Privacy Policy

• Szilveszter Izolda-Hajnalka, private individual, trading as EXI Moments
• Address: Fabricii nr.6, Miercurea-Ciuc, 530153, Harghita, Romania
• Phone: +40 754 638 350
• E-mail: hello@exi-moments.ro

The controller is the same person who lets the tub (see section 1 of the T&C).

None has been appointed, as Article 37 GDPR does not require one. For data protection questions, write to the e-mail address above.

Contract (Art. 6(1)(b) GDPR): the data needed for booking and renting. Legal obligation ((c)): for example the tax registration. Legitimate interest ((f)): for example security, evidence, legal claims. Consent ((a)): for example statistics, reviews, photos — you can withdraw it at any time, without affecting earlier processing.

Data: name, e-mail address, phone number, delivery address, requested period, notes.

Purpose: assessing the request, sending the payment request and the confirmation, arranging details by phone or e-mail.

Legal basis: contract, or steps taken before entering into a contract ((b)).

How long we keep it: if no contract follows (request rejected or cancelled, fee not paid), we anonymise it after 6 months; otherwise as under B).

Data: the data under A), plus home address, identifier (CNP, or for a foreign renter the passport or ID card number), prices and payments (booking fee, payment method, refund), the contract as a PDF, the signature image, time and method of signing (online, on site or on paper), for electronic signatures the IP address and browser details, and for a contract signed on paper the scanned copy.

Purpose: concluding, proving and performing the contract (delivery, payment, collection).

Legal basis: contract ((b)); for the signature data, legitimate interest ((f)) — evidence; for the identifier, legal obligation ((c)), see C).

How long we keep it: 5 years from 1 July of the year after the rental (the tax limitation period, Art. 110 of the Romanian Tax Procedure Code), then we delete it.

Data: the Renter’s name, home address and identifier, a copy of the contract and the rental price.

Purpose: as a private individual, the Lessor registers the contract with the tax authority (form C168) within 30 days of its conclusion and pays income tax.

Legal basis: legal obligation ((c)) — Art. 83(5) of the Romanian Tax Code and ANAF’s implementing order.

Recipient: the Romanian tax authority (ANAF), through its online Private Virtual Space (SPV).

How long we keep it: as under B).

Data: site details (water, access, ground, draining of used water, animals, entry), free-text notes, the name and phone number of the on-site contact.

Purpose: planning delivery and safe setup.

Legal basis: contract ((b)); if the contact is someone else, legitimate interest ((f)) — organising the delivery.

How long we keep it: 1 year after the end of the rental.

The on-site contact may be someone else (for example the host of your accommodation). We receive their details from the Renter; please tell them about this policy.

Data: photos of the tub taken at handover, at collection or in case of damage (which may show the site), the description of the damage, the repair cost, the handover checklist.

Purpose: recording the condition of the tub, settling damage claims.

Legal basis: contract ((b)) and legitimate interest ((f)) — legal claims.

How long we keep it: as under B); if a dispute is ongoing, until it is settled.

Data: e-mail address, the one-time sign-in link, the chosen language, the bookings linked to the account.

Purpose: following the booking, filling in the questionnaire, signing the contract, sending a review or photos.

Legal basis: contract ((b)).

How long we keep it: until you delete the account; you can do so yourself in the portal (see section 5).

Data: the rating, the review text and the display name you choose; the uploaded photos and their captions.

Purpose: showing approved reviews and photos on the website; for a review and a photo we give a discount on the next booking.

Legal basis: consent ((a)) — given by submitting. You can withdraw it at any time by e-mail or by deleting your account, and we then remove them.

How long we keep it: until you withdraw your consent.

When uploading, your browser re-saves the photo, so hidden data (such as the GPS location) usually does not reach us. The safest option is to turn off location tagging for photos on your phone.

Data: name, e-mail address, phone number, message, IP address.

Purpose: letting you know if the tub becomes free in the period you want; the IP address to prevent abuse.

Legal basis: a pre-contractual step at your request ((b)); for the IP address, legitimate interest ((f)).

How long we keep it: we close the entry after 6 months and delete it 1 year after sign-up.

Data: the e-mail address and phone number of a renter who seriously breached the contract.

Purpose: automatically rejecting a booking request if the e-mail address or phone number matches (see section 4).

Legal basis: legitimate interest ((f)) — protecting the tub and the Lessor.

How long we keep it: as long as the reason for the block persists, at most 3 years.

Data: what you accepted (T&C, having read the Privacy Policy, the exclusion of the right of withdrawal, your cookie choice), when and which version, browser details, the IP address as a one-way salted hash — not the address itself — and, if you accepted statistics, the statistics identifier.

Purpose: proving that you accepted the terms and made a cookie choice.

Legal basis: legal obligation ((c)) — demonstrating consent (Art. 7(1) GDPR); legitimate interest ((f)) — evidence.

How long we keep it: the cookie choice 1 year, the acceptances at booking 3 years.

