Personal Data Protection Policy (GDPR)

1. General Information

This policy explains in plain language what happens with the details you share via our contact form and with the usage data collected when you browse this website, in line with the General Data Protection Regulation (GDPR).

2. Data Controller

The organisation responsible for your personal data is:
Zibran Cabane SRL,
which owns this website and decides why and how the data is used.

3. Data Processor

Specornio Eddernott Technologies SRL supports our website and email systems and only handles data so that we can answer messages, following documented instructions from Zibran Cabane SRL.
With your consent for analytics cookies, the following providers also process usage data on our behalf:
  • • Google Ireland Limited — Google Analytics 4 and Google Tag Manager;
  • • Microsoft Ireland Operations Limited — Microsoft Clarity (heatmaps and session recordings).

4. Collected Data

When you contact us we collect only the following details:
  • • Name
  • • Email address
  • • Phone number
  • • Message content provided by the user
This website does not request or store sensitive data as described in Article 9 GDPR.
If you accept analytics cookies, we also collect technical and usage data:
  • • IP address and the approximate location derived from it;
  • • device, browser, and operating system information;
  • • pages visited, referring site, and time spent on the site;
  • • interactions such as clicks, scrolling, and mouse movement, recorded as heatmaps and session replays by Microsoft Clarity.

5. Purpose of Processing

We use your personal data only for the purposes below:
  • • handling and responding to inquiries submitted via the contact form;
  • • communicating with users regarding accommodation, reservations, or related services;
  • • responding to requests or questions voluntarily submitted by users.
  • • measuring how the website is used, so that we can improve its content and performance (only with your consent).
Personal data is never used for marketing without clear consent and is never sold or given to other companies for commercial use.

6. Legal Basis for Processing

Processing relies on two legal grounds:
  • • Article 6(1)(a) GDPR - your consent, expressed when you submit the form;
  • • Article 6(1)(b) GDPR - steps we take to prepare a booking or service you have requested.
  • • Article 6(1)(a) GDPR - your consent for analytics and tracking cookies, which you can give or withdraw at any time from the cookie settings.

7. Processing and Storage Method

Messages travel through encrypted connections and are stored on secure servers located in the European Union so that we can read and respond to them safely. The simplified flow is:
  • • contact form submission on this website;
  • • automatic delivery to our private inbox;
  • • internal tracking in a restricted workspace;
  • • reply sent back to you by email.
Access to personal data is strictly limited to authorised team members and essential technical partners bound by confidentiality duties.
Analytics providers may process usage data outside the European Union, in particular in the United States. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework and on standard contractual clauses where required.

8. Data Retention Period

We keep your data only as long as needed to answer you, manage a booking, or comply with legal obligations.
Cookies set by this website, including your cookie choice, expire after 6 months.

9. Data Subject Rights

Under the GDPR you can exercise the rights below at any time:
  • • right of access to personal data;
  • • right to rectification;
  • • right to erasure ("right to be forgotten");
  • • right to restriction of processing;
  • • right to object to processing;
  • • right to data portability;
  • • right to withdraw consent at any time;
  • • right to lodge a complaint with the competent data protection authority.
To exercise these rights, please contact us through the details listed on this website and we will respond promptly.

10. Data Security

We use organisational rules, access controls, and regular security reviews to protect personal data against unauthorised access, loss, destruction, alteration, or accidental disclosure.

11. Cookies, Analytics and Tracking

This website uses three categories of cookies. Only the first is active by default:
  • • Functional — remembers your language preference. Always active, as the site cannot work correctly without it.
  • • Analytics — Google Analytics 4 and Microsoft Clarity. Loaded only after you accept them.
  • • Tags — Google Tag Manager, used to manage the scripts above. Loaded only after you accept them.
Analytics and tag cookies stay disabled until you consent. You can change or withdraw your choice at any time using the cookie icon in the corner of every page.

12. Policy Updates

We may update this notice whenever our practices change, and the latest version will always be published here.