Privacy Policy

This Privacy Policy contains the details of the data processing activities on personal data and related information concerning the activities carried out by Abod Tourism Srl. (hereinafter: “Abod”) as data controller, including its activities in relation of the performance of the agreement for the use and utilization of the service (hereinafter: “Service”) available on the website at https://www.abodretreat.com/ (hereinafter: “Website”) and the related reservation sub-website available at https://abodretreat.lodgify.com/en/accommodations.

Abod offers as Service accommodation rentals and other hospitality related services.

Abod is entitled to amend this Privacy Policy at any time, which amendment shall be effective upon publication on the Website and shall apply to subsequent data processing.

The “GDPR” abbreviation referred to in the text refers to the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1. Name and contact information of data controller

seat: Sat Abud, comuna Ghindari, nr. 69, Județul Mureș, Romania

company registry number: J26/1756/2023

representative: Zoltán Szabó

e-mail address: zoltan@abodretreat.com

phone number: :+40 754 242 388

2. Principles of data processing

In accordance with the requirements of good faith and fairness and the applicable laws, Abod acts in cooperation with the user of the Service as the data subject (hereinafter: "Data Subject") (hereinafter Abod and Data Subject jointly: "Parties") during data processing. Abod only processes data defined by law or provided by the Data Subject, for the purposes defined below. Abod retains the data of the Data Subject only as long as it is absolutely necessary to achieve the purpose, is suitable for achieving the purpose, or as long as it is made possible or mandatory by an agreement or legal regulation.

3. The purpose and legal basis of the data processing, the scope of the processed data and the retention period

The provision and transfer of personal data is voluntary. The Data Subject can give his consent to data processing electronically by checking the "checkbox" on the Website.

In case of using the Service, the provision of personal data is necessary to perform the agreement between the Parties and to use the Services. In case of failure to provide data, the Data Subject shall not be able to use the Services, or not to their full extent.

The provision of personal data and data processing made by Abod shall serve the following purposes:

- in case of purchase on the Website, in order to identify the Data Subject and to conclude the agreement, it is necessary to provide the personal data of the Data Subject: name, email address, address, telephone number;

- in order to provide the Services by Abod and to perform the agreement, it is necessary to provide the personal data of the Data Subject: name, address, telephone number and the number of the personal identity document, date of birth;

- processing of the data of the Data Subject in order to make payments, invoicing and recovery of claims: name (invoicing name), email address, address (invoicing address), telephone number and bankcard data;

- for the purpose of establishing contact and providing information (including complaint handling), the Data Subject by providing his personal data makes his questions and requests available to Abod, and enables Abod to provide answers and information to the Data Subject at the provided contact information: name, email address, telephone number;

- in order to get newsletter, the Data Subject specifically subscribes to the Abod newsletter by providing his data as follows: name, e-mail address;

- for the compliance with additional obligations stipulated by law.

The Data Subject is solely responsible for having an appropriate legal basis for the personal data provided by the Data Subject relating to other persons. Abod excludes all liability in case of failure to do so.

3.1. Purchase and conclusion of agreement

In case of using the reservation sub-website, the Data Subject may enter his personal data and subsequently order the Service. The Data Subject is obliged to provide his personal data in order to be able to conclude an agreement with Abod and to be able to use the Service.

Purpose of data processing: Identification of the Data Subject and conclusion of the agreement

Legal basis of data processing: Freely given consent of the Data Subject (Article 6 (1) point a) of GDPR) and preparation for the conclusion of the agreement (Article 6 (1) point b) of GDPR)

Scope of processed data: Full name of the Data Subject, email address, address, telephone number

Duration of data processing: for the 5-year general limitation period, furthermore in case of freely given consent until the Data Subject's request for erasure or until erasure by Abod, if further processing of the data is not justified

3.2. Provision of Service

Abod is entitled to process the personal data provided for the purpose of using the Service in order to perform the agreement.

Purpose of data processing: Provide the Service and perform the agreement

Legal basis of data processing: performance of the agreement (Article 6 (1) point b) of GDPR)

Scope of processed data: the name, address, telephone number and the number of the personal identity document, date of birth of the Data Subject

Duration of data processing: for the 5-year general limitation period

3.3. Payment and invoicing

During the processing of payment in accordance with the agreement concluded for the use of the Service and the issuance of accounting documents required by law, the personal data of the Data Subject may also be recorded. In order to collect the Data Subject's outstanding debt to Abod, Abod may transfer the Data Subject's data necessary for claims management to a lawfully registered company that deals with the management of outstanding debts on a commercial basis. The legal basis for this data processing is the Article 6 subsection (1) point f) of the GDPR-Regulation, i.e., the enforcement of the legitimate interest of Abod.

