Privacy information

1. Controller and contact

The controller for Les Garçons direct bookings is Adrian Vasile Pop, a natural person, at Str. Sg. Alexandru Cutieru no. 25A, building C1, staircase 2, sector 6, Bucharest, Romania. Contact adrianvasilepop20@gmail.com or +40 745 383 682, including to exercise your data protection rights.

This notice covers the direct booking website, requests, payments and related communications. Additional arrival/check-in formalities are explained separately before the relevant data is collected.

2. Data and its sources

We process your name, email address, chosen language, property, dates, guest count, price, request status, messages, amendment/cancellation requests and accepted terms. To verify payment, we use the amount, transfer reference and information needed to identify the payer in bank records; refunds may require the beneficiary's name and IBAN. The form does not request card details, CVV, bank passwords, national identification numbers or identity document copies.

Technical data includes session identifiers, IP addresses and web request information. The application's abuse limiter uses an identifier derived from the IP address; this is not treated as anonymous. The infrastructure provider may separately log the IP address and access metadata.

Data comes from you, use of the platform, correspondence and bank transfer records. Share only necessary information about other people and give them this notice. Keep your request's private link confidential: it provides access to the request and conversation.

3. Purposes and legal bases

Answering requests, checking availability and payment, managing bookings and necessary communications rely on steps you request before a contract and performance of the contract: GDPR Article 6(1)(b).

Records required by applicable tax, accounting or other legislation rely on a legal obligation: Article 6(1)(c). This does not justify retaining conversations indefinitely.

Security, abuse prevention and protecting legal rights rely on our legitimate interests in protecting the service, guests and property and resolving complaints: Article 6(1)(f). We limit processing to what is necessary and assess its impact on your rights.

Your name, email address and stay details are necessary; without them we cannot manage the request. Other information is optional unless needed for a specific request. Accepting the contractual terms and acknowledging this notice do not constitute general consent to processing. We do not use booking data for newsletters or advertising.

4. Evidence for cancellation exceptions

For exceptions involving hospitalisation, a death in the close family or official events, we examine only necessary evidence. We prefer public announcements and supporting information that does not reveal sensitive data.

Do not send medical records, diagnoses or other people's health information through the platform, Gmail or Telegram. Contact us by telephone first with the booking reference and affected dates; we do not record the call. We arrange a separate review of minimal evidence, presented in person or on paper. Remove national identification numbers, document numbers, diagnoses, treatments and irrelevant information. Even confirmation of hospitalisation without a diagnosis is health data.

Before review, you receive separate information about the purpose, access and retention. For health data provided voluntarily, we request separate explicit consent under GDPR Articles 6(1)(a) and 9(2)(a). You may withdraw it using the contact above without affecting earlier lawful processing. We consider available alternative evidence and explain the implications for verification; withdrawal does not automatically reject the request if it can be substantiated another way.

Your consent does not replace another adult's consent; we verify legal authority where someone acts as a representative. Evidence and consent records are handled separately with restricted access. The platform records the commercial decision and financial outcome without the medical reason or details.

5. Recipients and transfers

Access is limited to the host and people authorised for necessary duties. Railway Corporation, United States, hosts the application, database and backups. The host also keeps encrypted copies with restricted access. Railway's documentation describes processing including in the United States, and the EU–US Data Privacy Framework and Standard Contractual Clauses for applicable transfers: https://railway.com/legal/dpa and https://railway.com/legal/privacy.

Resend, a service of Plus Five Five, Inc., United States, sends access emails and notifications about your request. It receives the recipient address, request reference, email text, a temporary private link when needed and delivery metadata. We do not send conversation content, bank details or medical evidence. Resend processes message content as a processor under the data processing agreement incorporated into its service terms. The selected sending region is Ireland, but this does not limit all processing to the EEA; Resend states that its primary processing operations are in the United States and provides Standard Contractual Clauses for relevant transfers. Details and safeguards: https://resend.com/legal/dpa; subprocessor list: https://resend.com/legal/subprocessors.

