Privacy Policy

1. Data controller

Hostillo S.R.L.

Hostillo S.R.L. ("we", "Hostillo", "the Guesthouse") acts as the data controller within the meaning of Regulation (EU) 2016/679 ("GDPR") and Romanian Law no. 190/2018.

We have not appointed a data protection officer (DPO), as one is not required for our activity; any request about personal data can be sent directly to the email address above.

2. What data we collect

2.1. Data you give us directly

• When you book: first and last name, phone, email, number of guests, dates of stay, preferences or special requests.
• At check-in: details from your ID card or passport (name, personal identification number or document series and number, citizenship), as required by the legal obligation to keep a register of guests.
• When you pay: the data needed to process the payment (we do not store full card details; these are processed directly by the bank's POS terminal or payment app).
• Correspondence: messages sent by email, WhatsApp or through the forms on the website.

2.2. Data collected automatically

Through cookies and similar technologies on pensiunea-amonte.ro: IP address, device and browser type, pages visited, browsing behavior (Google Analytics 4) and interaction with ads (Google Ads).

2.3. Data received from third parties

• From booking platforms, when you book through them: Booking.com, Airbnb.
• From the booking management system (Pynbooking, PMS/Booking Engine), which centralizes booking data whatever the channel.

3. Purposes and legal basis for processing

4. Who we share data with

Your data may be accessed, strictly to the extent necessary, by the following categories of recipients (processors or joint controllers):

• Pynbooking: the booking management system (PMS/Booking Engine) used to manage your booking.
• SmartBill: the invoicing and management system, used to issue invoices.
• Banca Transilvania: for payment processing (POS/mPOS).
• Google Ireland Ltd.: Google Analytics 4 and Google Ads, for traffic measurement and advertising (if you have consented to non-essential cookies).
• Meta Platforms: if you use WhatsApp to communicate with the guesthouse.
• Booking.com / Airbnb: if you booked through that platform.
• Public authorities: the police or other competent bodies for guest registration, the tax authority and other authorities, where the law requires it.

We do not sell or rent your data to third parties for their own marketing.

5. Transfers outside the European Economic Area

Some of the providers above (Google, Meta) may process data on servers located outside the EEA. These transfers rely on the standard contractual clauses approved by the European Commission or on other safeguards recognized by the GDPR, put in place by those providers.

6. How long we keep data

• Booking data and correspondence: for the duration of the contractual relationship, plus the statutory limitation period (3 years from the end of the stay), to defend against any claims.
• Invoices and accounting documents: 10 years, under Accounting Law no. 82/1991.
• Guest registration data: for the periods set by the legislation specific to accommodation services.
• Cookies: for the durations set in the consent banner on the website (analytics and marketing cookies can be deleted at any time from your browser or website preferences).

7. Your rights

As a data subject, you have the right to request:

• Access to the data we process about you;
• Rectification of inaccurate or incomplete data;
• Erasure ("the right to be forgotten"), within legal limits (it does not apply to data we are legally required to keep, such as invoices);
• Restriction of processing, under certain conditions;
• Objection to processing based on legitimate interest or to direct marketing;
• Portability of the data you provided directly, in a structured format;
• Withdrawal of consent at any time, for processing based on consent (such as analytics or marketing cookies), without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, contact us at contact@pensiunea-amonte.ro. We will reply within 30 days at most.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

8. Data security

We apply reasonable technical and organizational measures to protect data against unauthorized access, loss or accidental disclosure (access limited to authorized staff, secure accounts and platforms for booking management and invoicing).

9. Cookies

The website pensiunea-amonte.ro uses cookies:

• Necessary: for the basic operation of the website (no consent required);
• Analytics (Google Analytics 4): to understand how the website is used;
• Marketing (Google Ads): to show relevant ads and measure how well campaigns perform.

Analytics and marketing cookies are only used with your consent, given through the banner shown on your first visit. You can change your preferences at any time from the settings on the website or in your browser.

10. Children's data

We do not knowingly collect data from unaccompanied minors. Data about minors included in a booking is provided and managed by the adult who makes the booking or checks in.

11. Changes to this policy

This policy may be updated from time to time; the version that applies is the one published on the website at the time of processing. We recommend checking it periodically.

12. Contact

For any question about the processing of your personal data: contact@pensiunea-amonte.ro.