Purpose of data processing: performance of payment and invoice issuance related to the agreement

Legal basis of data processing: data processing is necessary to perform the legal obligation of the data controller (Article 6 (1) point c) of GDPR), set forth in taxation and accounting legislation

Scope of processed data: name of the Data Subject (invoicing name), address (invoicing address), email address (for issuing electronic invoices) and bankcard data (bankcard data are not known by Abod)

Duration of data processing: for the 5-year general limitation period, also according to the governing legal provisions on accounting, and in the case of debt collection, data processing lasts until the debt is collected, or until it becomes impossible.

3.4. Notifications, contact

In case of using the " Let’s Chat " menu item of the Website or the specified contact channels, the Data Subject may enter his personal data.

By freely providing personal data, the Data Subject allows his questions and requests to reach Abod, and to receive answers and information through the contact details provided by him. Abod is entitled to process the personal data provided for the purpose of contact until the Data Subject's consent is withdrawn or for the period prescribed by law. The withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal. If further processing of the contact data is not justified, Abod shall erase it immediately.

Purpose of data processing: Informing and contacting the Data Subject

Legal basis of data processing: Free consent of the Data Subject (Article 6 (1) point a) of GDPR)

Scope of processed data: Full name, e-mail address, phone number of the Data Subject

Duration of data processing: until the Data Subject's request for erasure or until erasure by Abod, if further processing of the data is not justified, and for the time period set forth by legislation on consumer complaint.

3.5. Sending newsletters, commercial promotions

By freely providing personal data, the Data Subject allows Abod to notify the Data Subject of current Services, discounts, promotions, and other news through the contact details provided by the Data Subject. Abod is entitled to process personal data provided for the purpose of sending newsletters and commercial promotions until the consent of the Data Subject is withdrawn. The withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal. The Data Subject can unsubscribe from Abod's newsletter at any time without giving any reason.

Purpose of data processing: sending newsletters and marketing materials, personalizing advertising, redeeming coupons

Legal basis of data processing: freely given consent of the Data Subject (Article 6 (1) point a) of GDPR)

Scope of processed data: name, phone number, e-mail address of the Data Subject

Duration of data processing: until the withdrawal of the consent or request for erasure of the Data Subject, or until erasure by Abod, if further processing of the data is not justified

3.6. Statistical purposes

Abod is entitled to use - for statistical purposes – such information which does not relate to an identified or identifiable natural person, as well as personal data that has been anonymized in a way that the Data Subject cannot or can no longer be identified. Such data is used and aggregated by Abod for the preparation of statistics and for the development of the Website and the Service.

4. Data processing and data transmission

Abod uses the following data processors:

- hosting service provider of the Website:

seat: 5 Yunitsman St, Tel Aviv-Yafo, Tel Aviv, 6936025, Israel

website: https://www.wix.com/about/privacy

contact: privacy@wix.com

Adequate and appropriate safeguards to ensure the security of data transfers: the application of the standard data protection clauses adopted by the European Commission (Article 46(2)(c) GDPR) and adequacy decision (Article 45(3) GDPR).

DPA: https://www.wix.com/about/privacy-dpa-users

data processing task: hosting service, data storage

- hosting service provider of the reservation sub- website:

seat: Magma House, 16 Davy Court Way, Castle Mound Way, Rugby, Warwickshire, CV23 0UZ, United Kingdom

website: https://www.lodgify.com/

contact: press@lodgify.com

DPA: https://www.lodgify.com/dpa/

data processing task: hosting service, data storage

- payment:

seat: South San Francisco, 354 Oyster Point Blvd, USA

website: www.stripe.com

contact: https://stripe.com/en-hu/legal/privacy-center#contact-us

DPA: https://stripe.com/en-hu/legal/dpa

data processing task: online payment processing

- invoicing:

seat: Sat Abud, comuna Ghindari, nr. 69, Județul Mureș, Románia

website: -

data processing task: invoicing

- accounting:

seat: Marosszentkirály,Fő út 22.

data processing task: accounting tasks

- sending newsletter:

seat: 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA

website: www.mailchimp.com

contact: personaldatarequests@mailchimp.com

DPA: https://mailchimp.com/en/legal/data-processing-addendum/

data processing task: storage of the newsletter database and operation of the newsletter system

Abod makes the data of the Data Subject available to third parties due to an official court or police request, copyright, property or other infringement or a reasonable suspicion of such infringement, or in other cases stipulated by law or official obligation. Abod cannot be held responsible for such data transfer and the resulting consequences.

