Privacy notice

Gaál Mansion (GAL BARABAS SRL)

‍

1. Data Controller Details

This section provides information about the entity responsible for processing personal data.

The data controller:

• Company name: GAL BARABAS SRL 
• Registration number: J14/211/2014 
• EUID: ROONRC.J14/211/2014 
• VAT number (CUI): 33612626 
• Representative: Csiszér Gábor 
• Email: manager@gaalkuria.com 
• Phone: +40 727 319 323 
• Website: https://www.gaalkuria.com 

‍

2. Legal Basis for Processing

Personal data is processed in accordance with applicable European Union and Romanian data protection laws. Processing is based on the following legal frameworks:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) 
• Applicable Romanian data protection legislation 
• Accounting and tax regulations 
• Legal obligations related to tourism and guest registration 

‍

3. Principles of Data Processing

Personal data is processed in accordance with the fundamental principles established by applicable legislation. The data controller adheres to the following principles:

• lawfulness, fairness and transparency 
• purpose limitation 
• data minimisation 
• accuracy 
• storage limitation 
• integrity and confidentiality 

‍

4. Categories of Data and Purpose of Processing

This section outlines the categories of personal data processed, as well as the purposes and legal bases for processing.

‍

4.1. Bookings and Guest Management

During the booking process, personal data necessary for providing accommodation services is processed. Processed data:

• name 
• email address 
• phone number 
• billing details 
• identification document details 
• payment information 

Purpose:

• managing reservations 
• performance of a contract 
• communication with guests 
• invoicing 
• compliance with legal obligations 

Legal basis:

• performance of a contract (Art. 6(1)(b) GDPR) 
• legal obligation (Art. 6(1)(c) GDPR) 
• consent (Art. 6(1)(a) GDPR) 

‍

4.2. Online Payments

Online payments are processed securely through a third-party provider. In the case of advance payments, personal data is processed by Netopia Payments.

Purpose: payment processing
Legal basis: performance of a contract

‍

4.3. Website Usage

When using the website, certain technical data is collected automatically.

Processed data:

• IP address 
• browsing data 
• device information 

Purpose:

• operation of the website 
• security 
• statistical analysis 

Legal basis:

• consent 
• legitimate interest 

4.4. Marketing and Newsletter

Marketing communications are sent to individuals who have provided their consent. Processed data:

• name 
• email address 

Purpose:

• sending newsletters 
• promotional offers 
• communication with returning guests 

Data subjects may unsubscribe at any time.

‍

4.5. Remarketing and Advertising

Marketing and analytics tools are used to optimise advertising activities. Systems used:

• Google Analytics 
• Google Ads 
• Meta (Facebook) Pixel 

Purpose: measuring campaign effectiveness and remarketing.

‍

4.6. Video Surveillance

For security purposes, the premises are monitored באמצעות a video surveillance system.

Monitored areas:

• parking area 
• courtyard 
• entrance 
• exterior areas of buildings 

Processed data: video recordings 

Purpose:

• security 
• protection of property 

Legal basis: legitimate interest 

‍

5. Data Transfers and Processors

In the course of providing services, personal data may be shared with third parties involved in service delivery. Partners include:

• Pynbooking – booking system 
• Webflow – website platform 
• Netopia Payments – payment processor 
• Google – analytics and advertising 
• Meta – remarketing 
• MailerLite – newsletter service 

These entities may act as data processors or independent data controllers.

‍

5.1. Transfers to Authorities

Personal data may be disclosed to competent authorities where required by law.

‍

6. Data Retention

Personal data is stored only for as long as necessary to fulfil the purposes of processing or to comply with legal obligations.

• booking data: up to 10 years 
• invoicing data: 10 years 
• marketing data: until consent is withdrawn 
• video recordings: maximum 30 days 

‍

7. Use of Cookies

The website uses cookies to ensure proper functionality and improve user experience.

Types of cookies used:

• essential cookies 
• analytical cookies (Google Analytics) 
• marketing cookies (Meta Pixel, Google Ads) 

Consent is obtained via the cookie banner.

‍

8. Rights of Data Subjects

Data subjects have rights regarding the processing of their personal data.

These include:

• right of access 
• right to rectification 
• right to erasure 
• right to restriction of processing 
• right to object 
• right to data portability 

Requests may be submitted to manager@gaalkuria.com

‍

9. Complaints and Remedies

If you believe your rights have been violated, you have the right to lodge a complaint.

Complaints may be submitted to: the Romanian Data Protection Authority (ANSPDCP) or the competent courts 

‍

10. Final Provisions

The data controller reserves the right to amend this Privacy Notice.

The latest version is always available on the website.