Privacy Policy

1. Who is the data controller

Controller: Boats Concept SRL
Address: Str. Griviței Nr. 70bis, Bl. 27, Sc. A, Ap. 12
Tax ID: 31003490

2. What data we collect

Data you provide directly

• Full name
• Email, phone number
• Your message, offer request, questions
• Preferences regarding experience, duration, number of people, level, period
• Data needed for booking or invoicing, where applicable

Data collected automatically

• IP address, browser and device type, operating system
• Pages visited, source of visit, time spent
• Cookies and similar technologies — see our Cookie Policy

3. Why we process data and on what legal basis

To respond to your requests

Purpose: communication, offers, organizing the experience. Basis: legitimate interest or pre-contractual steps at your request.

For bookings and contract performance

Purpose: confirmation, organization, service delivery, invoicing. Basis: performance of the contract and legal obligations.

To improve the site

Purpose: measuring traffic and performance. Basis: consent, when using non-essential cookies.

For security and preventing abuse

Purpose: protecting the site, detecting technical issues. Basis: legitimate interest.

Marketing / newsletter, where applicable

Purpose: sending updates, offers. Basis: consent. You can unsubscribe any time via the link in the email or by writing to us.

4. Who we may share data with

We do not sell your data. We only share it with IT and hosting providers, email providers, traffic analytics providers (only if you accepted the relevant cookies), and public authorities where legally required. These providers act only on our instructions.

5. Transfers outside the EU/EEA

Some services, such as analytics or email, may involve transfers outside the EU/EEA. In such cases we use appropriate safeguards under GDPR.

6. How long we keep data

• Contact or offer messages: usually 12 months or until resolution, plus reasonable archiving
• Booking or contract data: for the duration of the contract plus legally required periods
• Analytics data: as configured in the tool used
• Security logs: 30 days, depending on need

7. Your rights

Under GDPR you have the right of access, rectification, erasure under certain conditions, restriction, portability, objection, and the right to withdraw your consent. You also have the right to lodge a complaint with the supervisory authority — in Romania, ANSPDCP.

8. How to exercise your rights

You can write to us at pddlejourneys@gmail.com. We'll reply within the legal 30-day period. For protection, we may ask you for information to confirm your identity.

9. Data security

We apply reasonable technical and organizational measures to protect data — access control, backup, updates. No online system, however, can guarantee complete security.

10. Minors' data

Our services are not directed to minors without the consent and supervision of a parent or guardian. If you learn that a minor has provided us data without consent, please contact us for deletion.

11. Links to third-party sites

The site may contain links to other sites, social networks, maps, video. We do not control their privacy policies; we encourage you to read them.

12. Changes to this policy

We may update this policy periodically. The current version will be published on the site, along with the date of the last update.

13. Data processing through the booking form

Through the booking or inquiry form we may collect your name, email, phone, arrival date, departure date, subject and an optional message. We use this data to answer requests, check availability, manage the booking, contact you for confirmations and logistical details, and, where applicable, to issue accounting documents.

If you write to us on WhatsApp, by phone or email, we process contact details and message content only to reply and organize the booking, under the same conditions described above.