Privacy Policy

Last updated: September 2026. This English version is provided for convenience; in case of any discrepancy, the Romanian version prevails.

We respect the privacy of our guests and visitors. This policy explains which personal data we process when you use the hotel-recif.ro website, contact us or book a holiday at Hotel Recif Neptun, why we use it and what rights you have, in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Romanian law.

1. Who we are (the data controller)

Hotel Recif Neptun is operated by AMHOTECH SOFTWARE S.R.L., registered office in Bucharest, Sector 1, Str. Petre S. Aurelian nr. 62, Parcela N, Lot 9, Camera 1, Romania, registered with the Trade Register under no. J2022021395404, VAT no. RO47079907 (“we” or the “Controller”). Hotel Recif is part of the Avenue Hotels group.

Hotel location: Aleea Plopilor, Neptun, Constanța County, Romania.
Data protection contact: recif@avenuehotels.ro · +40 21 555 25 60.

2. What data we process

• Identification and contact data — first and last name, phone number, email address — when you book, ask for an offer or contact us.
• Stay details — dates, number of guests (including children’s ages, for pricing), room type, meal plan, and any preferences or special requests you share with us.
• Payment and invoicing data — the details needed for invoicing; card data is processed directly by the payment processor and is not stored by us.
• Check-in data — the identity document details requested at check-in, as required by Romanian law on guest registration.
• Technical and browsing data — IP address, browser and device type, pages visited, collected through cookies only if you consent (see our Cookie Policy).

3. Why we process data and on what legal basis

• Booking and providing accommodation and meal services — basis: performance of a contract (Art. 6(1)(b) GDPR).
• Replying to offer requests and questions — basis: steps taken at your request before entering into a contract, and our legitimate interest in replying to you.
• Complying with legal obligations — guest registration, invoicing, accounting and tax obligations (Art. 6(1)(c) GDPR).
• Website usage statistics (Google Analytics / Google Tag Manager) — basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Advertising and remarketing (Meta Pixel, Google Ads) — basis: your consent.
• Marketing communications (offers, news) — only with your express consent; you can unsubscribe at any time.
• Website security and fraud prevention — basis: our legitimate interest.

4. Who we share data with

We do not sell or rent your data. We only share it with partners who help us provide our services, under contracts that require confidentiality and security (processors), or when the law requires it:

• the online booking engine provider (4booking / Multisoft) and its payment processor;
• the offer request platform provider (MiniCRM);
• web hosting, email and website maintenance providers;
• the weather data provider (the Norwegian Meteorological Institute – MET Norway): to show the weather in Neptun, your browser requests the data directly from api.met.no, which therefore receives your IP address; we do not send it any other data;
• Google (Google Analytics, Google Tag Manager, Google Ads) and Meta Platforms (Meta Pixel), only if you have consented to statistics or marketing cookies;
• issuers of holiday vouchers/cards, if you pay with them;
• public authorities, when the law requires it.

If you message us on WhatsApp or Facebook Messenger, the conversation is also processed by Meta Platforms, under its own privacy policies.

5. Transfers outside the European Economic Area

Some providers (for example Google and Meta) may process data outside the EEA, including in the USA. In these cases, transfers rely on the safeguards provided by the GDPR, such as the European Commission’s adequacy decision on the EU-US Data Privacy Framework or standard contractual clauses.

6. How long we keep data

• bookings, invoices and accounting documents — for the period required by tax and accounting law;
• guest registration data — for the period required by applicable law;
• offer requests and correspondence — as long as needed to reply to you and, afterwards, no more than 2 years from the last interaction if you do not become a guest;
• marketing communication data — until you withdraw consent or unsubscribe;
• cookies — according to the durations in our Cookie Policy.

7. Your rights

As a data subject, you have the following rights:

• right of access — to find out whether we process data about you and to receive a copy;
• right to rectification — to have inaccurate or incomplete data corrected;
• right to erasure (“right to be forgotten”), under the conditions set by law;
• right to restriction of processing, under the conditions set by law;
• right to data portability — to receive your data in a structured format or have it sent to another controller, where technically possible;
• right to object — including, at any time, to processing for direct marketing;
• right to withdraw consent at any time, without affecting the lawfulness of earlier processing — for cookies, via Cookie settings;
• right to lodge a complaint with the supervisory authority.

To exercise your rights, write to us at recif@avenuehotels.ro or send a written request to the Controller’s registered office. We will reply within one month of receiving your request; this period may be extended under the conditions set by the GDPR.

8. Supervisory authority

If you believe your rights have been infringed, you can contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral Gheorghe Magheru nr. 28–30, Sector 1, Bucharest, postcode 010336, Romania · email: anspdcp@dataprotection.ro · www.dataprotection.ro. You may also contact the data protection authority in your EU country of residence.

9. Data security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or destruction — including a secure connection (HTTPS) and access to data limited to the people who need it to do their job.

10. Minors

Bookings are made by adults. Children’s data (for example their age, needed for pricing) is provided by parents or legal guardians, solely for the purpose of providing the services.

11. Changes to this policy

We may update this policy when our services or the law change. The current version is always available on this page, with the date of the last update.