Privacy policy

Last updated: 18 October 2026

This policy explains which personal data we process when you book on the Trei Vetre website, why, how long we keep it and what rights you have under Regulation (EU) 2016/679 (GDPR).

1. Controller

DAS TRADE BUCOVINA SRL, VAT no. RO44758563, 23A Poligonului Street, Vatra Dornei, Suceava County, Romania. Data protection contact: dastradebucovina@gmail.com, +40 756 101 012.

2. Data we process

• Contact and booking data: name, phone, email, country, property and stay dates, number of guests and children's ages, your message, chosen payment method.
• Guest registration data (online check-in): for each guest — surname, first name, date and place of birth, citizenship, type, series and number of the identity document, home address; estimated arrival time.
• Invoice data: ID document series and number (or company details), address, town, county and country.
• Payment data: the deposit is paid through Netopia Payments. We only receive the payment confirmation; we never see or store card details.
• Minimal technical data needed to run and secure the website (for example an anonymised fingerprint of the IP address used to protect forms against abuse).

3. Purposes and legal bases

• Handling your request and booking, communicating with you and sending the access code — performance of a contract (Art. 6(1)(b) GDPR).
• Guest registration and tax/accounting obligations — legal obligation (Art. 6(1)(c)).
• Sending offers, only if you ticked the consent box — consent (Art. 6(1)(a)); you can withdraw it at any time by writing to us.
• Website security and abuse prevention — legitimate interest (Art. 6(1)(f)).

4. Retention

• Identity data from check-in (guest registration form): 5 years from the arrival date, then deleted automatically.
• Booking and invoicing data: for the period required by accounting law.
• Marketing data: until you withdraw consent.

5. Who else has access

We never sell or rent your data. We use providers that process it only on our behalf, under contract:

• Supabase — database and data hosting in the European Union (Frankfurt, Germany).
• Netopia Payments — online payment processing.
• SmartBill — invoicing.
• Resend — booking-related emails. Resend may process data outside the European Economic Area under the European Commission's standard contractual clauses.
• Vercel — website hosting.

Data may be disclosed to authorities only where the law requires it.

6. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Write to dastradebucovina@gmail.com; we reply within one month. You may also lodge a complaint with the Romanian data protection authority (ANSPDCP).

7. Security

Data is protected by encrypted connections, administrator-only access and database-level access rules. Your personal booking link is secret; please do not share it.