Privacy policy

This is a translation provided for convenience. In case of any discrepancy, the Romanian version prevails.

Last updated: 5 October 2026

1. Who is responsible for your data

The controller is Luxury Forest Retreat SRL, which operates the Forest Retreat Villas complex and this website.

• Address: Strada Primăverii 12, Bușteni, Prahova County, postal code 105500, Romania
• Unique Registration Code (CUI): 30174858
• Trade Register number: J20/20007/19297
• EUID / RO-ONRC: ROONRC.J2012000719297
• Phone: +40 728 866 992
• Email: contact@forestretreatvillas.ro

For any request concerning your data, write to us at the email address above, with the subject “Data protection”. We are not legally required to designate a data protection officer, but requests are handled by the company’s management.

2. What data we collect and when

2.1 When you write to us through a form

The forms on the website (contact, availability request, quote request for Team Building or events) send us: your name, email address, phone number if you provide it, the dates and number of guests if you indicate them, and your message, with everything you choose to write in it.

Before sending, you tick a box confirming that you have read this policy and the terms and conditions. The tick box is not a formality: without it the form cannot be sent, and the server rejects the message even if the tick box were bypassed in the browser.

The message goes straight to our server and from there to our email addresses. It does not pass through any external form service. A copy remains on the server for 12 months, so that a message is not lost if the email fails to arrive, and is then deleted automatically.

Please do not include in your message data that enjoys special protection under the law: health information, religious or political beliefs, or data about children beyond their number and age. We do not need it to make you an offer.

2.2 When you book directly with us

Bookings are made directly with us: on WhatsApp, by phone, by email or through the form on the website. For the booking and the stay we use only what we need to host you: name, contact details, dates of stay, villa, number of guests, the preferences you write to us and the payment confirmation. We do not store full card details.

2.3 When you accept statistics

If you tick the “statistics” category in the cookie banner, we enable Google Analytics 4 and Microsoft Clarity. These receive pseudonymous identifiers (a browser code, not your name), the pages visited, the type of device and browser, the source from which you reached the website and your approximate region. The IP address is truncated before storage, so it never reaches the provider in full.

If you do not tick it, these tools are not loaded at all. They are not switched on and silenced; they simply do not exist on the page.

2.4 When you accept marketing

If you tick the “marketing” category, Meta Pixel is loaded. It tells the Meta platform that you have visited a certain page, so that we can measure whether our ads on Facebook and Instagram bring in booking requests and so that we can show you relevant ads. Here too, nothing is loaded without your consent.

2.5 Proof of consent

When you press a button in the cookie banner, we record your decision in our own register, on our server. We save: the exact time, the categories ticked, the type of decision (accept, reject or choice by category), the policy version, the page from which you decided, the IP address and the browser type.

The IP address is kept in full, not truncated, precisely because the purpose of this register is to serve as proof. A half-truncated IP proves nothing. The register contains neither your name nor your email address: each entry receives a random code, and that code is stored in your browser. If you want the proof to be deleted, send us the code and we will delete it.

2.6 What the server records in any case

Like any web server, ours writes to its technical logs the IP address, the time of the request, the page requested and the browser type. We cannot turn this off, because it is how the server defends itself against attacks and how we can find out what went wrong when a visitor tells us a page is not working. The logs are not used for marketing and are not linked to the forms.

2.7 Google Search Console

It shows us how the website appears in Google: which searches bring visitors, how many impressions and clicks it gets, which pages are indexed. These are aggregated, site-level reports. They do not identify individual visitors and do not involve cookies set by us.

3. At a glance, in a table

4. Who else sees the data

The data reaches our staff who handle bookings and the providers listed below, who process it strictly on our behalf and under a contract:

Apart from these, we may be required by law to disclose data to public authorities, for example to an inspection body or a court. We do not sell, rent or exchange your data with anyone for commercial purposes.

5. Transfers outside the European Union

The statistics and advertising providers are European companies, but their infrastructure may also process data outside the European Economic Area, usually in the United States. These transfers take place on the basis of the standard contractual clauses approved by the European Commission and, where applicable, the EU-U.S. Data Privacy Framework.

If you reject the “statistics” and “marketing” categories, these transfers do not take place for your visit.

6. How long we keep the data

The retention periods are in the table in section 3. The general rule: we keep data for as long as we need it for the purpose for which we received it, plus the period during which the law requires us to keep it or during which it might be requested from us as evidence. After that we delete or anonymise it, so that it can no longer be linked to you.

7. Your rights

With regard to the data we hold, you have the right:

• to know what data we hold and to receive a copy;
• to request the rectification of inaccurate or incomplete data;
• to request its erasure, under the conditions provided by law;
• to request restriction of processing while we verify an objection;
• to object to processing based on our legitimate interest;
• to receive the data in a format you can take to another provider;
• to withdraw your consent at any time, without giving reasons.

We do not make automated decisions that affect you and we do not build profiles that influence your price or treatment.

For cookies, you can withdraw consent directly from the preferences window, in two clicks. It is as easy as giving consent, as the law requires. For everything else, write to us at contact@forestretreatvillas.ro and we will reply within 30 days at most. If the request is complex and we need more time, we will let you know within this period and tell you why.

Withdrawing consent does not make the processing carried out before it unlawful, but it stops it from that point on.

8. How we protect the data

The website runs exclusively over an encrypted connection. Access to form messages and to the consent register is limited to the people who need it. The register cannot be opened from the internet: it is blocked at server level. The forms are protected against automated submissions, and messages are never published anywhere.

No measure is perfect. If an incident does occur that may affect your rights, we notify the authority within 72 hours and we also notify you, where the law requires us to.

9. Minors

The website is intended for adults. We do not knowingly collect data from children under 16. If a parent tells us the number and ages of their children for a booking, we use that information only to prepare the accommodation. If we learn that we have received any other data about a child, we delete it.

10. Marketing communications

We do not have a newsletter and we do not send promotional emails. We use the address you leave us in the form to reply to your request and to discuss your booking, nothing more.

Should we ever start a newsletter, it will require a separate subscription with email confirmation, not the addition of people who have already written to us.

11. If you are not satisfied

Please write to us first: most matters can be resolved directly. If our reply does not satisfy you, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (Romania):

B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, București, Romania
Email: anspdcp@dataprotection.ro
dataprotection.ro

You also have the right to bring an action before the courts.

12. Changes to this policy

When we change something important, we update the date at the top of the page. If the change concerns processing to which you have given your consent, we will ask for your consent again rather than relying on the old one.