BUSINESS ERHOTEL SRL (hereinafter referred to as the “Company” or “we”) processes personal data of natural persons who access the website (hereinafter referred to as the “Website”).
This policy explains in detail what data we collect, why, for how long we keep it and what rights you have.
1. Data Controller
The data controller is:
BUSINESS ERHOTEL SRL, a Romanian company with its registered office in Bucharest, Str. Cpt. Alexandru Șerbănescu no. 27, Hotel Erbas, ground floor, district 1, registered with the Trade Registry under no. J40/16338/2016, sole registration code 36833583.
Contact details of the controller (to be completed):
– Phone: 0314052020
Any request related to data protection should be sent to the e-mail address indicated in Section 11 below.
2. Scope of the Policy
This policy applies to:
– the use of the Website for information purposes;
– the completion and submission of the contact form;
– interactions with cookies and other tracking technologies used on the Website (Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, other Google tracking services).
We do not operate an online booking system on the Website. Requests for information or offers submitted through the contact form do not constitute a firm booking, but only a request that we review and respond to on a case-by-case basis.
The Website is not intended for minors under the age of 16, and we do not knowingly seek to process their data.
3. Processing Principles
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), observing in particular the principles of:
– lawfulness, fairness and transparency;
– purpose limitation;
– data minimisation;
– accuracy;
– storage limitation;
– integrity and confidentiality.
4. Categories of Data Processed
4.1. Data Collected Automatically When Accessing the Website
When you simply visit the Website, our IT systems and third-party analytics/marketing services may automatically collect the following technical data:
– IP address (or a hash / partial form of it, depending on the configuration of the tools);
– date and time of access;
– pages visited, session duration, actions such as clicks, scrolls, form completions;
– information about device and browser (device type, operating system, screen resolution, browser version);
– online identifiers assigned via cookies (session ID, user ID for analytics, remarketing IDs).
This data is collected via:
– server log files;
– strictly necessary cookies for operation;
– analytics/statistical cookies (e.g. Google Analytics);
– marketing cookies and pixels (Meta Pixel, TikTok Pixel, Google Ads etc.).
4.2. Data Provided Directly via the Contact Form
When you complete the contact form, we process the data you provide to us:
– first name;
– last name;
– e-mail address;
– phone number;
– the content of the message you send (free text, any additional information).
Please do not include sensitive data in your message (e.g. medical information, religion, criminal record, national identification number, copies of identity documents, etc.). If you still send us such data, we will delete it when it is not strictly necessary for handling your request.
5. Purposes and Legal Grounds of Processing
We process data for the following purposes, based on the indicated legal grounds:
5.1. Responding to Requests Sent via the Contact Form
– Data: first name, last name, e-mail, phone, message content, technical data related to submission.
– Purpose: analysing the request and providing an answer, including sending an indicative offer or clarifications.
– Legal basis: Article 6(1)(b) GDPR – taking steps at your request prior to entering into a potential contract; and/or Article 6(1)(f) – legitimate interest (managing communication with potential customers).
5.2. Ensuring the Operation and Security of the Website
– Data: server logs (IP, date/time, URL accessed, browser etc.), strictly necessary cookies.
– Purpose: providing the content of the Website, preventing cyber-attacks, detecting errors and abuses.
– Legal basis: Article 6(1)(f) GDPR – legitimate interest (operation and security of the IT infrastructure).
5.3. Traffic Analysis and Statistics (Google Analytics and Similar Tools)
– Data: online identifiers, information about device and browser, pages visited, events (scroll, click, form submission etc.).
– Purpose: understanding how the Website is used, improving the content and structure, measuring the performance of campaigns.
– Legal basis:
– consent (Article 6(1)(a) GDPR) – for analytics cookies if you accept them in the banner;
– legitimate interest (Article 6(1)(f)) – for strictly necessary aggregated and anonymised measurements, where applicable.
5.4. Online Marketing and Remarketing (Meta Pixel, TikTok Pixel, Google Ads etc.)
– Data: cookie/pixel identifiers, pages visited, actions on the Website, technical information about the device.
– Purpose: displaying personalised advertising about the hotel on third-party platforms (Facebook/Instagram, TikTok, Google etc.), measuring conversions and optimising campaigns.
– Legal basis: Article 6(1)(a) GDPR – consent given through the cookie banner. If you do not accept marketing cookies, these tools will not be loaded.
We do not use personal data to make solely automated decisions that produce legal effects or similarly significantly affect you (within the meaning of Article 22 GDPR).
6. Storage Period
We keep data only for as long as necessary for the purposes for which it was collected or as required by law:
– data from the contact form: up to 3 years from the date of the last communication, so that we can prove our correspondence and how the request was handled;
– technical logs and security data: generally up to 3 years, with a possible extension for investigating security incidents;
– data associated with analytics and marketing cookies: according to the lifetimes set by the respective providers or our internal settings, without exceeding the limits provided by applicable law and, in any case, without exceeding 3 years for identifiable data.
After the above periods expire, the data will be deleted or irreversibly anonymised.
7. Cookies and Similar Technologies
The Website uses cookies and similar technologies. Full details (types of cookies, purposes, storage periods and tools used) are provided in the Cookie Policy, available at the dedicated URL on the Website.
For non-essential cookies (analytics, marketing) we rely on your explicit consent through the cookie banner. You can withdraw your consent at any time from the Website’s cookie settings or from your browser.
8. Service Providers and Possible Transfers Outside the EEA
For operating the Website and providing analytics/marketing services we may use specialised providers (for example Google, Meta, TikTok).
Data may be stored on servers located in the European Union or, in some cases, in countries outside the European Economic Area (EEA). In such situations, transfers are made, as far as possible, on the basis of:
– standard contractual clauses approved by the European Commission; and/or
– other adequate safeguards offered by the respective providers, according to their official documentation.
9. Data Security
We implement reasonable technical and organisational measures to protect data against unauthorised access, loss, alteration or unauthorised disclosure, such as:
– limiting access to data only to staff and providers who need it;
– security measures at server and application level;
– periodic updating of software components;
– encrypted communication protocols (HTTPS/SSL), where applicable.
No technical solution is 100% secure, but we make reasonable efforts to maintain an adequate level of security.
10. Your Rights Regarding Personal Data
As a data subject, you have the following rights under the GDPR:
– right of access – to know what data we process about you and how;
– right to rectification – to request the correction of inaccurate data or the completion of incomplete data;
– right to erasure (“right to be forgotten”) – under the conditions of Article 17 GDPR;
– right to restriction of processing – in the cases provided for in Article 18 GDPR;
– right to object – to processing based on legitimate interest or to profiling for direct marketing purposes;
– right to data portability – where processing is based on consent or contract and carried out by automated means;
– right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
– right to lodge a complaint with the supervisory authority.
11. Exercising Your Rights and Complaints
For any request relating to your personal data, you can contact us at:
– E‑mail: HB2N5 RE@ACCOR.COM
– Postal address: BUSINESS ERHOTEL SRL, Str. Cpt. Alexandru Șerbănescu no. 27, Hotel Erbas, ground floor, district 1, Bucharest, Romania.
We will generally respond within one month of receiving the request, with the possibility of extension in accordance with Article 12(3) GDPR.
You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) in Romania.
12. Privacy of Minors
The Website is not directed at persons under the age of 16. We do not knowingly collect data about minors. If we become aware that we have collected such data without the consent of the holder of parental responsibility, we will delete it as soon as possible.
13. Updating the Policy
We may amend this Privacy Policy to reflect legislative changes or changes in our operations.
