1. Data controller
The controller of personal data processed through discoverromaniaguide.com is:
- Company name
- DISCOVER HISTORICAL ROMANIA S.R.L.
- Trade Register No.
- J201901523408
- Tax ID (CUI)
- 41874733
- Registered office
- Str. Caius Marcius Coriolan nr. 34, sc. 2, et. 4, ap. 27, Sector 5, Bucharest, Romania
For any question or request about your personal data, write to us at contact@discoverromaniaguide.com. We have not appointed a data protection officer (DPO), as this is not required for our activity; requests are handled directly by our team.
This policy applies to the website. Data processing carried out through the mobile app is described in the privacy information shown in the app and on its app store page.
2. What data we process
We only process data that you send us or that is strictly necessary for the website to work:
- Contact form: name, email address, phone and organisation (optional), topic, the attraction your message refers to (optional) and the message itself.
- Museum (partnership) form: name of the institution or attraction, its type, city/county, contact person’s name, email address, phone (optional) and message.
- Messages sent directly by email to our address: email address, name and any other information included in the message.
- Technical data: for every visit, the hosting server automatically records the IP address, date and time, the page accessed and the browser type (server logs). To protect the forms against abuse, we keep a cryptographic fingerprint (hash) of the IP address for up to one hour, from which the address cannot be read directly.
- Strictly necessary cookies, described in our Cookie policy.
We do not use traffic analytics, advertising or profiling tools. Please do not send us sensitive data (for example health data) through the forms.
3. Why we process data and on what legal basis
- Answering your messages and questions — our legitimate interest in communicating with people who contact us (Art. 6(1)(f) GDPR).
- Reviewing partnership enquiries and discussing the inclusion of an attraction in the app — steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and, where applicable, performing the contract.
- Website security and abuse prevention (spam, attacks) — our legitimate interest (Art. 6(1)(f) GDPR).
- Complying with legal obligations, such as keeping accounting records if a partnership is concluded or responding to requests from authorities (Art. 6(1)(c) GDPR).
The fields marked * in the forms are needed so we can receive and answer your request; without them we cannot process your message. We do not make decisions based solely on automated processing and we do not create profiles.
4. Who we share data with
We do not sell or rent personal data. It can only be accessed by:
- the Discover Romania team handling your request;
- the providers of our technical services — website hosting and email (Romarg, with servers in Romania) and, where applicable, the IT providers who maintain the website — only to the extent necessary and under confidentiality obligations;
- public authorities, only when required by law.
We do not transfer data outside the European Economic Area.
5. How long we keep data
- Contact messages and related correspondence: up to 2 years after the last communication, after which we delete them.
- Partnership enquiries: up to 2 years after the last communication if no partnership is concluded; if one is, for the duration of the partnership and afterwards for the period required by accounting and archiving law.
- IP address fingerprint (hash) used against abuse: up to one hour.
- Server logs: the limited period set by the hosting provider for security purposes.
- Session cookies: until you close your browser.
6. Your rights
Under Regulation (EU) 2016/679 (GDPR), you have the right:
- of access to your data and to receive a copy of it;
- to rectification of inaccurate data;
- to erasure (“right to be forgotten”);
- to restriction of processing;
- to data portability;
- to object to processing based on our legitimate interest;
- not to be subject to a decision based solely on automated processing.
To exercise these rights, write to us at contact@discoverromaniaguide.com. We will reply without undue delay and within one month of receiving your request (a period that may be extended as provided by law). We may ask for additional information to confirm your identity.
You also have the right to lodge a complaint with the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, www.dataprotection.ro.
7. How we protect data
The website uses an encrypted connection (HTTPS). Form data is sent directly by email to our team and is not stored in a database on the website. Access to the administration area is restricted and protected. However, no method of transmission over the internet is completely secure, so we cannot guarantee absolute security.
8. Children
The website is not aimed at children under 16 and we do not knowingly collect their data. If you learn that a child has sent us personal data, write to us and we will delete it.
9. External links and platforms
Links to social networks (Facebook, Instagram, YouTube, TikTok), app stores or museum websites lead to platforms that have their own privacy policies. We do not load content from these platforms on our pages; they only receive data about you if you visit them.
10. Changes
We may update this policy when the way we process data or the law changes. The version in force is the one published here, with the date of the last update shown at the top. See also our Terms & conditions.