Legal · GDPR
Privacy policy
Last updated: April 2026 · [DENUMIRE COMPANIE]
1. Data controller
The personal data controller is [DENUMIRE COMPANIE], with its registered office at [ADRESA], tax ID (CUI) [CUI]. Email: postulcuapa@gmail.com. By using our services, you agree to the processing of your data in accordance with this policy.
2. Data collected
We collect the following categories of data: identification data (first name, last name, email, phone), when you book, contact us or subscribe to the newsletter; medical data (blood type, weight, height, conditions), only for retreat bookings and with your explicit consent; payment data, processed securely by Stripe (we do not store card details); browsing data (IP address, browser, pages visited), through cookies, with your consent.
3. Purpose of processing
Data is processed for: performing the contract (processing bookings and payments); communication about your booking or order; sending the newsletter (only with explicit consent); improving our services and the site; complying with legal obligations.
4. Legal basis
We process data on the basis of: performance of a contract (Art. 6(1)(b) GDPR); explicit consent (Art. 6(1)(a) GDPR), for the newsletter and medical data; legitimate interest (Art. 6(1)(f) GDPR), for platform security.
5. Your rights
Under the GDPR, you have: the right of access to your data; the right to rectification; the right to erasure (the 'right to be forgotten'); the right to restriction of processing; the right to data portability; the right to object; the right to withdraw consent at any time. To exercise your rights, write to postulcuapa@gmail.com.
6. Data security
We implement appropriate technical and organisational measures to protect data: HTTPS connection, encryption of sensitive data, restricted access. The platforms used (Supabase, Stripe) comply with international security standards.
7. Cookies
We use cookies for site functionality, analytics (Google Analytics) and marketing (Facebook Pixel), with your consent. You can manage cookie preferences from the consent banner displayed on your first visit.
8. International transfers
Some services used (Stripe, Supabase, Google) may transfer data outside the EU. These transfers are carried out with appropriate safeguards (Standard Contractual Clauses or Privacy Shield certification).
9. Complaints
If you believe your rights are not being respected, you can file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP): www.dataprotection.ro