Privacy policy
Version 1.0 · effective from 4 November 2026 · Transylvania on Horseback
1. Who is responsible for your data
VISCRI FARM SRL (data controller), Viscri no. 81, Bunești, Brașov County, Romania · J8/885/2017 · VAT RO37409110 · brand Transylvania on Horseback.
For any question about your data or to exercise your rights: contact@transylvaniaonhorseback.ro (subject “Personal data”). We reply within one month.
2. What we collect and why
| When | Data | Why | Legal basis (GDPR) |
|---|---|---|---|
| Information request | name, e-mail, country, language, your message | to answer you | art. 6(1)(b): steps at your request before a contract |
| Booking request | contact details (name, e-mail, phone, country); for each rider: name, age, height, weight, riding experience; dates, preferences, rooms, diet | to make a suitable offer and choose a safe horse and route | art. 6(1)(b) |
| Health information (optional: injuries, allergies, conditions) | only what you tell us | safety on the trail | art. 9(2)(a): explicit consent, via a separate tick box |
| Booking and payment | billing details, payment history (cards are processed by Stripe, not by us), acceptance of the terms (date, time, IP, version) | performing the contract, invoicing, proof of acceptance | art. 6(1)(b), 6(1)(c) tax and accounting duties, 6(1)(f) proof in case of dispute |
| Newsletter | e-mail, name, country, language | offers, group departures, news | consent (art. 6(1)(a)) or, for our customers, legitimate interest in similar services, with unsubscribe at any time |
| Trail photos and videos | your image | to send them to you; to publish them only with your consent | sending: art. 6(1)(b); publishing: consent |
| Browsing our website | IP address (to pick the language automatically, not stored), strictly necessary cookies | running the website | art. 6(1)(f) legitimate interest |
| Statistics and marketing on the website (only if you accept) | analytics cookies | to understand which pages help | consent, via the cookie banner |
We make no automated decisions with legal effects. The booking form gives an indicative check of whether the declared level matches the ride; a person always takes the final decision.
3. Who we share data with
Only what is needed for the services booked:
- Partners providing the services: guesthouses and restaurants on the route (names, number of people, diet), and guides (riding level and health information relevant to safety).
- Stripe (online payments), Ireland/USA.
- Brevo (newsletter and e-mails), France, EU.
- Our website and e-mail hosting provider.
- Our accountant and public authorities where the law requires.
We never sell or rent your data. Some providers (for example Stripe) may transfer data outside the EU under the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
4. How long we keep data
| Data | Retention |
|---|---|
| Requests that do not become bookings | 2 years after the last message |
| Bookings, contracts, proof of acceptance of the terms | 5 years after the ride |
| Invoices and accounting records | 5 years, as required by Romanian accounting law |
| Health information | deleted 30 days after the ride |
| Newsletter | until you unsubscribe; we then keep only your address on a suppression list so we never write again |
| Published photos | until you withdraw consent |
5. Your rights
You may request access, rectification, erasure, restriction and portability of your data. You may object at any time, free of charge, to processing based on legitimate interest, including marketing. You may withdraw consent at any time (newsletter, health information, photos), without affecting earlier processing.
Write to contact@transylvaniaonhorseback.ro. You may also complain to the Romanian supervisory authority ANSPDCP (www.dataprotection.ro) or to the authority in your country (for example the ICO in the UK, the CNIL in France, or your Land authority in Germany).
6. Newsletter
- We only send the newsletter if you subscribed or if you have been our customer; in the latter case only about similar rides.
- Every e-mail has a one-click unsubscribe link.
- Subscriptions on our website are confirmed by e-mail (double opt-in).
7. Cookies
- Strictly necessary (no consent needed): chosen language, form session, security.
- Statistics and marketing (only with consent): switched on only if you accept them in the cookie banner. You can change your choice at any time through “Cookie settings” in the website footer.
- The full list of cookies and their duration is shown in the cookie banner.
8. Security
Our website uses an encrypted connection (HTTPS). Card details never pass through our server. Only the team members who handle requests and bookings can access them.
9. Changes
When we change this policy we publish the new version here with its effective date, and inform customers and subscribers by e-mail of important changes.