Privacy Policy — La Residenza

1. Who we are

The privacy of your data is important to us. This policy explains what personal data we collect, for what purposes, on what legal basis, with whom we share it and what rights you have in relation to it.

The personal data controller:
LA RESIDENZA S.R.L., with registered office at 14 Independenței Street, postal code 300207, Timișoara, Timiș County, Romania. Tax ID (CUI): 13926918. Trade Registry number: J2001000635359. Email: contact@laresidenza.ro. Phone: 0256 401 080.

Hereinafter referred to as the "Company", "we" or "La Residenza". The Company operates La Residenza hotel in Timișoara, as well as the Sempre restaurant and pool area, located within the hotel premises.

Data is processed in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018.

2. Who this policy applies to

This policy applies to:

visitors to the website www.laresidenza.ro;
persons who contact us through the contact form, email, phone or social media;
clients who make accommodation reservations, reservations at the Sempre restaurant or for the pool area;
persons staying at the hotel;
candidates who send us their CVs.

Note on age: the venue operates on an adults only basis. We do not address persons under 18 and do not knowingly collect their data. If we find out that we have received such data, we will delete it without undue delay.

3. What data we collect

3.1 Data you provide directly

Contact form / email / phone: first name, last name, email address, phone number, the content of the message
Accommodation request or reservation: first name, last name, contact details, requested period, number of persons, special preferences and requests
Sempre restaurant / pool reservation: name, phone number, date, time, number of persons, any dietary preferences voluntarily communicated
Hotel check-in: data from the identity document (first name, last name, personal numeric code or equivalent, document series and number, citizenship, date of birth, domicile), in accordance with the legal obligations regarding the register of tourists
Invoicing: name/company name, address, tax ID or personal numeric code (as applicable), data required to issue fiscal documents
Newsletter (if available): email address, possibly first name
Recruitment: the data voluntarily included in the CV and cover letter

Please do not send us sensitive data (regarding health, religious beliefs, etc.) except to the extent strictly necessary — for example, a food allergy or an accessibility need that you would like us to take into account.

3.2 Data collected automatically through the site

IP address (in full or truncated, depending on the tool)
browser type and version, operating system, device type
pages visited, duration of the visit, traffic source
date and time of access
cookie identifiers and similar technologies

Collected through server log files and analytics tools. Full details in the Cookie Policy.

3.3 Data obtained from other sources

We may receive data about you from partner online booking platforms (name, contact details, reservation details), when you make a reservation through them.

3.4 Video surveillance

A video surveillance system operates in the common areas of the venue, indicated by pictograms at the entrance. Areas with a reasonable expectation of privacy (rooms, restrooms, changing rooms) are not monitored. Further details are available at reception.

4. Why we process data and on what legal basis

Responding to requests (form, email, phone) — pre-contractual steps / legitimate interest (art. 6(1)(b), (f))
Managing reservations and providing services — performance of the contract (art. 6(1)(b))
Register of tourists and reporting to authorities — legal obligation (art. 6(1)(c))
Issuing invoices and accounting documents — legal obligation (art. 6(1)(c))
Commercial communications and newsletter — consent (art. 6(1)(a))
Traffic analysis and site improvement — consent, non-essential cookies (art. 6(1)(a))
Site security and fraud prevention — legitimate interest (art. 6(1)(f))
Video surveillance — legitimate interest (art. 6(1)(f))
Establishment, exercise or defence of a legal claim — legitimate interest (art. 6(1)(f))
Processing of job applications — pre-contractual steps (art. 6(1)(b))
Dietary preferences, allergies, accessibility needs — explicit consent, health data (art. 9(2)(a))

Providing data is voluntary. Without the necessary data, however, we will not be able to respond to your request, confirm a reservation or carry out check-in.

5. How long we keep the data

Messages via contact form / email: max. 1 year from the last correspondence
Reservations that did not materialise: max. 1 year
Accommodation and services provided: 3 years from the end of the stay
Accounting and fiscal documents: 5 years, and 10 years for payroll records
Register of tourists: in accordance with the applicable regulations
Newsletter: until consent is withdrawn
Video recordings: max. 30 days (exception: investigations/judicial proceedings)
Unsolicited CVs: max. 1 year, with the candidate's consent
Cookies: in accordance with the Cookie Policy

When these periods expire, the data is deleted or anonymised.

6. Who we disclose data to

We do not sell or rent your data. We may disclose it to the following categories of recipients, only to the extent necessary:

IT service providers — web hosting, maintenance, email, cloud storage
providers of hotel management and reservation systems (PMS, channel manager)
partner online booking platforms
marketing service providers — email marketing platforms, analytics tools
the Company's accountant and auditors
legal advisers, in case of litigation
public authorities (police, ANAF, tourism authorities, courts), when required by law

Providers that process data on our behalf act exclusively on our instructions, in accordance with art. 28 GDPR.

7. Transfers outside the European Economic Area

Some providers (e.g. analytics or email marketing tools) may store data on servers outside the EEA. The transfer is carried out on the basis of an adequacy decision of the European Commission or standard contractual clauses, with additional safeguards where appropriate.

Further information: contact@laresidenza.ro (section 11).

8. Data security

We apply appropriate technical and organisational measures: secure SSL/TLS connection, role-based access control, passwords and authentication, regular system updates, backups, staff training on confidentiality.

The transmission of information over the internet cannot be guaranteed to be completely secure. We recommend that you do not send particularly sensitive data, such as full bank card details, by email.

9. Your rights

Right of access — confirmation of processing and a copy of the data
Right to rectification — correction of inaccurate or incomplete data
Right to erasure ("right to be forgotten"), as provided by law
Right to restriction of processing (art. 18 GDPR)
Right to data portability — structured, commonly used, machine-readable format
Right to object — including to direct marketing
Right to withdraw your consent at any time
Right not to be subject to automated decision-making — we do not use automated decision-making processes and do not carry out profiling

To exercise your rights: contact@laresidenza.ro. We respond within 1 month at most (extendable by 2 months for complex requests). We may ask you for additional information to verify your identity.

Right to lodge a complaint:
The National Supervisory Authority for Personal Data Processing (ANSPDCP)
28-30 General Gheorghe Magheru Blvd., Sector 1, Bucharest
Email: anspdcp@dataprotection.ro · Web: www.dataprotection.ro

as well as the right to apply to the courts.

10. Cookies, external links and social media

The Site uses cookies and similar technologies. Non-essential cookies are placed only on the basis of your consent, given through the banner displayed on your first visit. Full details in the Cookie Policy.

The Site may contain links to third-party websites (booking platforms, maps, social networks). We are not responsible for their privacy practices.

If you contact us through Facebook, Instagram or other social networks, the processing of data by the platform takes place in accordance with its own policy.

11. Contact

LA RESIDENZA S.R.L.
14 Independenței Street, postal code 300207, Timișoara, Timiș County
Email: contact@laresidenza.ro · Phone: 0256 401 080

[Data Protection Officer (DPO), if appointed: name and contact details]

12. Changes to this policy

We reserve the right to update this policy whenever necessary. The updated version takes effect upon publication on the site.