Privacy Policy

Villa DeaDorata ("we", "us", or "our") is the controller of personal data collected through this website. This policy explains what we collect, why, who we share it with, and the choices you have. This website is built on the Resify platform; Resify acts only as a technical service provider and is not the controller of your personal data.

Villa DeaDorata · Registered address: Cuza Voda 75, Oradea, Bihor County, 410097, Romania

We collect the following categories of information:

• Booking data: your name, email address, phone number, check-in and check-out dates, number of guests, room selection, special requests, booking reference, and payment status.
• Payment metadata: the brand and last four digits of your card, the billing country, and the payment status. Full card details are entered into Stripe's secure form and are never stored by us.
• Communications: the content of any messages you send to us through the website, by email, or by phone, together with related metadata.
• Device and usage data: IP address, approximate location derived from IP, browser type, operating system, language, referring URL, pages viewed, and basic interaction telemetry.

We use the information we collect to:

• Process and fulfil your booking, including taking payment, sending confirmations and reminders, providing access instructions, and handling check-in.
• Communicate with you about your booking, your stay, and service-related matters.
• Comply with our legal, tax, and accounting obligations.
• Detect and prevent fraud, abuse, and security incidents.
• Improve the website, measure how it is used, and run basic analytics.
• Establish, exercise, or defend legal claims.

Our legal basis is performance of the booking contract with you, our legitimate interests in operating and improving this website and protecting it from fraud and abuse, and compliance with our legal obligations.

This website uses two categories of cookies and similar technologies:

• Strictly necessary: to keep your booking session, remember your language preference, and operate the secure checkout. These cannot be disabled.
• Analytics and performance: to understand how visitors find and use the website and to measure conversion. These may be enabled when we are running analytics.

You can manage cookies through your browser settings. Disabling non-essential cookies may affect how the website works for you. We do not use cookies for third-party advertising on this website by default.

We share personal data with the following categories of recipients, only to the extent necessary for the purposes above:

• Stripe: to process your payment.
• Resend: to send transactional email (booking confirmations, reminders).
• Cloudinary: to host and deliver photos shown on this website.
• Supabase: to store and serve the booking database that powers this website.
• Vercel: to host and serve this website.
• Authorities: when required by law, court order, or to protect our rights, property, or the safety of guests, staff, or the public.

We do not sell personal data.

Some of our service providers operate outside the country where you live. Where required by law we rely on appropriate safeguards such as standard contractual clauses. By using this website you acknowledge and consent to these transfers.

Booking and payment records are kept for as long as is necessary to satisfy our tax, accounting, and legal obligations (typically 7 to 10 years depending on jurisdiction). Other personal data is kept only for as long as needed for the purposes described in this policy. Backups, logs, and aggregated or de-identified data may be retained for longer.

We use commercially reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, and alteration. No method of transmission over the internet or electronic storage is fully secure, however, and we cannot guarantee absolute security. You use this website at your own risk.

Depending on where you live, you may have rights to access, correct, delete, restrict, port, or object to the processing of your personal data, and to withdraw consent. To exercise any of these rights, or to ask any other question about your personal data, email viladeadorata@gmail.com. We may need to verify your identity before acting on a request and may decline requests to the extent permitted by law.

This website is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

This website may contain links to websites and services operated by third parties. This policy does not apply to those third parties and we are not responsible for their privacy practices.

We may update this policy at any time at our sole discretion. The updated policy takes effect as soon as it is posted on this website. Your continued use of the website constitutes your acceptance of the updated policy.

Questions about this policy? Email viladeadorata@gmail.com.