Privacy policy

The controller is SC PRIME TRAVEL TRADING SRL, with its registered office at Bd. Camil Ressu nr. 55, bl. N12, et. 6, ap. 27, camera 2, Sector 3, Bucharest, Romania, trade register number J40/1888/2013, tax identification number 31232639, which operates this website under the rotrips brand.

For any question about this policy or about your data, write to office@rotrips.com.

Contact form: name, email address and, if you provide them, phone number, company, travel dates and number of travellers, together with the content of your message. Purpose: answering your enquiry and preparing a quotation. Legal basis: your consent, and the steps taken at your request prior to entering into a contract (Art. 6(1)(a) and 6(1)(b) GDPR).

Your name, email address and message are needed for us to answer you; without them we cannot take up your enquiry. The other fields are optional.

Offers by email: only if you tick this separate option, we use your email address to send you occasional travel offers. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 12 of Romanian Law no. 506/2004). You can unsubscribe at any time by replying to any of these messages or by writing to office@rotrips.com.

Proof of consent: the text you accepted, the version of this policy in force, the date and time, and the IP address from which the form was submitted. Purpose: being able to show that we received your consent. Legal basis: our legitimate interest in meeting the duty to demonstrate consent (Art. 6(1)(f) and Art. 7(1) GDPR).

Protecting the form against abuse: when you submit, Cloudflare Turnstile checks your IP address and technical signals from your browser to tell people from automated programs, and your IP address is used to limit the number of submissions. Legal basis: our legitimate interest in protecting the form and our inbox against spam (Art. 6(1)(f) GDPR).

Analytics: if, and only if, you accept analytics cookies, we record pages viewed, interactions such as clicking a phone number or submitting a form, and technical performance measurements. The contents of form fields are not recorded. Legal basis: your consent (Art. 6(1)(a) GDPR).

We do not collect any data that is not needed for the purposes above. We do not make decisions based solely on automated processing and we do not build profiles.

Website hosting: Vercel Inc., United States, through its network of data centres.

Email: our email hosting provider, with servers in Romania, through which form submissions and the confirmation to you are sent and received.

Spam protection: Cloudflare, Inc., United States, through its Turnstile service, used only on the contact page.

Analytics: PostHog Inc., with the data stored on its EU Cloud infrastructure in Frankfurt, Germany.

These providers process data only on our instructions, under a contract that meets Art. 28 GDPR.

Vercel, Cloudflare and PostHog are companies based in the United States. Where data reaches them or may be accessed from outside the European Economic Area, the transfer relies on the adequacy decision for the EU-US Data Privacy Framework, for certified companies, or on the standard contractual clauses approved by the European Commission (Art. 45 and 46 GDPR).

Enquiries that do not lead to a booking are deleted after 24 months.

Records relating to bookings are kept for the period required by Romanian accounting and tourism legislation.

Your email address for offers is kept until you unsubscribe.

Proof of consent is kept for as long as the consent is relied upon, plus three years.

IP addresses used to limit submissions are held only briefly in server memory and are not stored.

Analytics data is retained in pseudonymised form for 12 months.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, including to processing based on our legitimate interest, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, write to office@rotrips.com. We reply within one month.

You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (www.dataprotection.ro).

The site is served exclusively over HTTPS. Form submissions are checked by Cloudflare Turnstile and limited in number per IP address. Access to enquiry data is restricted to the members of staff who need it to answer you.