Privacy Policy

1. Data Controller

The Fun Enterprise S.r.l.
CUI: RO 39932905
Calea Floreasca 246B, Bucharest, Romania
Email: [email protected]
Phone: +40 722 474 316

2. What Data We Collect

We collect and process the following categories of personal data:

• Booking data: Name, email address, phone number, date of birth, driving licence number.
• Payment data: Payment method, transaction ID. We do not store full credit card numbers — payments are processed by our payment service providers (Stripe, Netopia).
• Communication data: Messages sent via email, WhatsApp, or our contact form.
• Newsletter data: Email address (when you subscribe to our newsletter).
• Website usage data: IP address, browser type, pages visited, cookies. See our Cookie Policy for details.
• Liability disclaimer: Signature, date, and the signed document.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR:

• Contract performance (Art. 6(1)(b)): Processing necessary to fulfil your booking and provide the tour service.
• Legitimate interest (Art. 6(1)(f)): Internal analytics, fraud prevention, and service improvement.
• Consent (Art. 6(1)(a)): Newsletter subscriptions, marketing communications, and non-essential cookies.
• Legal obligation (Art. 6(1)(c)): Tax and accounting records as required by Romanian law.

4. How We Use Your Data

• To process and manage your booking.
• To communicate with you about your tour (confirmations, reminders, follow-ups).
• To process payments securely.
• To send marketing communications if you have opted in (newsletter).
• To improve our website and services.
• To comply with legal and regulatory obligations.

5. Data Sharing

We may share your data with the following categories of recipients:

• Payment processors: Stripe, Netopia (for secure payment processing).
• Cloud services: Supabase, Vercel (hosting and database).
• Booking platforms: GetYourGuide, Viator, Bokun (if you booked through these platforms).
• Communication tools: WhatsApp Business, email service providers.
• Legal authorities: When required by law or court order.

We do not sell your personal data to third parties.

6. Data Retention

• Booking data: Retained for 5 years after the tour date (legal/tax requirements).
• Payment data: Retained for 10 years (Romanian fiscal obligations).
• Newsletter subscriptions: Until you unsubscribe.
• Website analytics: Anonymised after 26 months.

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your data (“right to be forgotten”), subject to legal retention obligations.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: You may withdraw consent at any time (e.g., unsubscribe from newsletter).

To exercise any of these rights, contact us at [email protected].

8. Cookies

Our website uses cookies to ensure functionality, improve your experience, and analyse website traffic. You can manage your cookie preferences at any time through the cookie consent banner. For details, see our Cookie Policy.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. This includes encryption in transit (TLS/SSL), access controls, and regular security reviews.

10. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):
www.dataprotection.ro