In addition, Abod does not transfer personal data to third parties. Personal data shall not be transferred to countries that do not have the adequacy decision of the European Commission, or that do not otherwise ensure adequate protection of personal data. Abod does not carry out automated decision-making or profiling in connection with data processing.

5. Rights of the Data Subject

The Data Subject has the right to request information free of charge about the processed personal data, the purpose, legal basis, duration of the data processing, the name, address (seat) of the person entitled to data controlling and data processing, and the activities related to the data processing, as well as who and how they can access the data, as well as about the rights of the Data Subject and legal remedies related to data processing.

The Data Subject may request Abod regarding personal data:

(i) access to data: shall have the right to obtain from Abod confirmation as to whether or not personal data concerning him are being processed and access to the personal data and the essential information regarding the processing.

(ii) rectification of data: the Data Subject has the right to have Abod rectify or amend inaccurate personal data concerning him without undue delay upon request,

(iii) erasure of data: the Data Subject has the right to request that Abod erase the personal data concerning the Data Subject without undue delay, and Abod is obliged to erase the personal data concerning the Data Subject without undue delay.

The data does not need to be erased if the data processing is necessary for the purposes as follows:

- exercising the right of freedom of expression and information,

- compliance with a legal obligation under EU or member state law applicable to Abod,

- for the establishment. exercise or defence of legal claims,

- for the archiving purpose in the public interest, scientific or historical research purposes or statistical purposes, if erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;

- for reasons of public interest in the area of public health;

(iv) restriction of data processing: the Data Subject shall have the right to obtain from Abod restriction of processing if - among other things - the accuracy of the personal data is contested by the Data Subject, or Abod no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defence of legal claims;

(v) can object to the processing of personal data: the Data Subject has the right to object to the processing of his personal data at any time if the data processing is based on public interest or the data processing is necessary for the purposes of the legitimate interests pursued by Abod or a third party, and

(vi) may request the release of his personal data in a machine-readable format: the Data Subject is entitled to receive the personal data provided by him in a structured, commonly used, machine-readable format, and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.

Abod shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed unless this proves impossible or involves disproportionate effort. The data controller shall inform the Data Subject about those recipients if the Data Subject requests it.

If the data processing is based on consent, the Data Subject is entitled to withdraw his consent at any time.

Abod shall provide information on action taken on a request the Data Subject without undue delay and in any event within 1 (one) month of receipt of the request. That period may be extended by 2 (two) further months where necessary, taking into account the complexity and number of the requests. Abod shall inform the Data Subject of any such extension within 1 (one) month of receipt of the request, together with the reasons for the delay. Where the Data Subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the Data Subject. If Abod does not take action on the request of the Data Subject, Abod shall inform the Data Subject without delay and at the latest within 1 (one) month of receipt of the request of the reasons for not taking action.

The Data Subject can file a complaint regarding data processing at National Supervisory Authority For Personal Data Processing of Romania (official name: Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal; address: 28-30 G-ral Gheorghe Magheru Bld. District 1, post code 010336 Bucharest, Romania; phone number: +40-318-059-211; fax: +40-318-059-602; e-mail: anspdcp@dataprotection.ro; website: https://www.dataprotection.ro/), furthermore, in case of violation of his rights, the Data Subject has the right to an effective judicial remedy.

6. Cookies

Data that are technically recorded during the operation of the Website: the data of the Data Subject's computer that is generated during the use of the Service and which is recorded by the Abod system as an automatic result of the technical processes. The data that is automatically recorded is automatically logged by the system upon entry or exit without a separate statement or action from the Data Subject. These data cannot be combined with other user personal data - except in cases made mandatory by law. Only Abod has access to the data.

In order to serve personalized content, Abod places a small data package (so-called "cookie") on the computer of the Data Subject. The purpose of the cookie is to ensure the highest possible level of operation of the given page in order to increase the user experience (e.g., quick access to previously searched text). The Data Subject can erase the cookie from his own computer or set the browser to prohibit the use of cookies.

