This policy explains what personal data we collect, why we use it, and the choices available to you when you use our website or book a stay.

This policy is based on Regulation (EU) 2016/679 (GDPR), Law no. 190/2018, and Law no. 506/2004 regarding electronic communications.

Karstic Chalets collects, processes, uses, and stores your personal data for the following situations:

• Providing tourist and booking services (legal basis: performance of a contract), including communication before and during the stay.
• Compliance with legal obligations, including accounting, invoicing, and reporting to competent public authorities.
• Fraud prevention, platform security, and service quality improvements (legal basis: legitimate interest).
• Marketing communications only where consent is provided or where another lawful basis applies.

Depending on the service, we may process: name, email, phone number, booking details, billing details (including company details when invoicing is requested), and optional information sent through forms (for example message content or optional date of birth fields). Card details are processed by Stripe and are not stored by Karstic Chalets.

We do not request CNP, ID/CI series and number, or bank account details through our standard booking and contact forms.

IMPORTANT! Data required to provide the booked services and issue invoices is mandatory. If required data is not provided, we may be unable to complete the booking.

Retention periods are set by data category and legal obligations. Booking and communication data is retained only as necessary for service and defense of legal claims, while accounting and invoice data is retained for the period required by Romanian fiscal law.

We do not use your personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.

For the purposes above, personal data may be disclosed to processors and partners under contract, strictly on a need-to-know basis.

• Public authorities and institutions, where disclosure is required by law.
• Stripe (payment processing) and Factureaza.ro (invoicing).
• Resend (transactional emails), Vercel (hosting and analytics), Google Analytics, and OpenAI Ads Manager (advertising measurement), when enabled according to your consent choices.
• Authorized Karstic Chalets personnel and professional advisors (for example accounting and legal services). Where data is transferred outside the EEA, appropriate safeguards are applied according to GDPR.

Karstic Chalets applies technical and organizational safeguards designed to protect your personal data against unauthorized access, loss, misuse, or alteration.

You may ask us to confirm whether we process your personal data and request access to it, correction of inaccurate data, deletion, restriction of processing, objection, or data portability where applicable.

Send requests to contact@karstic.ro. Please include enough information for us to identify the relevant booking or conversation. We may ask for additional information where needed to protect against unauthorized requests.

We will respond within the time required by applicable data-protection law. You may also lodge a complaint with the Romanian data-protection authority, ANSPDCP.

We use cookies and similar technologies to run the website, remember your settings, and understand traffic and performance. Cookies are small text files stored on your device.

Strictly necessary cookies are used for essential site functions. Analytics technologies are used only according to your consent choice.

We use cookies for the following purposes:

• To remember preferences and consent settings. The consent-choice cookie, named karstic_consent, is currently stored for 180 days.
• To measure traffic, performance, and selected interactions so we can improve the website. These analytics features are enabled only when you allow analytics in your cookie preferences.
• Advertising measurement technologies, including the OpenAI Ads Manager pixel, are enabled only when you choose to allow marketing technologies.

You can change cookie preferences at any time and also manage cookies from your browser settings. Disabling some cookies may affect certain site features.

The consent-choice cookie is named karstic_consent and is currently stored for 180 days. It records separate choices for analytics and marketing. Google Analytics, Vercel Analytics, and selected custom analytics events require analytics consent. The OpenAI Ads Manager pixel requires marketing consent.