted and retained separately for as long as necessary to resolve the matter;<\/li>
                                                      • paper forms used for SPA and cosmetic services, including any health data, are in principle retained for 90 days from the last relevant visit, unless there is a legally justified reason for a longer period;<\/li>
                                                      • paper forms used for fitness, massage, relaxation and other non-medical procedures are in principle retained for 3 months from the last relevant visit;<\/li>
                                                      • forms used for the children's indoor play area are in principle retained for 30 days from the last relevant use, except where there is an incident, complaint or other legal reason for longer retention;<\/li>
                                                      • paper forms used exclusively for sports equipment rental are in principle retained for 90 days from the last relevant use, unless there is an incident, damage, complaint or other legal reason for longer retention;<\/li>
                                                      • the form concerning food products\/beverages brought into the Hotel from outside is in principle retained for 30 days, with the possibility of retaining the relevant document where a complaint, inspection, incident or legal claim arises;<\/li>
                                                      • Teleferic Grand Privilege account data is retained for the duration of membership and thereafter for as long as necessary to resolve obligations, disputes and claims arising from the programme;<\/li>
                                                      • data used exclusively for marketing is retained until consent is withdrawn, the right to object is exercised, or the purpose is no longer justified, as applicable;<\/li>
                                                      • recruitment data is retained for as long as necessary for the recruitment process and, where applicable, for a justified period for handling complaints, defending legal rights or future recruitment where an appropriate legal basis exists;<\/li>
                                                      • data relating to reservations, accommodation, payments, invoicing and financial\/accounting records is retained for the periods required to perform the contract and for the periods required by applicable fiscal, accounting, tourism and archiving legislation.<\/li><\/ul>

                                                        Unselected raw photo\/video materials are retained only for the period necessary for selection and production; published materials or materials retained in the brand archive are kept for as long as they remain relevant to the stated purpose, subject to the rights of data subjects. Data on social media and review platforms is also subject to the retention periods and rules of the relevant platforms.<\/p>

                                                        We periodically review whether continued retention is necessary. Where processing is no longer necessary and there is no legal obligation or justified legitimate interest requiring retention, the data is deleted, destroyed, anonymised or isolated, as appropriate, using measures suitable for the medium on which it is stored.<\/p>

                                                        WHAT ARE YOUR RIGHTS?<\/strong><\/p>

                                                        As a data subject, you have the following rights under the conditions laid down by the GDPR:<\/p>

                                                        • right of access - you may request confirmation as to whether personal data is being processed, access to the data and a copy of the personal data we hold about you (Article 15 GDPR);<\/li>
                                                        • right to rectification - you may request the correction or completion of inaccurate or incomplete data (Article 16 GDPR);<\/li>
                                                        • right to erasure - in the situations provided by law, you may request the deletion of your data (Article 17 GDPR);<\/li>
                                                        • right to restriction of processing - in the situations provided by Article 18 GDPR;<\/li>
                                                        • right to data portability - for processing operations and under the conditions in which Article 20 GDPR applies;<\/li>
                                                        • right to object - including to processing based on legitimate interest and, at any time, to direct marketing, under the conditions of Article 21 GDPR;<\/li>
                                                        • right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;<\/li>
                                                        • rights relating to decisions based solely on automated processing, under the conditions of Article 22 GDPR, where such a process applies;<\/li>
                                                        • right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).<\/li><\/ul>

                                                          These rights are not absolute and may be restricted in the circumstances provided by law. For example, in the case of CCTV, the right of access does not mean direct access to the surveillance system or a right to view the recordings in their entirety. We may provide only the relevant footage and may apply measures such as masking or blurring images of other individuals in order to protect their rights and freedoms.<\/p>

                                                          To exercise your rights, you may contact us at dpo@telefericgrandhotel.ro or submit a written request to TINT S.R.L., 243 Poiana Soarelui Street, Poiana Brasov, Brasov Municipality, Brasov County, or at the Hotel reception. We respond without undue delay and, in any event, within no more than one month of receipt of the request; this period may be extended under the conditions provided by the GDPR.<\/p>

                                                          IS YOUR PERSONAL DATA SECURE?<\/strong><\/p>

                                                          We take data security seriously and implement technical and organisational measures appropriate to the risk in order to protect personal data against unauthorised access, loss, alteration, unauthorised disclosure or destruction. These measures include, where appropriate, access controls, internal policies and procedures, physical security measures, authentication, logging, updates and safeguards for information systems.<\/p>

