Privacy Policy

Last updated: July 2026

1. Introduction and data controller

This Privacy Policy describes how SC TAKE-4 SRL, operating the "Casa Vale" holiday homes, collects, uses, stores and protects your personal data when you visit our website, contact us or make a booking. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and applicable Romanian law, including Law No. 190/2018.

The data controller is:

SC TAKE-4 SRL
Trade Register No.: J32/302/2006
Sole Registration Code (CUI): 18440390
Registered office: sat Vale nr. 325, oraș Săliște, județ Sibiu, România
Phone: 0756 524 042
E-mail: info@casa-vale.ro

By using our website and services you acknowledge that you have read and understood this Policy.

2. Categories of personal data we collect

Depending on how you interact with us, we may process the following categories of data:

Identification and contact data: name and surname, e-mail address, telephone number, postal address, country of residence.
Booking data: chosen property, arrival and departure dates, number of guests, special requests, and where applicable payment references (we do not store full card numbers).
Communication data: the content of messages you send us via the contact form, e-mail, telephone or the guestbook.
Technical and usage data: IP address, browser type and version, device and operating system, pages visited, date and time of access, referring website — collected automatically, largely through cookies (see our Cookies Policy).

We do not knowingly collect special categories of data (e.g. health, religion) and we do not knowingly collect data from children under 16 without parental consent.

3. Purposes of processing

We process your personal data for the following purposes:

To respond to your enquiries and manage the pre-contractual relationship;
To make, confirm and administer your booking and to provide the accommodation services;
To send you booking-related communications (confirmations, changes, practical information);
With your consent, to send occasional marketing or newsletters about our offers;
To comply with our legal obligations (accounting, tax, guest records required by law);
To establish, exercise or defend legal claims and to ensure the security of our website.

4. Legal basis for processing (Art. 6 GDPR)

Performance of a contract or steps at your request prior to a contract — Art. 6(1)(b): for handling enquiries, bookings and the stay;
Consent — Art. 6(1)(a): for marketing communications and for non-essential cookies; consent may be withdrawn at any time;
Legal obligation — Art. 6(1)(c): for accounting, tax and mandatory guest records;
Legitimate interest — Art. 6(1)(f): for the security of our site, prevention of fraud and defence of our rights, balanced against your interests and rights.

5. Recipients of the data

We do not sell your personal data. We may disclose it only to:

Processors acting on our behalf under a data-processing agreement: our web-hosting provider, e-mail and IT service providers, and payment processors (e.g. bank, PayPal);
Professional advisers such as our accountant, where necessary for legal/tax compliance;
Public authorities, only where we are required to do so by law or to defend our legal rights.

6. International transfers

Our data is primarily stored within the European Economic Area (EEA). Where a service provider processes data outside the EEA (for example certain analytics or e-mail services), we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses or an adequacy decision, so that your data enjoys an equivalent level of protection.

7. Retention period

We keep your personal data only for as long as necessary for the purposes for which it was collected:

Enquiry data that does not lead to a booking: up to 12 months;
Booking and contract data: for the duration of the stay and thereafter for the periods required by tax and accounting law (generally up to 5–10 years);
Marketing data: until you withdraw your consent or unsubscribe;
Technical/cookie data: as described in our Cookies Policy.

When the retention period ends, data is securely deleted or anonymised.

8. Your rights as a data subject

Under the GDPR you have the following rights, which you may exercise free of charge:

Right of access — to obtain confirmation of whether we process your data and a copy of it;
Right to rectification — to have inaccurate or incomplete data corrected;
Right to erasure ("right to be forgotten") — to have your data deleted where there is no overriding legal ground to keep it;
Right to restriction — to limit processing in certain circumstances;
Right to data portability — to receive your data in a structured, commonly used, machine-readable format;
Right to object — to object to processing based on legitimate interest or to direct marketing;
Right to withdraw consent — at any time, without affecting the lawfulness of prior processing;
Right to lodge a complaint — with the supervisory authority (see section 13).

9. How to exercise your rights

To exercise any of these rights, please write to us at info@casa-vale.ro or to our registered office at sat Vale nr. 325, oraș Săliște, județ Sibiu, România. We will respond to your request without undue delay and in any event within one month of receipt, as provided by Art. 12 GDPR. We may ask you to confirm your identity before acting on your request.

10. Data security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure, including encrypted (HTTPS) transmission, access controls, secure hosting and regular review of our procedures. However, no transmission over the internet can be guaranteed as fully secure.

11. Cookies

Our website uses cookies and similar technologies. For full details of the cookies we use, their purpose and duration, and how to manage your preferences, please read our Cookies Policy.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in the law or in our practices. The current version is always published on this page with the date of the last update. Significant changes will be signalled on the website.

13. Supervisory authority (ANSPDCP)

If you consider that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, e-mail anspdcp@dataprotection.ro, website www.dataprotection.ro.

14. Contact

For any question regarding this Privacy Policy or the processing of your personal data, please contact the controller: