1. WHO ARE WE?

DOMENIUL CASA TIMIS S.R.L. and 3R INTEGRATIVE MEDICINE S.R.L. (hereinafter referred to as the “Operators”) place great importance on your personal data and constantly make the necessary efforts to ensure that data processing complies with the legal requirements in this field. For this purpose, we have drafted this commitment through which we undertake to respect the confidentiality of your personal data and through which we explain what categories of personal data are processed by the Operators, how such data is used, and the purpose for which it is subject to processing operations.

This Policy applies only to the personal data we process through our website www.casatimis.ro (hereinafter referred to as the “Website” or the “Platform”) in the context in which you interact with it by completing the forms available on the platform, placing an order for gift cards, in accordance with the Policy available on the Website, subscribing to the newsletter, making a reservation, completing and submitting the satisfaction questionnaire, or simply browsing it. We want to assure you that we have taken all necessary measures to ensure the confidentiality of your data, which is processed only by the staff of the two Data Operators, who have been previously trained regarding the processing of personal data, authorized accordingly, and who comply with strict confidentiality commitments.

To get to know us virtually, we provide you with our identification details.

The Operators that process your personal data when you browse or interact with the online platform www.casatimis.ro are represented by DOMENIUL CASA TIMIS SRL, with its registered office in Prahova County, Bucov Commune, Chitorani Village, Florica Romalo Street no. 4, registered with the Trade Register under no. J2022000894292, having VAT no. 45910456, and 3R INTEGRATIVE MEDICINE SRL, with its registered office in Prahova County, Bucov Commune, Chitorani Village, Florica Romalo Street no. 4, registered with the Trade Register under no. J2023001841296, having VAT no. 48640454.

For any questions or concerns regarding the protection of personal data, you are invited to send a request to the postal address indicated above or to the following email correspondence addresses [email protected] or [email protected], depending on the Data Operator you wish to contact. Persons submitting such requests to the Operators are kindly asked to mention in the email subject line/on the envelope information such as “data protection”, “GDPR”, “personal data”, so that such requests may be handled with priority.

In this capacity, you will receive a response within a maximum of 30 days from the communication of the document to the Data Operators, an extension of this term being possible only in exceptional situations. In such cases, we assure you that you will be duly informed regarding this extended term.

2. DEFINITIONS

• “Personal data” means, within the meaning of the applicable national and international legislation, any information relating to an identified or identifiable natural person. An identifiable person is a person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to their physical, physiological, psychological, economic, cultural, or social identity.

! For the purposes of this Policy, the personal data subject to processing may refer to: first name, last name, phone number, email address, delivery address, etc., as further described below.

• “Processing of personal data” means any operation or set of operations performed on personal data, whether by automated or non-automated means, such as: collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure to third parties by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, or destruction.

! For the purposes of this Policy, data processing refers to the processing carried out when you browse the website www.casatimis.ro or interact with it by completing the forms available on the Platform, placing an order through the website, or subscribing to the Operators’ newsletter.

• “Controller” means the person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

! For clarity, for the purposes of this Privacy Policy, the personal data Controllers are DOMENIUL CASA TIMIS SRL and 3R INTEGRATIVE MEDICINE SRL.

• “Data subject” means the person whose personal data is subject to processing.

! For the purposes of this Policy, the data subject is the Internet user browsing the website www.casatimis.ro.

• “Consent” of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

Note! The data processing carried out through the Platform and based on the legal ground of consent is intended exclusively for newsletter subscription and the acceptance of cookies other than those that are necessary (essential), as reflected in the cookie pop-up.

• “Third party” means a natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or the processor, are authorized to process personal data.
• “Processor” means the person who processes personal data on behalf of the controller.

3. WHAT TYPES OF PERSONAL DATA DO WE PROCESS?

Your browsing of the Website and your interaction with it involve the processing of two categories of personal data, namely:

• personal data that you voluntarily disclose to the Operators (e.g. through the order or contact form, by making a reservation, by submitting the satisfaction questionnaire, or when subscribing to the newsletter, etc.), which is collected individually;

• data that you provide involuntarily, simply by browsing our website.

If invoicing is requested for a legal entity, please note that the data requested and entered in the website forms on behalf of a legal entity does not constitute personal data (such as the company email address, for example companyname@office, or the company phone number, such as a landline number, etc.) under the provisions of Regulation no. 679/2016 on the protection of personal data (GDPR).

Where the personal data of the company’s representative as a natural person is provided (first name and last name, phone number, email address), that person will be considered a data subject under the GDPR and will benefit from all applicable protection measures.

The user is properly informed regarding the processing of personal data when providing their data to the Operators through the forms on the website, thus fulfilling the Operators’ legal obligation to inform the data subject.

Based on the data subject’s voluntary provision, the Operators collect the following personal data:

1. When placing an order:

• first name and last name;
• phone number;
• email address;
• billing address;

• any other data you provide by completing the Order notes field, through which you may send us details or preferences regarding the placed order.

Note!: If the order is paid by bank card, your data will not be processed by the Operators, as the payment activity falls under the privacy policy of the partner payment processors. However, some data (for example, the card number) may be saved for future purchases through the browser you use and only if you agree to such storage at browser level. This processing takes place solely to ease the user’s ordering experience and does not involve the Operators, in the sense that they do not have access (not even through simple viewing) to the data required to pay for the order by bank card.

1. For obtaining additional information / submitting complaints via email or by phone (customer support), respectively in the context of inbound and/or outbound phone calls:

• voice;
• phone number;
• other categories of personal data you provide in the context of phone calls and which may refer to:

• first name and last name;
• email address;
• delivery address;
• bank account (for reimbursement), as applicable, etc.;

• traffic data related to each phone communication, respectively: the call start date, call end date, call duration, the telephony network through which the call was carried out, the number dialed and the calling number, etc.

1. For newsletter subscription

Subscription to the newsletter is conditional upon your consent to receive commercial and marketing messages from the Operators. In this context, the following personal data will be processed:

• email address;
• name.

1. For making a reservation at the restaurants belonging to Domeniul Casa Timis, respectively for experiences and events or the services offered by 3R Integrative Medicine

Making a reservation requires the provision of personal data that will be used, with your consent, in order to contact you for the fulfillment of the reservation.

• first name and last name;
• phone number;
• email address;
• number of persons covered by the reservation;
• stay details (arrival date, departure date);
• number of reserved rooms and room type, etc.;
• any other data you provide by completing the “Message” section.

1. For completing the contact form

• first name and last name;
• phone number;
• email address.

1. For submitting the satisfaction questionnaire

The Operators’ guest has the option to complete and submit, following their stay or experience at Domeniul Casa Timis or within 3R Integrative Medicine, a satisfaction questionnaire, in the context of which the Operators may process the following personal data:

• first name;
• country of origin;
• your suggestions regarding the Data Operators’ services;
• your option regarding newsletter subscription, as well as
• your consent to the distribution of your suggestion on the Operators’ social media pages.

The Operators also process marketing and communication data only on the basis of users’ prior consent, as well as technical data and browsing actions through cookies and similar technologies.

The data specified above contributes to the provision of the services offered by the Operators and to the activity of ordering vouchers marketed through the platform www.casatimis.ro, as well as to communication with the Operators or the sending of marketing communications by them, but only after obtaining the user’s prior consent, as detailed in the Newsletter Subscription Policy.

If you provide us with personal data that is not necessary for the purposes described above, respectively for fulfilling placed orders, making reservations, resolving complaints, or providing additional information, we reserve the right to immediately remove it from our database.

The Operators may also involuntarily collect other personal data belonging to you, namely: IP address, browser version, time zone setting and location, operating system, platforms on the devices used to access our websites, etc. This information will not be used to identify natural or legal persons, as applicable, and will not be made public except under the conditions set out in this Privacy Policy, supplemented by the Cookie Policy available on www.casatimis.ro.

The Operators reserve the right to request additional information from you, accompanied by supporting documents, via email, in printed form, or in any other manner deemed appropriate by the Operators, where necessary, for the purposes detailed below.

Payment processing service providers will process the following categories of personal data:

• bank card details (card number, CVC, etc.);
• first and last name of the cardholder;
• order ID;

• transaction initiation date;

• transaction completion date;

• transaction ID;

• payment status (paid / unpaid);

• amount transacted (as applicable).

These payment processing service providers process your data as independent controllers of personal data, which is why the data processing carried out by them is subject to their own privacy policy. At the stage of actually entering the details of the card used for online payment, the identity of the online payment operator will also be made known to you.

Note: In the case of returns / order cancellations that cannot be processed through the payment operator’s platform, Domeniul Casa Timis or 3R Integrative Medicine may process, as personal data, your IBAN and the bank where you opened the bank account in order to refund the money paid for the returned products / canceled orders.

Note: The Operators have entered into data processing agreements with their service providers (for example: IT / online system administration, legal services, payment processing services, etc.), but they are not responsible for the processing carried out by such providers in their own name, where such providers would process the data as independent controllers, the data subject being properly informed with regard to processing that involves a transfer of data between the Operators and any company providing services to them.

Therefore, please note that when you wish to make a reservation for the accommodation offered by Domeniul Casa Timis, the data controller will be BookOnlineNow Private Company, acting as an independent controller of personal data, and the processing will be carried out in accordance with that operator’s own Terms and Conditions and Privacy Policy.

Your personal data may be disclosed by Domeniul Casa Timis or 3R Integrative Medicine, for processing purposes, to processors, including contractual partners, authorities and financial institutions, courts of law, or competent bodies, at their request and for the purpose of providing the services offered by the Operator.

The Operators may store your personal data even after a request to erase such data has been registered, if storage is carried out for one of the following purposes provided by art. 17 of the GDPR, namely:

1. performance of a contract;
2. compliance with a legal obligation requiring processing under European Union law or the national law applicable to the controller;
3. exercise of the right to freedom of expression and information;
4. protection of the vital interests of the data subjects;
5. performance of a task carried out in the public interest;
6. archiving in the public interest, scientific or historical research, or statistical purposes;
7. the protection of the legitimate interests of the Operators or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, especially where the data subject is a child;
8. for the establishment, exercise, or defense of legal claims.

4. FOR WHAT PURPOSES AND ON WHAT LEGAL GROUNDS DO WE PROCESS PERSONAL DATA?

The Operators process your personal data for the following purposes and on the following legal grounds:

• the processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract (art. 6 para. (1) letter b) of Regulation (EU) no. 679/2016 of the European Parliament and of the Council of 27 April 2016), specifically for the purpose of ensuring the data subject’s access to the products and services presented on the Platform www.casatimis.ro and of concluding the distance sale;
• the processing is carried out on the basis of the consent of the data subjects (art. 6 para. (1) letter a) of Regulation (EU) no. 679/2016 of the European Parliament and of the Council of 27 April 2016), in the case of sending commercial and marketing communications or accepting cookies other than the necessary ones, as well as for publishing your suggestions on the Operators’ social media pages;
• the processing is necessary for the purposes of the legitimate interests pursued by the Operators (art. 6 para. (1) letter f) of Regulation (EU) no. 679/2016 of the European Parliament and of the Council of 27 April 2016), in order to provide accurate information and resolve issues of any nature relating to the content of the website www.casatimis.ro or the services and products offered by the Operators, as well as for actions involving interaction with the online platform.

Your personal data will be processed so that the Operators may:

1. improve the website and the services provided through it;
2. determine the usefulness / popularity of the web content presented on the website;
3. send technical, support, or administrative notifications;
4. fulfill requests and resolve complaints received from users;
5. facilitate the user’s access to the services offered by the Operators;
6. communicate information of interest to website users;
7. protect the rights belonging to the Operators.

5. DURATION OF PERSONAL DATA PROCESSING

The personal data processed by the Operators through the website www.casatimis.ro is retained for a reasonable period of time in relation to the purpose of the data processing, in accordance with the legal provisions regarding data archiving. The Operators comply with the data archiving periods imposed by law.

With regard to data obtained in the context of inbound and outbound phone calls (call recordings), it will generally be kept for a period of 30 days. However, data obtained in the context of phone calls and necessary, for example, for billing and fulfilling a placed order, will be retained in accordance with the legal provisions regarding archiving.

Data processed as a result of your newsletter subscription will be processed by the Operators only until you withdraw your consent for such processing, in accordance with the Newsletter Subscription Policy available on www.casatimis.ro.

6. SPECIAL PROVISIONS REGARDING MINORS

The Operators pay particular attention to the data of minors that might be provided by them for the purpose of placing an order or making a reservation on the online platform www.casatimis.ro, in order to ensure that any processing of minors’ personal data is carried out only in accordance with legal requirements and in strictly determined cases.

Thus, the Operators do not carry out direct marketing promotional activities towards minors. However, if a minor places an order / contacts the Operators through the relevant platforms, it shall be considered that the minor has taken such action with the consent of their legal representative.

Minors are not allowed to request services or participate in contests or campaigns organized by the Operators unless such operations are carried out on behalf of the minor by their legal representative or guardian, in accordance with the law.

In this regard, any person who provides personal data to the Operators through the website or other applications or devices covered by this Policy guarantees that they are an adult and have full legal capacity.

Any processing of personal data belonging to minors will be carried out only under the conditions of the law and with due regard to the provisions above.

