Privacy Policy & Cookies

FLOWERSHOUSE EVENTS SRL

Last updated: May 7, 2026

1. About this policy

This Privacy Policy describes how the personal data of visitors and customers of the website flowershousesibiu.ro (hereinafter referred to as the “Website”), operated by FLOWERSHOUSE EVENTS SRL (hereinafter referred to as “we”, “us” or “FLOWERSHOUSE EVENTS SRL”), is collected, used and protected. The Website is an online booking platform for tourist accommodation services.

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (GDPR), Law no. 190/2018 regarding measures for the implementation of the GDPR and Law no. 506/2004 regarding the processing of personal data in the electronic communications sector. For certain processing operations specific to accommodation services, tourism legislation also applies, including MAI Order no. 35/2002, OG 58/1998 regarding the organization and operation of tourism activities and the related implementation rules.

By using the Website or making an accommodation booking, you agree to the practices described in this policy.

2. Who is the data controller

The personal data controller is:

FLOWERSHOUSE EVENTS SRL
Registered office: Str. Justitiei 24 Cod 550004, Romania
CUI: 43598022
Trade Register No.: J2021000088320
EUID: ROONRC.J2021000088320
Email: office@flowershousesibiu.ro
Phone: +40 771 332 088

For any question regarding the processing of your personal data, you can contact us at the email address above.

3. What data we collect and for what purposes

3.1. Processing accommodation bookings

When you make a booking on the Website, we collect the following data:

First name and last name
Email address
Phone number
Booking details: check-in date, check-out date, number of adults/children, selected accommodation type, additional options
Special notes provided by you, for example preferences, food allergies, estimated arrival time
Billing details, if you request a tax invoice or if you are a legal entity: company name, tax identification number, registered office address

Purpose of processing: processing and confirming the booking, communication regarding the booking status, providing the reserved accommodation services, managing changes and cancellations, issuing fiscal documents, including the invoice.

Legal basis: performance of a contract to which the data subject is a party, according to art. 6 para. (1) letter b GDPR, and, for fiscal obligations, the legal obligation of the controller, according to art. 6 para. (1) letter c GDPR.

Storage period: for the duration of the contractual relationship and thereafter according to legal archiving obligations, respectively 5 years for financial-accounting documents and 10 years for certain fiscal documents, according to the Fiscal Code.

3.2. Registration in the accommodation form at check-in

Upon arrival at the accommodation unit, we are legally required to prepare an arrival and departure notification form, also known as an accommodation form, for each hosted tourist. For this purpose, we collect:

First name and last name of all accommodated persons, including minors
Date and place of birth
Citizenship
Personal identification number (CNP), for Romanian citizens
Type, series and number of the identity document: ID card, passport or residence permit
Home address
Arrival date and departure date
Assigned room number

Purpose of processing: fulfilling the legal obligation to keep records of accommodated tourists and reporting to the competent authorities, where required.

Legal basis: the legal obligation of the controller, according to art. 6 para. (1) letter c GDPR, respectively MAI Order no. 35/2002 and related legislation regarding tourism activity. For the CNP, processing is permitted under art. 6 of Law no. 190/2018, being necessary for fulfilling a legal obligation.

Storage period: according to the time limits provided by the legislation in force for records of accommodation activities, generally 5 years.

3.3. Payment processing through Stripe

For online payment processing, we use Stripe, a service provided by Stripe Payments Europe, Limited, One Building, 1 Grand Canal Street Lower, Dublin, D02 H210, Ireland, and its affiliated entities.

When you make an online payment, your card details, such as card number, expiration date and CVV code, are entered directly into Stripe’s secure form and are processed by Stripe as an independent controller. This data is not transmitted to us and is not stored on our servers.

Stripe subsequently provides us with transaction confirmation data, such as payment status, transaction identifier, last 4 digits of the card, amount and currency, in order to reconcile the payment with your booking. In certain cases, for example booking guarantee, payment at check-in or damages, additional card operations may be carried out with your prior authorization.

