PRIVACY POLICY REGARDING THE PROCESSING OF PERSONAL DATA

NATURE EXPERIENCE SRL, the operator and administrator of Oxygen Resort, considers the protection of personal data a fundamental commitment to its customers, partners, and visitors. Therefore, we make every effort to process your personal data in accordance with Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data (“GDPR”), as well as with the applicable Romanian legislation.

This Privacy Policy explains how we collect, use, store, transfer, and protect your personal data when you use our website, make reservations, benefit from our accommodation, restaurant, or leisure services, or communicate with us through any available channel.

1. WHO WE ARE AND HOW TO CONTACT US

The personal data operator is:
NATURE EXPERIENCE SRL
VAT Number: RO41088540
Trade Registry No.: J19/407/2019
Registered office: Str. Millennium no. 14, Postal Code 537250, Remetea Village, Harghita County, Romania
Commercial name: Oxygen Resort

For any questions regarding personal data protection, you can contact us at:

• Email: nature.experience2021@gmail.com

By mail or courier to:
NATURE EXPERIENCE SRL
Str. Millennium no. 14
Postal Code 537250
Remetea Village
Harghita County
Romania
With the note: “To the attention of the Data Protection Officer”.

2. WHAT CATEGORIES OF PERSONAL DATA WE PROCESS

Depending on the services used, we may collect and process the following categories of data:

• Name and surname;
• Email address;
• Phone number;
• Home or billing address;
• Data necessary for issuing invoices;
• Data regarding reservations made;
• Data regarding stays and services purchased;
• Data regarding payments made;
• Correspondence held with us;
• Technical data collected through the website (IP address, browser, device used);
• Images captured by video surveillance systems installed in public areas of the resort;
• Other information voluntarily provided by you.

We do not intentionally collect data belonging to minors and do not process special categories of personal data except in cases expressly provided by law or when necessary to provide the requested services.

3. PURPOSES AND LEGAL GROUNDS FOR PROCESSING

Your data may be processed for the following purposes:

• a) Provision of Oxygen Resort services
  - Managing reservations;
  - Confirming and administering stays;
  - Issuing fiscal documents;
  - Receiving and processing payments;
  - Providing accommodation, restaurant, and leisure services;
  - Communicating with customers before, during, and after their stay.
  Legal ground: Performance of the contract between you and NATURE EXPERIENCE SRL.
• b) Compliance with legal obligations
  - Fiscal and accounting obligations;
  - Tourist records in accordance with applicable legislation;
  - Obligations imposed by competent authorities.
  Legal ground: Fulfillment of a legal obligation.
• c) Improvement of services
  - Analyzing customer feedback;
  - Improving user experience;
  - Developing services and facilities offered.
  Legal ground: The company’s legitimate interest.
• d) Marketing and commercial communications
  With your consent, we may send information about offers, promotions, events, and services available at Oxygen Resort.
  Legal ground: The data subject’s consent.
  You may withdraw your consent at any time.

4. HOW LONG WE KEEP THE DATA

Personal data is kept only for the period necessary to fulfill the purposes for which it was collected and in accordance with applicable legal obligations.
Financial-accounting documents will be kept according to the periods provided by Romanian fiscal and accounting legislation.

5. TO WHOM WE DISCLOSE YOUR DATA

Data may be disclosed, as appropriate, to:

• IT service providers;
• Reservation service providers;
• Payment service providers;
• Accounting and auditing firms;
• Competent public authorities;
• Other contractual partners when this is necessary for the provision of the requested services.

We do not sell or disclose your data to third parties for commercial purposes.

6. DATA SECURITY

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or accidental disclosure.

7. YOUR RIGHTS

According to the GDPR, you have the following rights:

• Right of access;
• Right to rectification;
• Right to erasure;
• Right to restriction of processing;
• Right to data portability;
• Right to object;
• Right to withdraw consent;
• Right to lodge a complaint with the competent authority.

8. SUPERVISORY AUTHORITY

National Supervisory Authority for Personal Data Processing
Bd. General Gheorghe Magheru no. 28-30
Sector 1, Bucharest
Romania
Website: www.dataprotection.ro

9. CHANGES TO THE PRIVACY POLICY

We reserve the right to periodically amend this Privacy Policy to reflect legislative or operational changes. The updated version will be published on the Oxygen Resort website and will take effect from the date of publication.