This policy explains how we process personal data, under Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.
1. Data controller
LAVALI ONLINE SHOP SRL, limited company (SRL), Romania, Tax ID (CUI) 48870445, Trade Register No. J23/6383/2023, registered office: Str. Oituz 80, Popești-Leordeni, județ Ilfov, România. Phone: 0762 777 111. E-mail: contact@romanianguide.com. Operator of RomanianGuide.com (the Site).
2. What we collect and why
- Account (if you create one): display name, e-mail, password (stored hashed). Basis: performance of the account contract – Art. 6(1)(b) GDPR.
- Check-in / passport: places you mark as visited, an optional name and note, the visit time. Basis: consent – Art. 6(1)(a).
- Contact messages: name, e-mail, message. Basis: legitimate interest in replying – Art. 6(1)(f).
- Shop waiting list: e-mail, to notify you when a product is available. Basis: consent.
- Visit statistics: page paths and the referring website. Your IP address is pseudonymised before storage using an irreversible SHA-256 hash combined with a local salt; we store only the hash, alongside a hashed user-agent fingerprint. We cannot reconstruct the original IP from these records. Basis: legitimate interest – Art. 6(1)(f).
- Security data: your real IP address and browser user-agent are recorded, separately from the statistics above, for: login audit (your account), rate-limiting of public forms (contact, check-in, product waiting list), and investigation of abuse. Basis: legitimate interest – Art. 6(1)(f). Retention: kept as long as necessary for the security purpose. We do not currently operate an automatic time-based deletion job for these records; you may request erasure at any time under your GDPR rights (see §5).
- Consent records: when you make a cookie choice in the banner, we store an internal record containing the choices, the policy version, the banner language, and irreversible SHA-256 hashes of your IP and user-agent (with a local salt, separate from the statistics one). We cannot reconstruct the originals from these records. Basis: legitimate interest in being able to demonstrate consent – Art. 7(1) read together with Art. 6(1)(f) GDPR.
- Cookies: see our Cookie Policy.
We do not collect special categories of data and do not perform automated decisions with legal effect. We currently do not process online payments (the shop is catalogue-only for now).
3. Who we share data with
- Our hosting provider (servers in the EU/Romania).
- AI-Cazare.ro — accommodation suggestions reached via a link, and accommodation photos hot-linked from their servers (your browser sends them your IP and user-agent when these images load).
- OpenStreetMap / Nominatim — map tiles and place search; your IP is sent when maps and searches load.
- OSRM (router.project-osrm.org) — route calculation in the trip planner; your IP and the route coordinates are sent on each calculation.
- Overpass API (overpass-api.de) — nearby train station lookup in the trip planner; your IP and the search area are sent on each query.
- Bunny Fonts (fonts.bunny.net) — fonts, hosted in the EU by BunnyWay d.o.o. (Slovenia); no IP logging, no cookies. We no longer use Google Fonts and therefore no longer transfer this data to the USA.
- Public authorities, only where required by law.
We do not sell your data and do not use it for advertising.
4. How long we keep data
Account data – until you delete your account. Contact messages – usually up to 24 months. Technical logs – usually up to 12 months. Check-in data – until you delete it or your account. Consent records – kept for the duration of the policy version they refer to plus a reasonable audit period.
5. Your rights
You have the rights of access, rectification, erasure, restriction, portability, objection, and to withdraw consent (anytime, without affecting prior processing). Exercise them at contact@romanianguide.com; we respond within 30 days. You may complain to the Romanian Data Protection Authority (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest; phone +40.318.059.211; e-mail anspdcp@dataprotection.ro; www.dataprotection.ro.
6. Minors
Our services are not directed to children under 16; we do not knowingly collect their data.
7. Security
We use reasonable technical and organisational measures (HTTPS, hashed passwords, access control, Content Security Policy, anti-clickjacking and anti-MIME-sniff headers, HMAC-signed anti-bot tokens on public forms). No system is 100% secure.
8. Data Protection Officer
We have not appointed a DPO (our processing does not require one). For any data matter: contact@romanianguide.com.
9. Changes
We may update this policy; the current version is always shown here.
Last updated: 25.05.2026.