Purpose of processing: processing the booking payment, authorizing amounts for guarantee/damages where applicable, fraud prevention, compliance with PCI-DSS standards and legal obligations.

Legal basis: performance of the contract, according to art. 6 para. (1) letter b GDPR, and legitimate interest for fraud prevention, according to art. 6 para. (1) letter f GDPR.

Stripe’s Privacy Policy is available here: https://stripe.com/privacy

3.4. Tourist promotion tax / local taxes

Where applicable, we collect the tourist promotion tax or other local taxes established by the local public authority for accommodated tourists. For this purpose, we process tourists’ identity data in order to declare it, in anonymized form or, where applicable, nominally, to the local tax authority.

Legal basis: the legal obligation of the controller, according to art. 6 para. (1) letter c GDPR, according to the Fiscal Code and the applicable local council decisions.

3.5. Meta Pixel / Facebook Pixel

On the Website, we use Meta Pixel, a tracking technology provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, to measure the effectiveness of our advertising campaigns on Meta platforms, namely Facebook and Instagram, and to display relevant ads to users of these platforms.

Meta Pixel collects, with your prior consent expressed through the cookie banner, the following data:

IP address
Browser type and version, device used
Pages visited on the Website and actions performed, for example starting a booking or completing a booking
Cookie identifiers, including _fbp and fr
If you are logged into a Facebook or Instagram account in the same browser, the data may be associated with your Meta account

Purpose of processing: measuring conversions and the results of paid advertising campaigns, remarketing, respectively displaying personalized ads to people who have visited the Website, and creating similar audiences on Meta platforms.

Legal basis: your consent, according to art. 6 para. (1) letter a GDPR, granted through the cookie banner.

Joint controllers: regarding the collection of data through Meta Pixel, FLOWERSHOUSE EVENTS SRL and Meta Platforms Ireland Limited act as joint controllers within the meaning of art. 26 GDPR, according to the Controller Addendum published by Meta. Subsequent processing of data by Meta on its own platforms is carried out under Meta’s sole responsibility.

Storage period: Meta Pixel cookies have a lifetime of up to 90 days, for example _fbp. Aggregated data on Meta’s side is kept according to the platform’s own policies.

Meta may transfer data to the United States of America. More details are included in the section regarding data transfers outside the EU/EEA.

You can manage your Meta advertising preferences here: https://www.facebook.com/ads/preferences/

3.6. Technical browsing data

When accessing the Website, the WordPress platform and the hosting provider automatically collect technical data: IP address, browser type, operating system, pages visited, session duration and traffic source. This data is used for the technical operation of the Website, security and, with your consent, traffic analytics.

Legal basis: legitimate interest for the operation and security of the Website, according to art. 6 para. (1) letter f GDPR, and, for analytics, your consent.

4. Cookies

The Website uses cookies for the proper functioning of the platform, analytics and marketing. The categories of cookies used are:

Strictly necessary cookies – essential for the operation of the Website, for example booking form steps, user session, cookie preferences, technical Stripe cookies for payment processing. These do not require consent.
Performance/analytics cookies – used to understand visitor behavior and improve the Website. These require consent.
Marketing and advertising cookies – Meta Pixel, including _fbp, fr and others, used for remarketing, measuring conversions and displaying relevant ads on Facebook and Instagram. These require consent.

On your first visit, a cookie consent banner is displayed, through which you can accept or reject non-essential cookie categories. You can change your preferences at any time through the “Cookie preferences” button in the Website footer.

You can also configure your browser to block or delete cookies from its settings.