7. TRANSFER OF PERSONAL DATA

Your data is processed within the territory of the European Union, through secure internal servers. However, through social media-specific plugins (for example, Facebook, LinkedIn, Instagram, TikTok, etc.), having the status of third-party recipients of the data, it is possible that your data processed in this context may also be transferred outside the European Union / European Economic Area and stored on servers in third countries. In this respect, the Operators have implemented a series of necessary and appropriate measures capable of ensuring compliant data processing.

The Operators undertake that the collected data shall be processed only in accordance with the stated purposes and shall not make public, sell, rent, license, transfer, etc. without authorization the database containing information regarding the data of the data subjects to any third party not involved in fulfilling the stated purposes, except where the transfer / access / viewing, etc. is requested by the competent authorities, in the cases provided by the regulations in force at the time of the event.

It is possible that your data may be disclosed to other companies that provide services to us and act as processors, such as providers delivering website maintenance, IT, legal, delivery services, etc.

Likewise, your data may also be processed by our partners that provide payment processing or other services (making a reservation and/or completing the satisfaction questionnaire) for the Operators.

These entities are selected with great care to ensure that they meet the specific requirements regarding the protection of personal data. They have a limited ability to use your information for purposes other than providing us with services.

Apart from the disclosures described in this Privacy Policy, we may transmit information to third parties to whom you consent or request that we make such disclosure.

8. LINKS, HYPERLINKS, THIRD-PARTY WEBSITES

The website www.casatimis.ro may contain links to third-party websites which may, in turn, collect your personal data, including through cookies or other technologies.

If you connect to a third-party website, the Operators’ privacy policy will not apply to your browsing of that website.

9. WHAT RIGHTS DO YOU HAVE AS A DATA SUBJECT?

Any natural person who browses our website, as a data subject, has the following rights in relation to Domeniul Casa Timis and 3R Integrative Medicine, as personal data Controllers:

• Right of access means the data subject’s right to obtain confirmation from the Controller as to whether or not personal data concerning them is being processed and, where that is the case, access to such data and information on how the data is processed;

• Right to rectification refers to correcting, without undue delay, inaccurate personal data that has been processed or completing it if it is incomplete. Such data may be modified by sending an email to: [email protected] or [email protected];

• Right to erasure / right to deletion (“right to be forgotten”) means the data subject’s right to request that their personal data be erased without undue delay where one of the following grounds applies: the data is no longer necessary for the purposes for which it was collected or processed, they withdraw their consent and there is no other legal ground for the processing, they object to the processing and there are no overriding legitimate grounds, the personal data has been unlawfully processed, the personal data must be erased for compliance with a legal obligation, or the personal data has been collected in relation to the offer of information society services;

• Right to restriction of processing may be exercised where the data subject requests the limitation of the processing of their personal data, in which case it will be used strictly for the exercise of the data subject’s other legal rights, including responding to any requests / complaints from them;

• Right to data portability refers to the right to receive personal data in a structured, commonly used, and machine-readable format and the right to have such data transmitted directly to another controller, where the processing is based on consent or on a contract and is carried out by automated means, if technically feasible;

• Right to object concerns the data subject’s right to object to the processing of personal data where the processing is necessary for the performance of a task carried out in the public interest or where it pursues a legitimate interest of the Operators;

• Right not to be subject to automated individual decision-making refers to the fact that the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. However, this right cannot be exercised where the decision is necessary for entering into, or performance of, a contract between the data subject and the Operators, is authorized by the law applicable to the Operators, provided that adequate safeguards are in place for the rights, freedoms, and legitimate interests of the data subjects, or is based on the data subject’s consent obtained in compliance with the applicable legislation;

• Right to lodge a complaint with the National Supervisory Authority for Personal Data Processing. If the data subject considers that the rights provided above have been infringed, they may address the ANSPDCP by filing a complaint.

The contact details of the A.N.S.P.D.C.P. are as follows:

Address: Bucharest, Sector 1, B-dul G-ral. Gheorghe Magheru no. 28-30;

Phone: 0.318.059.211 / 0.318.059.212;

Fax: 0.318.059.602;

E-mail: [email protected];

Website: www.dataprotection.ro.

In order to exercise the rights provided above, the data subject shall address the Operators by sending a request to: Chitorani Village, Bucov Commune, Florica Romalo Street no. 4, Prahova County, or to the email correspondence address mentioned above, in the first section of this Policy.

10. FINAL PROVISIONS

If the Operators consider that a change to the privacy rules is necessary, they will publish the relevant modifications in order to inform data subjects about the information they collect and how they use it.

The provisions of the Privacy Policy are supplemented by the provisions of the Cookie Policy and the Newsletter Subscription Policy, available on the website www.casatimis.ro.