Data: a pseudonymous statistics identifier (the exi_session cookie), the page visited, clicks and form events, the referring page (without its query part — such as the secret code of a booking link), browser, language, a salted hash of the IP address; plus the measurements of Vercel Web Analytics and Speed Insights (page views, loading speed), which use no cookies.

Purpose: seeing which pages and features work well, and improving the website.

Legal basis: consent ((a)) — given in the cookie banner; you can withdraw it at any time with the “Cookie settings” button in the footer.

How long we keep it: we delete our own statistics after 90 days; we see Vercel’s measurements in aggregate, for the period the Vercel service provides.

Data: the IP address for rate-limiting booking requests and waiting-list sign-ups; a log of actions on bookings, contracts and accounts (for example online signing, account deletion) with the e-mail address and IP address.

Purpose: protecting the website and the data, preventing abuse, keeping actions traceable.

Legal basis: legitimate interest ((f)); data security is also an obligation under Art. 32 GDPR.

How long we keep it: the rate-limiting IP address 7 days; we anonymise the action log after 3 years.

We send booking e-mails (request received, payment request, confirmation with the contract, the signed contract, cancellation, sign-in link) to perform the contract ((b)).

After the rental we once ask for a review and offer a discount on your next booking. This rests on legitimate interest ((f)): offering an existing customer a similar service (Art. 12(2) of Romanian Law 506/2004). If you’d rather not get it, reply to the e-mail and we won’t send it again. We send no newsletters.

We keep the correspondence for the period under B).

The following providers process data on our behalf, under their data processing terms (DPA):

• Supabase Inc. (USA) — database, file storage (contracts, signatures, photos) and portal sign-in. The data is stored in the European Union, on a server in Ireland (AWS eu-west-1). The booking calendar also connects to this server directly from your browser.
• Vercel Inc. (USA) — website hosting. Server-side processing takes place in the EU, in Dublin (Ireland); static content is served by Vercel’s servers worldwide. With your consent, the Web Analytics and Speed Insights measurements.
• Resend Inc. (USA) — sending e-mails (confirmation, payment request, the contract PDF, sign-in link).
• Cloudflare Inc. (USA) — domain name service and forwarding of e-mails sent to hello@exi-moments.ro.

E-mails sent to us and booking notifications arrive in the Lessor’s Gmail mailbox, operated by Google (Google Ireland Ltd. and Google LLC, USA).

The providers above are US companies or have US parent companies, so the data may also be accessed from the USA (for example for operations or support), and sending e-mails may involve processing in the USA. Transfers rely on the Standard Contractual Clauses adopted by the European Commission (SCC) and — where the provider is certified — on the EU-US Data Privacy Framework (DPF) (Art. 45 and 46 GDPR).

To ANAF as described in section 2 C). To other authorities (for example police, courts, ANPC, ANSPDCP) only under a legal obligation, on request. We do not sell data and do not share it with anyone for advertising.

An approved review (with the name you chose) and an approved gallery photo are visible to anyone on the website (section 2 G)).

If the e-mail address or phone number in a booking request is on the block list (section 2 I)), the system rejects the request automatically. Placing someone on the list was an earlier, individual decision of the Lessor. You may ask for the decision to be reviewed by a person and give your point of view. We use no other automated decisions or profiling.

• Access (Art. 15) — you can ask what data we hold about you and request a copy.
• Rectification (Art. 16) — we correct inaccurate data.
• Erasure (Art. 17) — we delete it, except what the law requires us to keep (for example the contract for the tax registration).
• Restriction (Art. 18) — for example while a dispute is ongoing.
• Portability (Art. 20) — you receive, in a machine-readable format, the data processed on the basis of contract or consent.
• Objection (Art. 21) — to processing based on legitimate interest.
• Withdrawing consent (Art. 7(3)) — statistics: with the “Cookie settings” button in the footer; reviews, photos: by e-mail.

Write to hello@exi-moments.ro. We reply within one month at the latest (Art. 12(3) GDPR); for complex requests this may be extended by two months, and we will let you know. Before acting on a request we may verify your identity.

In the portal you can download the basic data of your account (JSON) and delete your account yourself. On deletion we close the portal account, remove your photos and review, and delete your name, e-mail address, phone number, addresses and identifier from your customer record and bookings. We keep concluded contracts for the period under section 2 B), for the tax registration. You can also request a full copy or erasure by e-mail.

You can complain to the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — B-dul G-ral. Gheorghe Magheru 28-30, București 010336, tel. +40 318 059 211, e-mail: anspdcp@dataprotection.ro, dataprotection.ro. You may also turn to the authority of the EU member state where you live or work.

Booking requires your name, e-mail address, phone number and delivery address, and the contract your home address and identifier; without them we cannot conclude the contract. The questionnaire data is needed for safe delivery. Everything else (statistics, reviews, photos, waiting list) is optional.

Details in the Cookie Policy.

If our processing changes, we update this policy; the version in force is always on this page, with its version number and effective date. The rental contract names the version in force when it was concluded.