Book now

Personal Data Protection Policy (GDPR)

1. General Information

This policy explains in plain language what happens with the details you share via our contact and booking forms and with the usage data collected when you browse this website, in line with the General Data Protection Regulation (GDPR).

2. Data Controller

The organisation responsible for your personal data is:
Zibran Cabane SRL,
which owns this website and decides why and how the data is used.

3. Data Processor

Specornio Eddernott Technologies SRL supports our website, booking and email systems and only handles data so that we can answer messages and manage bookings, following documented instructions from Zibran Cabane SRL.
Our cloud hosting provider hosts the website, the booking system and the delivery of our emails. Booking data and its backup copy are stored in the European Union.
With your consent for analytics cookies, the following providers also process usage data on our behalf:
  • • Google Ireland Limited — Google Analytics 4 and Google Tag Manager;
  • • Microsoft Ireland Operations Limited — Microsoft Clarity (heatmaps and session recordings).

4. Collected Data

When you contact us we collect only the following details:
  • • Name
  • • Email address
  • • Phone number
  • • Message content provided by the user
When you book a stay we also collect:
  • • the cabin, the check-in and check-out dates, the number of guests and the price of the stay;
  • • your name, email address, phone number, city and country;
  • • any notes you add to the booking;
  • • the language you booked in, and the date and time of your booking and of your acceptance of the booking conditions.
  • • your IP address, used by Cloudflare Turnstile and by our daily booking limits.
This website does not request or store sensitive data as described in Article 9 GDPR.
If you accept analytics cookies, we also collect technical and usage data:
  • • IP address and the approximate location derived from it;
  • • device, browser, and operating system information;
  • • pages visited, referring site, and time spent on the site;
  • • interactions such as clicks, scrolling, and mouse movement, recorded as heatmaps and session replays by Microsoft Clarity.

5. Purpose of Processing

We use your personal data only for the purposes below:
  • • handling and responding to inquiries submitted via the contact form;
  • • managing your booking: reserving the cabin for your dates, sending you a confirmation with a private link to your booking, and informing our team so they can prepare your stay;
  • • keeping the record of your booking after the stay, so that we can answer questions, complaints or legal claims about it;
  • • protecting the booking form and our systems against bots and abuse;
  • • communicating with users regarding accommodation, reservations, or related services;
  • • responding to requests or questions voluntarily submitted by users.
  • • measuring how the website is used, so that we can improve its content and performance (only with your consent).
Personal data is never used for marketing without clear consent and is never sold or given to other companies for commercial use.

6. Legal Basis for Processing

Processing relies on the following legal grounds:
  • • Article 6(1)(a) GDPR - your consent, expressed when you submit the contact form;
  • • Article 6(1)(b) GDPR - concluding and performing the contract for your stay: the details in the booking form are needed to reserve the cabin and host you, and without them we cannot accept the booking;
  • • Article 6(1)(a) GDPR - your consent for analytics and tracking cookies, which you can give or withdraw at any time from the cookie settings;
  • • Article 6(1)(f) GDPR - our legitimate interest in protecting the website against bots and abuse (Cloudflare Turnstile, daily booking limits, technical logs) and in being able to answer questions, complaints or legal claims about a stay, for which we keep the booking for 3 years after check-out.

7. Processing and Storage Method

Messages travel through encrypted connections and are stored on secure servers located in the European Union so that we can read and respond to them safely. The simplified flow is:
  • • contact form submission on this website;
  • • automatic delivery to our private inbox;
  • • internal tracking in a restricted workspace;
  • • reply sent back to you by email.
Bookings follow a similar path:
  • • the booking form on this website;
  • • storage in our booking database, hosted in the European Union;
  • • emails to you about your booking (the confirmation, the deposit and a reminder a week before arrival) and a notification email to our team;
  • • management in our administration calendar, which only authorised team members can open, after signing in with a one-time code sent by email.
Access to personal data is strictly limited to authorised team members and essential technical partners bound by confidentiality duties.
Analytics providers may process usage data outside the European Union, in particular in the United States. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework and on standard contractual clauses where required.

8. Data Retention Period

We keep your data only as long as needed to answer you, manage a booking, or comply with legal obligations.
In particular:
  • • confirmed bookings are kept for 3 years after check-out, so that we can answer questions, complaints or legal claims about the stay, and are then deleted automatically;
  • • cancelled bookings are kept for 28 days after the cancellation, so that a cancellation made by mistake can be undone, and are then deleted automatically;
  • • cancelled bookings whose deposit was kept (late cancellation or no-show) are kept like confirmed bookings, for 3 years after check-out, as the record of an amount received, and are then deleted automatically;
  • • messages from the contact form are only delivered to our inbox by email and are not kept anywhere else; a message that cannot be delivered is kept for at most 7 days, so that we can fix the problem;
  • • to prevent abuse, the IP address, email address and phone number used for each booking are counted for 2 days, stored only in hashed form;
  • • our servers keep technical logs for 2 months; they contain no names, email addresses, phone numbers or messages of our guests.
Deleted data also disappears from our backups within 35 days.
The private link to your booking, sent in the confirmation email, stops working 90 days after check-out.
Cookies set by this website, including your cookie choice, expire after 6 months.

9. Data Subject Rights

Under the GDPR you can exercise the rights below at any time:
  • • right of access to personal data;
  • • right to rectification;
  • • right to erasure ("right to be forgotten");
  • • right to restriction of processing;
  • • right to object to processing;
  • • right to data portability;
  • • right to withdraw consent at any time;
  • • right to lodge a complaint with the competent data protection authority.
To exercise these rights, please contact us through the details listed on this website and we will respond promptly.

10. Data Security

We use organisational rules, access controls, and regular security reviews to protect personal data against unauthorised access, loss, destruction, alteration, or accidental disclosure.
The details you enter in our contact and booking forms travel only over encrypted connections (HTTPS), and everything we store from them, including bookings, their backups and messages waiting to be sent, is encrypted at rest.
Your confirmation email contains a private link to your booking details. Anyone who has this link can view them, so please do not share it.

11. Cookies, Analytics and Tracking

This website uses three categories of cookies. Only the first is active by default:
  • • Functional — remembers your language preference, and includes Cloudflare Turnstile on the booking form. Always active, as the site cannot work correctly without them.
  • • Analytics — Google Analytics 4 and Microsoft Clarity. Loaded only after you accept them.
  • • Tags — Google Tag Manager, used to manage the scripts above. Loaded only after you accept them.
Analytics and tag cookies stay disabled until you consent. You can change or withdraw your choice at any time using the cookie icon in the corner of every page.

12. Policy Updates

We may update this notice whenever our practices change, and the latest version will always be published here.
Last updated: October 2026.