                                                          We require providers and partners that process personal data on our behalf to implement appropriate security measures and, where they act as processors, to comply with the obligations laid down in Article 28 GDPR. Internal access is granted according to job responsibilities and the need-to-know principle.<\/p>

                                                          COOKIES AND SIMILAR TECHNOLOGIES<\/strong><\/p>

                                                          The Website may use cookies and similar technologies that are necessary for its operation, security and the provision of requested functionalities. Cookies or technologies that are not strictly necessary, including those used for analytics or advertising, are used in accordance with the choices expressed by the user through the consent management mechanism, where required by law. Detailed information is available in the Cookie Policy published on the Website.<\/p>

                                                          LINKS TO OTHER WEBSITES<\/strong><\/p>

                                                          Our Website may contain links to websites or services operated by third parties. We do not continuously control the content, availability, security or policies of those third parties and are not responsible for processing carried out by them where such responsibility does not arise under applicable law. When you use a third-party website or service, that third party's terms and privacy policy apply. We recommend that you review them before providing personal data.<\/p>

                                                          Use of internet services made available within Teleferic Grand Hotel may also be subject to the terms and policies of the relevant service providers, communicated on the login page or by other appropriate means.<\/p>

                                                          QUESTIONS OR COMPLAINTS<\/strong><\/p>

                                                          If you have questions or concerns regarding the processing of personal data, or if you wish to exercise your rights, you may contact us at dpo@telefericgrandhotel.ro. Written requests may be sent to TINT S.R.L.'s registered office at 243 Poiana Soarelui Street, Poiana Brasov, Brasov Municipality, Brasov County, postal code 500001, or submitted at the Hotel reception.<\/p>

                                                          If you believe that your data protection rights have not been respected, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), without prejudice to your right to use any other administrative or judicial remedies available under the law.<\/p>

                                                          CHANGES TO THIS POLICY<\/strong><\/p>

                                                          This Policy may be updated to reflect legislative, technical, operational or service-related changes. The updated version will be published on the Website and will state the date of the latest update. Changes apply prospectively, and where a change has a relevant impact on how your personal data is used, we will use appropriate means to inform you, in accordance with the law.<\/p>

                                                          For processing operations covered by specific Privacy Notices, updates to this Policy will be coordinated with those documents in order to avoid inconsistencies regarding categories of data, purposes, legal bases, recipients and retention periods.<\/p>

                                                          Last updated: 30 September 2026<\/strong><\/p>

                                                          \u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

                                                          POLITICA DE CONFIDEN\u021aIALITATE \u00a0 Respectarea dreptului la protec\u021bia datelor cu caracter personal, precum \u0219i a dreptului la via\u021b\u0103 privat\u0103 este una dintre misiunile fundamentale ale Societ\u0103\u021bii TINT S.R.L. (Teleferic Grand Hotel). Astfel, \u00eentreprindem demersurile necesare pentru a prelucra datele dumneavoastr\u0103 personale \u00een conformitate cu principiile stabilite de legisla\u021bia aplicabil\u0103 \u00een Rom\u00e2nia, inclusiv Regulamentul (UE) 2016\/679 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_glsr_average":0,"_glsr_ranking":0,"_glsr_reviews":0,"footnotes":""},"class_list":["post-1728","page","type-page","status-publish","hentry"],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/telefericgrandhotel.ro\/en\/wp-json\/wp\/v2\/pages\/1728","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/telefericgrandhotel.ro\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/telefericgrandhotel.ro\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/telefericgrandhotel.ro\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/telefericgrandhotel.ro\/en\/wp-json\/wp\/v2\/comments?post=1728"}],"version-history":[{"count":13,"href":"https:\/\/telefericgrandhotel.ro\/en\/wp-json\/wp\/v2\/pages\/1728\/revisions"}],"predecessor-version":[{"id":9722,"href":"https:\/\/telefericgrandhotel.ro\/en\/wp-json\/wp\/v2\/pages\/1728\/revisions\/9722"}],"wp:attachment":[{"href":"https:\/\/telefericgrandhotel.ro\/en\/wp-json\/wp\/v2\/media?parent=1728"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}