Privacy policy
We protect your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the applicable Romanian legislation. This policy explains what data we process, for what purpose, and what rights you have.
What data we process
Identification and contact data (name, e-mail, phone), data required for the booking (passengers, travel documents), payment data (processed by PCI-DSS certified providers) and website usage data.
Purposes and legal basis
- Performing the booking (art. 6(1)(b)) — order handling, invoicing, voucher issuing.
- Legal obligations (art. 6(1)(c)) — retention of tax documents (10 years).
- Legitimate interest (art. 6(1)(f)) — improving our services and sending relevant communications.
- Consent (art. 6(1)(a)) — marketing, non-essential cookies.
Profiling and segmentation
In order to recommend relevant offers, we may compute internal scores (for example, the likelihood of booking) based on your history. This produces no legal effects on you. You may object to profiling for marketing purposes at any time from the “Privacy” section of your account.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. You can export your data or delete your account directly from the “Privacy” area. Identity documents are stored encrypted.
Sub-processors
We work with the following providers who process data on our behalf, under a data processing agreement (DPA) or standard contractual clauses:
| Provider | Role / data processed | Location |
|---|---|---|
| Resend | Email delivery (transactional + marketing) | EU |
| Stripe | Card payment processing | EU/US (SCC) |
| PayPal | PayPal payment processing | EU/US (SCC) |
| Mollie | Payment processing (card, iDEAL, etc.) | EU |
| Sentry | Technical error monitoring (no PII by default) | EU |
| Google Analytics 4 | Traffic analytics (consent-gated) | US (Data Privacy Framework) |
| Meta Pixel | Campaign measurement/attribution (consent-gated) | US (Data Privacy Framework) |
DPO contact
For any request regarding your data you may write to the agency’s contact address. You also have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP).
Demonstration environment — fictitious data and entities.
