Karstic Chalets S.R.L (hereinafter referred to as "Karstic Chalets"), a Romanian company with a registered office in Municipiul Cluj Napoca, Strada Campului, Nr: 161, Scara: III, Ap: 7, judet Cluj, is registered in the trade register under number J12/1504/31.03.2023 and has CUI: 47924016 and processes your personal data through its own application.

This policy is based on Regulation (EU) 2016/679 (GDPR), Law no. 190/2018, and Law no. 506/2004 regarding electronic communications.

Karstic Chalets collects, processes, uses, and stores your personal data for the following situations:

• Providing tourist and booking services (legal basis: performance of a contract), including communication before and during the stay.
• Compliance with legal obligations, including accounting, invoicing, and reporting to competent public authorities.
• Fraud prevention, platform security, and service quality improvements (legal basis: legitimate interest).
• Marketing communications only where consent is provided or where another lawful basis applies.

Depending on the service, we may process: name, email, phone number, booking details, billing details (including company details when invoicing is requested), and optional information sent through forms (for example message content or optional date of birth fields). Card details are processed by Stripe and are not stored by Karstic Chalets.

We do not request CNP, ID/CI series and number, or bank account details through our standard booking and contact forms.

IMPORTANT! Data required to provide the booked services and issue invoices is mandatory. If required data is not provided, we may be unable to complete the booking.

Retention periods are set by data category and legal obligations. Booking and communication data is retained only as necessary for service and defense of legal claims, while accounting and invoice data is retained for the period required by Romanian fiscal law.

For the purposes above, personal data may be disclosed to processors and partners under contract, strictly on a need-to-know basis.

• Public authorities and institutions, where disclosure is required by law.
• Stripe (payment processing).
• Factureaza.ro (invoicing), Resend (transactional emails), and technical providers used for hosting, monitoring, and analytics.
• Authorized Karstic Chalets personnel and professional advisors (for example accounting and legal services). Where data is transferred outside the EEA, appropriate safeguards are applied according to GDPR.

Karstic Chalets applies technical and organizational safeguards to protect personal data. You have the rights provided by GDPR, including access, rectification, erasure, restriction, objection, portability, and withdrawal of consent where applicable. Requests can be sent to contact@karstic.ro. You also have the right to lodge a complaint with ANSPDCP.

We use cookies and similar technologies to run the website, remember your settings, and understand traffic and performance. Cookies are small text files stored on your device.

Strictly necessary cookies are used for essential site functions. Non-essential cookies (for analytics or marketing) are used only according to your consent choices.

We use cookies for the following purposes:

• To remember preferences and consent settings (for example, the consent-choice cookie is currently stored for 7 days).
• To measure performance and improve functionality.
• To support marketing-related features only if such features are active and consent was provided.

You can change cookie preferences at any time and also manage cookies from your browser settings. Disabling some cookies may affect certain site features.