For the most frequently used browsers, the Data Subject can access the cookie management function via the link below:

Google Chrome:

https://support.google.com/accounts/answer/32050

Internet Explorer:

https://support.microsoft.com/en-us/topic/how-to-delete-cookie-files-in-internet-explorer-bca9446f-d873-78de-77ba-d42645fa52fc

Firefox:

https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox

Safari:

https://support.apple.com/en-in/guide/safari/sfri11471/mac

By prohibiting the use of cookies, the Data Subject acknowledges that the given site does not function fully without cookies. No profiling is done on the basis of cookies.

Summary of cookies used by Abod:

Cookie name: XSRF-TOKEN

Cookie type: Essential

Purpose/function of data management by cookie: Cookie for fraud detection of calls

Duration of data processing: Session

Cookie name: hs

Cookie type: Essential

Purpose/function of data management by cookie: Security Cookie for Hive (legacy)

Duration of data processing: Session

Cookie name: svSession

Cookie type: Essential

Purpose/function of data management by cookie: Session cookie for identification

Duration of data processing: 6 months

Cookie name: SSR-caching

Cookie type: Essential

Purpose/function of data management by cookie: Performance cookie for rendering

Duration of data processing: 24 hours

Cookie name: TS*

Cookie type: Essential

Purpose/function of data management by cookie: Cookies for attack detection

Duration of data processing: Session

Cookie name: bSession

Cookie type: Essential

Purpose/function of data management by cookie: Used for system effectiveness measurement Duration of data processing: Session

Cookie name: fedops.logger.sessionId

Cookie type: Essential

Purpose/function of data management by cookie: Tracking session errors and issues (resilience) Duration of data processing: 12 months

Cookie name: _wixAB3|*

Cookie type: Essential

Purpose/function of data management by cookie: Cookie for site experiments

Duration of data processing: 6 months

Cookie name: server-session-bind

Cookie type: Essential

Purpose/function of data management by cookie:

Cookie for API protection

Duration of data processing: Session

Cookie name: client-session-bind

Cookie type: Essential

Purpose/function of data management by cookie:

Cookie for API protection

Duration of data processing: Session

Marketing & Analytics Cookies

Meta (Facebook Pixel)

Cookie Name: _fbp

Cookie Type: Marketing

Purpose: Tracks visitors across websites to deliver relevant advertisements.

Duration: 90 days

Google Ads

Cookie Name: _gcl_au

Cookie Type: Marketing

Purpose: Used by Google Ads to track conversions and optimize ad performance.

Duration: 90 days

Google Analytics

Cookie Name: _ga

Cookie Type: Analytics

Purpose: Tracks website usage and performance.

Duration: 2 years

Cookie Name: _gid

Cookie Type: Analytics

Purpose: Distinguishes users and tracks their activity.

Duration: 24 hours

Cookie Name: _gat

Cookie Type: Performance

Purpose: Limits the number of requests sent to Google Analytics.

Duration: 1 minute

Google Tag Manager

Cookie Name: _gtm

Cookie Type: Functional

Purpose: Loads scripts and other cookies for tracking and analytics.

Duration: Session

The reservation sub-website operates on the Shopify platform, the information about the related cookies can be found here.

https://www.shopify.com/legal/cookies

Abod uses the service of MailChimp for its e-mail campaigns. The list of related cookies can be viewed here:

https://mailchimp.com/legal/cookies/

7. Safety Measures

Abod takes care of the security of the processing of personal data, and also takes the technical measures that ensure that the recorded, stored and managed personal data are protected, and shall make every effort in order to prevent their destruction, unauthorized use and unauthorized change.

Abod applies specific security measures as follows:

- only persons with express authorization and who are bound by confidentiality can access personal data, the data can be seen by employees in the job positions as follows: project manager, newsletter editor, marketing assistant, system operator, system developer;

- access to personal data on computers/servers only with a username and password, in the case of data processed in electronic form, the use of a central authorization management system;

- computer system containing personal data equipped with virus protection;

- use of daily data backups and archiving to ensure the safety of digitally stored data;

- password-protected administrative interface,

- customizable authorizations for Data Subjects,

- use of software(s) to prevent Abod's computer system/servers from being easily accessed via the Internet

- password protection on computing devices,

- password change at specified intervals,

- Abod ensures that the installed systems can be restored in the event of a malfunction, as well as that a report is prepared on such errors.

Effective: from 11.02.2025

Abod Tourism Srl.