Telegram Messenger Inc. delivers alerts to the host containing the event type, reference, property, dates and protected administration link. We do not include the guest's name, email, message content or evidence. You do not need a Telegram account. Telegram's policy describes its processing as a controller and transfers to group companies in the British Virgin Islands and Dubai, with Standard Contractual Clauses stated by the provider: https://telegram.org/privacy.

Correspondence sent to our Gmail address is processed through Google. For EEA consumer services, Google generally identifies Google Ireland Limited as the responsible entity, subject to the service terms. Google describes global infrastructure, including in the United States, and reliance on adequacy decisions, the Data Privacy Framework for certified entities and Standard Contractual Clauses, as applicable: https://policies.google.com/privacy and https://policies.google.com/privacy/frameworks.

Banks process transfers under their own obligations. Advisers and authorities receive only necessary data with a lawful basis. We do not sell personal data. Importing Airbnb/Hospitable availability calendars does not itself send your direct booking data to those platforms.

Contact us for information about relevant transfers and how to obtain copies of applicable safeguards. Data may be processed outside the European Economic Area, in the countries described above.

6. Retention

We apply the following periods through automated operations where available and manual procedures, with monthly compliance checks:

• Closed requests without a booking or payment: 90 days after closure. • Routine organisational conversations without contractual or evidential relevance: up to 12 months after the stay or booking closure. • Essential contract, terms, payment and cancellation data: normally 3 years after the stay or resolution of the cancellation, to protect legal rights. We do not automatically retain the entire conversation for this purpose. • Tax/accounting documents: the statutory period applicable to the document and the form of activity, assessed separately. • Exception evidence: until the decision and any approved refund are completed, then removal within 30 days. We separately retain the necessary decision and financial outcome without medical details. • Emails and sending logs at Resend: the published standard retention for the Free plan is 30 days. Private access links expire after 20 minutes and are single-use; the application removes the encrypted body after the sending attempt or expiry. Local delivery records follow the retention period of the associated request. Emails received in your mailbox are managed by you and your email provider. • Telegram alerts for direct bookings: manually removed within 30 days of sending. • Abuse limiter records: 2 days; calendar synchronisation logs: 90 days. Railway states that infrastructure logs, including HTTP metadata and IP addresses, are stored for 90 days on US infrastructure. Provider information: https://station.railway.com/questions/log-retention-and-data-processing-agreem-223bf7c1.

A specific complaint, investigation or proceeding may require retention of strictly relevant information until its conclusion and the expiry of applicable legal periods. We record the reason, restrict access and reassess necessity; health information also requires a valid condition under GDPR Article 9.

Encrypted automated backups have a 35-day rotation window: older copies are removed after a new copy is verified. Encrypted local copies follow the same period through manual management. Deleted data may temporarily remain in backups without routine use; after restoration, we reapply established deletions and restrictions. Separately managed emails and documents follow the period applicable to their purpose and are included in the procedure.

7. Cookies and automation

We use cookies necessary for sessions and form security: the session duration is configured at 14 days and the CSRF security cookie at up to one year. Blocking them may affect the form and private access. We do not use behavioural advertising cookies or marketing tracking tools. We disable email open and click tracking in the sending service. Optional notifications can be turned off in your private request page; this does not prevent you from requesting a new access link.

Availability, deadline and abuse checks may be automated. The host verifies receipt of payment and booking confirmation. We do not use profiling or solely automated decisions producing legal or similarly significant effects on you.

8. Rights and updates

Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests for reasons relating to your situation. You may withdraw consent where it is the legal basis. Erasure is not absolute, for example where a legal obligation or the protection of a legal claim requires retention.

Write to adrianvasilepop20@gmail.com. We verify identity using only proportionate information. We normally respond free of charge within one month; where complexity or the number of requests permits a legal extension, this is up to two additional months, with reasons communicated during the first month.