5. To whom we disclose your data

We do not sell or rent your personal data. We work with service providers who process data on our behalf or as independent controllers:

Hosting provider – provides the technical infrastructure on which the Website runs, including the WordPress installation, database and media files. Data is stored on secure servers, in accordance with applicable standards.
Stripe Payments Europe, Limited – online payment processor for bookings and possible guarantees/damages. Stripe acts as an independent controller for the financial data of the transaction. Stripe’s Privacy Policy is available here: https://stripe.com/privacy
Meta Platforms Ireland Limited – provider of the Meta Pixel service. Meta acts as a joint controller for the collection stage and as an independent controller for subsequent processing on Meta platforms. Meta’s Privacy Policy is available here: https://www.facebook.com/policy.php
Competent public authorities – Ministry of Internal Affairs, Romanian Police, tax authorities, ANAF, local tax authorities for the tourist promotion tax, courts, criminal investigation bodies and supervisory authorities, when we are legally required to do so.
IT and maintenance service providers – may access, strictly within the limits of their tasks, data on the Website in order to ensure its operation, security and updating.
Accounting – the accounting service provider may access fiscal documents containing personal data, to the extent necessary for fulfilling accounting and tax obligations.

All partners we work with are contractually required to comply with GDPR standards and ensure data confidentiality.

6. Data transfers outside the EU/EEA

Stripe and Meta process data mainly in the European Union, especially in Ireland, but may also transfer data to the United States of America or other jurisdictions, based on:

Certification under the EU-U.S. Data Privacy Framework, according to the European Commission adequacy decision of July 10, 2023
Standard Contractual Clauses adopted by the European Commission, according to art. 46 para. (2) letter c GDPR, as an additional safeguard

To the extent that other providers, for example hosting or maintenance services, involve transfers outside the EEA, these are carried out only with the appropriate safeguards provided by the GDPR.

7. Your rights

As a data subject, according to the GDPR, you have the following rights:

Right of access, according to art. 15 GDPR – you may request a copy of the data we hold about you.
Right to rectification, according to art. 16 GDPR – you may request the correction of inaccurate or incomplete data.
Right to erasure / right to be forgotten, according to art. 17 GDPR – you may request the deletion of your data, under the conditions provided by law. Please note that certain data must be kept in order to fulfill legal obligations, for example accommodation forms and fiscal documents, and cannot be deleted before the expiry of the legal retention periods.
Right to restriction of processing, according to art. 18 GDPR – you may request that we limit the way we use your data.
Right to data portability, according to art. 20 GDPR – you may receive your data in a structured, commonly used format.
Right to object, according to art. 21 GDPR – you may object to the processing of your data for direct marketing purposes.
Right to withdraw consent – at any time, without affecting the lawfulness of the processing carried out before the withdrawal.
Right to lodge a complaint – with the National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru no. 28-30, Sector 1, Bucharest, tel. +40 318 059 211, email: anspdcp@dataprotection.ro, website: www.dataprotection.ro

To exercise your rights, you can contact us at office@flowershousesibiu.ro. We will respond within a maximum of 30 calendar days from receiving the request.

8. Data security

We apply appropriate technical and organizational measures to protect your data against unauthorized access, loss, modification or unauthorized disclosure. These measures include encryption in transit through HTTPS/TLS, access restricted on a “need-to-know” basis, strengthened authentication, regular security updates of the WordPress platform and the plugins used, periodic backups, PCI-DSS payment processing through Stripe and secure storage of accommodation forms, in physical and/or electronic format, with restricted access.

However, no method of online transmission is 100% secure. In the event of a security incident affecting your data, we will notify you in accordance with our legal GDPR obligations.

9. Minors

Our Website is not directly addressed to persons under the age of 16. The booking is made by an adult, who assumes responsibility for all participants, including minors. For the completion of the accommodation form, the data of all accommodated persons, including minors, is required based on a legal obligation. The data of minors is provided by the holder of parental responsibility and is processed exclusively for this purpose.

10. Changes to this policy

We may periodically update this Privacy Policy to reflect legislative changes, changes in our practices or changes in the services used. The version in force is always published on the Website, with the date of the latest update. Substantial changes will be communicated through a visible notice on the Website.

11. Contact

For any question, request or complaint regarding the processing of your personal data: