Your privacy matters to us. This document explains, in plain language, what personal data we collect through peunde.ro, why we collect it, how long we keep it and what rights you have over it.
It follows Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR), Romanian Law no. 190/2018 implementing the GDPR, and Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.
Language This is a translation provided for convenience. In case of any discrepancy, the Romanian version prevails.
1. Who the data controller is
The controller that determines the purposes and means of processing your personal data is:
- Project
- Peunde
- Website
- https://peunde.ro
- contact@peunde.ro
For any question about how your data is processed, or to exercise the rights described below, write to us at contact@peunde.ro.
We have not appointed a data protection officer (DPO), as our activity does not fall within the cases set out in Article 37(1) GDPR. Data protection requests are handled directly at the e-mail address above.
2. What data we collect
2.1. Data you send us
The website has no contact forms, user accounts or online payments. Data reaches us only when you write to us, on your own initiative, at the e-mail address shown on the site. In your message you may send us:
- your name;
- your e-mail address and, optionally, your phone number;
- the name and details of the property you run (hotel, guesthouse, villa and so on);
- any other information you choose to include in the message.
Please do not send us special categories of data (health, religious beliefs, trade union membership and the like). We do not need them and we do not ask for them.
2.2. Data collected automatically
When you visit the site, the following categories are processed automatically:
- Technical security data — IP address, browser type and operating system, date and time of access. These are processed by our hosting and content delivery provider (Cloudflare) in order to serve the pages, prevent automated attacks and keep the site available.
- Statistical data — processed only if you consent to analytics cookies: pages visited, time on site, where you came from, device type, country and approximate city. This data is collected through Google Analytics 4 and is not used to identify you personally.
If you decline analytics cookies, Google Analytics is not loaded at all and no analytics cookie is placed on your device.
3. Purposes and legal bases
We process your data only for defined purposes, each with a clear legal basis under Article 6 GDPR:
| Purpose | Data processed | Legal basis |
|---|---|---|
| Replying to your message and carrying out the free audit | Name, e-mail, phone, details about the property, content of the message | Art. 6(1)(b) — steps taken at your request prior to entering into a contract |
| Performing the services contract, if we decide to work together | Identification and contact details, billing details | Art. 6(1)(b) — performance of a contract |
| Issuing invoices and keeping accounting records | Billing details | Art. 6(1)(c) — legal obligation (Romanian Law no. 82/1991, Fiscal Code) |
| Statistics on how the site is used and improving the content | Navigation statistics (Google Analytics) | Art. 6(1)(a) — your consent, which you may withdraw at any time |
| Site security, prevention of fraud and automated attacks | IP address, technical access data | Art. 6(1)(f) — our legitimate interest in keeping the site working and safe |
| Establishing, exercising or defending a legal claim | Relevant correspondence, contractual documents | Art. 6(1)(f) — legitimate interest |
Providing your data is voluntary. If you choose not to give us your contact details, we will not be able to answer your request; there is, however, no negative consequence for browsing the site.
4. Cookies and similar technologies
We use strictly necessary cookies for the site to work and, only with your prior consent, analytics cookies. The banner shown on your first visit lets you accept or decline optional cookies with the same number of clicks — declining is as easy as accepting.
You can change your choice at any time using the button in the footer of every page.
The full list of cookies, with provider, purpose and duration, is in our Cookie policy.
5. Who we share data with
We do not sell or rent your data to anyone. We disclose it only to the following categories of recipients, strictly as far as necessary:
- Hosting and CDN provider — Cloudflare, Inc., which hosts the site and filters malicious traffic;
- Analytics provider — Google Ireland Limited (Google Analytics 4), only if you have consented;
- E-mail provider — for receiving and storing correspondence;
- Accounting provider — for issuing and recording tax documents, if you become a client;
- Public authorities — where we have a legal obligation to disclose the data.
All providers that process data on our behalf act as processors and have data processing agreements in place with us under Article 28 GDPR.
6. Transfers outside the EU/EEA
Some of our providers are companies established in the United States (Google LLC, Cloudflare, Inc.). Data is transferred to them safely, on the basis of:
- the European Commission's adequacy decision on the EU–U.S. Data Privacy Framework, to which those providers are certified; and/or
- standard contractual clauses adopted by the European Commission, together with additional technical measures.
You can request a copy of the applicable safeguards by writing to contact@peunde.ro.
7. How long we keep data
| Category | Retention period |
|---|---|
| E-mail correspondence with no contract concluded | Maximum 3 years from the last message |
| Contractual data and correspondence with clients | 3 years from the end of the contract (the general limitation period) |
| Accounting documents and invoices, if a paid engagement goes ahead | 10 years, under Romanian Accounting Law no. 82/1991 |
| Google Analytics statistics | 14 months from collection |
| Record of your cookie consent | 6 months, after which we ask you again |
| Technical security logs | Maximum 12 months |
Once these periods expire, the data is deleted or irreversibly anonymised.
8. Your rights
As a data subject you have the following rights, which you can exercise free of charge:
- Right of access (Art. 15) — to find out whether we process data about you and to receive a copy of it.
- Right to rectification (Art. 16) — to have inaccurate data corrected or incomplete data completed.
- Right to erasure (Art. 17), the “right to be forgotten” — to have data deleted where there is no longer a basis for keeping it.
- Right to restriction of processing (Art. 18) — to limit processing in certain situations, for example while we verify the accuracy of the data.
- Right to data portability (Art. 20) — to receive your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21) — to object to processing based on our legitimate interest.
- Right to withdraw consent (Art. 7(3)) — at any time, as easily as you gave it, without affecting the lawfulness of processing carried out before withdrawal.
- Right not to be subject to automated decision-making (Art. 22) — we do not make such decisions, as explained below.
To exercise any of these rights, write to contact@peunde.ro. We reply within one month of receiving your request. That period may be extended by up to two further months for complex requests, in which case we will tell you about the extension and the reasons for it. To prevent disclosure to someone not entitled to the data, we may ask you for additional information needed to confirm your identity.
9. How to lodge a complaint
If you believe we have infringed your rights, please contact us first — most situations can be resolved quickly. You always have the right, however, to lodge a complaint with the supervisory authority:
- Authority
- The National Supervisory Authority for Personal Data Processing (ANSPDCP)
- Address
- B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336, Bucharest, Romania
- Phone
- +40 318 059 211
- anspdcp@dataprotection.ro
- Web
- www.dataprotection.ro
You may also bring the matter before the competent courts.
10. Data security
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction: encrypted HTTPS across the whole site, security headers configured at server level, protection against automated attacks through Cloudflare, access to correspondence limited to those who need it, and two-factor authentication on the accounts we use.
No system is completely secure, however. In the event of a personal data breach likely to affect your rights, we will notify ANSPDCP within 72 hours and inform you directly where the law requires it.
11. Children
The site is aimed at professionals in the hospitality industry and is not intended for anyone under 16. We do not knowingly collect data from children. If you are a parent or guardian and believe a child has sent us personal data, write to us and we will delete it without delay.
12. Automated decisions and profiling
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Google Analytics statistics are used only in aggregate form, to understand which content is useful to readers.
13. Links to other websites
The site contains links to external resources (for example Google, ANPC, ANSPDCP). We are not responsible for the privacy practices of those sites. We encourage you to read their policies before giving them personal data.
14. Changes to this policy
We may update this policy whenever the way we process data or the applicable legal framework changes. The version in force is always the one published on this page, and the date of the last update is shown at the top of the document. For substantial changes, we will ask for your consent again where consent is the basis for the processing.
For any question about this document, write to us at contact@peunde.ro.