You may complain to Romania's data protection authority, ANSPDCP: https://www.dataprotection.ro, anspdcp@dataprotection.ro, B-dul G-ral. Gheorghe Magheru 28–30, sector 1, Bucharest, and seek a remedy before the competent courts.

We update this notice and its version date when processing changes. An update does not retrospectively authorise new uses; we provide information and obtain consent, where necessary, before those uses begin.

9. Optional statistics and request attribution

Only if you choose “Accept statistics”, we measure property-page use, availability searches, quote outcomes and technical errors to improve the site and understand which channels bring requests. The legal basis is consent under GDPR Article 6(1)(a) and, for access to browser information that is not strictly necessary, Article 4(5) of Romanian Law 506/2004. Consent is not a booking condition, does not change your price and does not authorise marketing or Google Maps. Continuing to browse is not acceptance.

After consent, your browser reduces the page source to a category such as Google, Bing, AI assistant, Instagram, Facebook, email or unidentified. Our own counters receive only the event type, property, language, source category and a random code to deduplicate that event. They do not receive your name, email, stay dates, booking reference, messages, full URL, search terms or browsing history. We use no advertising pixels and do not send these counters to Google Analytics, Meta or AI services. Railway infrastructure technically processes requests as described in section 5; abuse prevention separately uses the IP-derived value described above.

If you send a request while consent is active, we keep the source category alongside your request to count approvals, verified payments and confirmations by channel. This link is personal data; we do not describe it as anonymous. We do not use the source for decisions about you, availability or pricing. Operational indicators needed to manage requests continue to use booking records regardless of your statistics choice.

The first-party cookie lg_measurement_choice remembers your choice for up to 90 days. Acceptance includes a consent-receipt reference; refusal stores only the choice and version. It is signed, HttpOnly, SameSite=Lax and Secure in production. It is not used as a visitor identifier in counters or for cross-site tracking. Session and CSRF cookies remain separate and strictly support platform functionality and security.

We retain aggregate counters for 13 months, event deduplication codes for 30 days, and the source–request link no longer than the 90-day consent period, or until earlier withdrawal or erasure. Minimal consent proof contains a random reference, notice version, acceptance and expiry times and any withdrawal time, without IP, browser agent or event history; it is retained for up to 180 days from consent. This proof is needed to demonstrate consent under GDPR Articles 5(2) and 7(1). Withdrawal intents awaiting technical reconciliation remain until that reconciliation completes. A separate encrypted withdrawal ledger retains only the random reference and operation time to prevent data from returning through backups; its necessity is reviewed together with the existence of recoverable copies under our erasure procedure.

You can refuse or withdraw at any time through “Privacy preferences”: https://rezerv.lesgarcons.ro/preferinte-confidentialitate/?lang=en . Withdrawal stops future collection and removes source–request links associated with this browser’s consent; it does not change your booking or affect the lawfulness of earlier processing. Already aggregated counters have no link to a consent receipt or request and do not keep an individual record from which we can reliably extract your contribution. If you used another browser/device or deleted the cookie, contact us with your booking reference to remove its source information; you do not need to cancel your stay request. We honour Do Not Track and Global Privacy Control signals by disabling optional collection. Refusal, missing or expired consent and verification errors do not prevent booking.

10. Optional Google map

The map is not loaded before you choose “Show Google map”. Activation connects your browser to Google, which receives technical data such as your IP and may use cookies under its own policies. You may close the map at any time; closing it does not remove cookies already set by Google. The map choice is not saved across pages and does not activate our statistics. External Google Maps links connect your browser to Google when opened. You can book without the map. Google policy: https://policies.google.com/privacy .

11. Sources declared in earlier requests

The simplified form no longer asks how you found Les Garçons. If you previously provided that information, we retain only the category for source analysis, without marketing subscription or effects on booking or price. You can request removal using the contact in section 1; the answer is also removed when operational data is cleared under retention procedures. This historical answer is not treated as consent to the optional statistics described in section 9.