PRIVACY POLICY

Last updated: 3 June 2026

1. Data controller

The controller of your personal data is:

2. Definitions

• Personal data – any information relating to an identified or identifiable natural person (for example: name, e-mail, phone number);
• Processing – any operation performed on data (collection, recording, storage, use, erasure, etc.);
• Data subject – the natural person whose data is processed;
• Controller – SUN MULTI SERVICES S.R.L., which determines the purposes and means of processing.

3. What data we collect

Depending on how you interact with us, we may process the following categories of data:

• Identification and contact data – first name, last name, e-mail address, phone number, submitted through the contact form or when you request information or a reservation;
• Content of messages – the information you choose to provide to us in your request;
• Technical and browsing data – IP address, browser and device type, pages visited, collected through cookies (see the Cookie Policy);
• Data collected on-site – if you become a guest of the complex, certain data may be collected directly at the reception desk, based on the legal obligations applicable to tourist accommodation structures.

4. Purposes and legal bases of processing

4.1. Handling requests and reservation enquiries

We process contact data in order to respond to your messages and to handle requests for information or reservations. Legal basis: pre-contractual steps taken at your request, as well as our legitimate interest in responding to enquiries (Art. 6(1)(b) and (f) GDPR).

4.2. Operation and improvement of the website

We process technical and browsing data to ensure the operation of the website and to improve it. Legal basis: legitimate interest and, in the case of non-essential cookies, your consent (Art. 6(1)(f) and (a) GDPR).

4.3. Compliance with legal obligations

When you become a guest of the complex, we may process certain data in order to comply with the legal obligations applicable to tourist accommodation structures and with fiscal and accounting obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

4.4. Marketing communications (optional)

If you give your express consent, we may send you information about offers and news. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

5. Recipients of the data

Your data may be accessed, strictly on a need-to-know basis, by:

• the controller's authorised personnel;
• service providers acting as processors (for example, the web hosting provider, the e-mail service provider, the traffic analytics provider, the accounting service provider);
• public authorities, where there is a legal obligation to do so.

We do not sell or trade your personal data to third parties.

6. Transfer of data outside the EU/EEA

As a rule, your data is processed within the European Union / European Economic Area. Where certain service providers (for example, analytics providers) process data outside the EU/EEA, we ensure that the transfer takes place with adequate safeguards, in accordance with the GDPR (for example, standard contractual clauses or an adequacy decision of the European Commission).

7. Retention period

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected:

• data from contact / reservation requests – for the period necessary to handle them and for a reasonable period thereafter;
• data processed on the basis of a legal obligation (for example, accounting documents) – for the period provided by law;
• data processed on the basis of consent – until consent is withdrawn;
• technical data / cookies – in accordance with the durations indicated in the Cookie Policy.

8. Data security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or disclosure. However, the transmission of information over the internet cannot be guaranteed to be completely secure, which is why we cannot guarantee the absolute security of data transmitted to the website.

9. Your rights

As a data subject, you have the following rights under the GDPR:

• Right of access – to obtain confirmation that we process your data and to access that data;
• Right to rectification – to correct inaccurate data or to complete it;
• Right to erasure ("right to be forgotten") – to request the deletion of data, under the conditions of the law;
• Right to restriction of processing – in certain situations provided by law;
• Right to data portability – to receive the data in a structured format and to transmit it to another controller;
• Right to object – to object to processing based on legitimate interest or for marketing purposes;
• Right to withdraw consent – at any time, without affecting the lawfulness of prior processing;
• Right to lodge a complaint with the supervisory authority.

To exercise these rights, you can contact us at office@monterai.ro. We will respond to your request within the period provided by law.

10. Cookies

The website uses cookies and similar technologies. Detailed information about them and about how you can manage your preferences can be found in the Cookie Policy.

11. Processing of minors' data

The website is not directed at minors under the age of 16 and we do not knowingly collect their data through the website. If you become aware that a minor has provided us with personal data without the consent of their legal guardian, please contact us so that we can remove it.

12. Changes to this policy

We reserve the right to update this Privacy Policy at any time, displaying the date of the latest update. We recommend that you check this page periodically to stay informed about how we protect your data.

13. Contact and supervisory authority

For any question or request regarding the processing of your data, you can contact us:

You also have the right to lodge a complaint with the supervisory authority:

This policy should be read together with the Terms and Conditions and the Cookie Policy published on the website.