The data controller is DUM BOUTIQUE SRL, tax identification number 54239300, Trade Register number J2026016677001, with its registered office at Bd. Decebal no. 13, building S15, section 3, ground floor, Sector 3, Bucharest, 030964, Romania. Contact: office@dumanhotel.ro; telephone 0733 777 001. This notice covers data processed through the website and in connection with hotel enquiries and bookings. Do not send payment card details, copies of identity documents, medical data or other sensitive information unnecessary for your enquiry through the general forms.
| Purpose | Data and legal basis | Retention criteria |
|---|---|---|
| Responding to enquiries and preparing bookings | Contact details, message content and stay details; steps taken at your request before entering a contract, Article 6(1)(b) GDPR; for general correspondence, the legitimate interest in managing enquiries, point (f). | For as long as necessary to resolve the enquiry, followed by a justified period for keeping evidence of correspondence and handling possible claims. |
| Bookings and provision of services | Identification and contact details, dates, room category and information needed for the stay; performance of the contract, point (b). | During the contractual relationship and afterwards for as long as necessary to comply with legal obligations and defend legal rights. |
| Invoicing and legal obligations | Data required for accounting documents and mandatory records; legal obligation, point (c). | Mandatory periods set by the legislation applicable to each document category. |
| Website security and operation | Technical data, such as IP addresses and access logs, to the extent collected by the systems used; legitimate interest in preventing abuse and incidents, point (f). | The technical period necessary for security and incident investigation, with restricted access. |
| News and marketing communications | Email address and evidence of your choice; separate consent, point (a). | Until consent is withdrawn; evidence of consent is kept only for as long as necessary to meet obligations and defend legal rights. |
| Optional Google Analytics statistics | Website usage data, only after valid consent to analytics; consent, point (a). | According to the periods configured and described in the final cookie notice; withdrawal stops future collection based on consent. |
Data necessary for an enquiry or booking must be provided so that it can be processed; without it, a response or the provision of the service may be impossible. Marketing and analytics data are optional, and refusing them does not affect access to hotel services.
Recipients and transfers
Access is restricted to authorised staff and providers needed for the service: hosting and maintenance, email, the booking platform, accounting and payment processing, as applicable; competent authorities receive data when required by law. Google Analytics is used for optional statistics only after a consent mechanism has been implemented.
Bookings open on the external Stayntouch platform. Read the notices displayed there before providing data. If a provider transfers data outside the European Economic Area, the transfer must rely on a valid mechanism under Chapter V GDPR, such as an applicable adequacy decision or standard contractual clauses and any necessary supplementary measures. Details and applicable safeguards may be requested from the controller.
Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction and portability; object to processing based on legitimate interests; and withdraw consent at any time without affecting the lawfulness of earlier processing. You may object to marketing at any time. Some data must be retained to comply with the law or defend legal rights. Send your request to office@dumanhotel.ro or by post to the registered office. Identity is verified only to the extent necessary to protect the data.
We respond within the period set by the GDPR, usually one month; any extension permitted by the Regulation will be explained. You may lodge a complaint with ANSPDCP and apply to the competent court. Website data are not intended to be used for decisions with legal effects based solely on automated processing.
Updated on 17 October 2026.