Privacy Policy

1. Data Controller

La Trei Surori, located at Strada Aurel Vlaicu 59, 500188 Brașov, Romania, is the data controller responsible for your personal data.

2. What Data We Collect

When you submit a booking inquiry through our contact form, we collect the following information:

• Full name
• Email address
• Phone number
• Message content
• Selected apartment(s) and guest count (adults and children)
• Check-in and check-out dates
• Cloudflare Turnstile verification token (anti-spam verification)
• Language preference (stored in your browser's local storage, only with your consent)

3. Purpose and Legal Basis

We process your personal data for the following purposes under the legal bases indicated:

• Responding to your booking inquiry — based on your consent (Art. 6(1)(a) GDPR) and pre-contractual measures (Art. 6(1)(b) GDPR)
• Sending you a confirmation email regarding your inquiry — based on legitimate interest (Art. 6(1)(f) GDPR)
• Protecting our contact form from spam and abuse via Cloudflare Turnstile — based on legitimate interest (Art. 6(1)(f) GDPR)
• Remembering your language preference — based on your consent (Art. 6(1)(a) GDPR)

4. Data Retention

We retain your booking inquiry data for up to 30 days after your scheduled check-out date, or for 12 months if no date was selected. After this period, the data is deleted from our email systems. Cookie preferences are stored for 365 days. You may request earlier deletion at any time.

5. Third-Party Data Processors

We use the following third-party services that may process your personal data on our behalf:

• Brevo (Sendinblue) — email delivery service based in France, GDPR-compliant. Processes your name, email, phone, and message content for email transmission.
• Cloudflare Turnstile — privacy-first anti-spam service provided by Cloudflare, Inc. Processes a challenge-response to verify you are not a bot without tracking.
• Vercel Inc. — hosting platform. Your data may pass through Vercel's infrastructure for website delivery.
• Booking.com — if you book through Booking.com, their privacy policy applies to that transaction.

6. Cookies and Similar Technologies

Our website uses a cookie to store your consent preferences and, with your consent, browser local storage for your language preference. Cloudflare Turnstile sets a necessary security cookie (cf_clearance) for challenge verification. You can manage your preferences through the cookie banner at the bottom of the page. Click "Cookies" in the navigation bar to change your preferences at any time.

7. International Data Transfers

Your personal data is processed within the European Union. Our email service (Brevo) is based in France. Vercel's infrastructure uses EU-based servers. No personal data is transferred outside the EU/EEA without appropriate safeguards.

8. Your Rights

Under the GDPR, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate personal data
• Right to erasure ("right to be forgotten") — request deletion of your data
• Right to restriction of processing — limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw your consent at any time

To exercise any of these rights, please contact us at contact@latreisurori.com with the subject "Data Request". We will respond within 30 days.

9. Right to Lodge a Complaint

If you believe that our processing of your personal data violates GDPR, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) of Romania at www.dataprotection.ro.

10. Updates to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page. We encourage you to review this page periodically.