1. Who we are
The controller is ARKADIA INOVATION SRL, tax ID (CUI) 47935937, trade register number J2023006461402, with its registered office at Str. Munții Gurghiului nr. 38, Sector 6, București, which operates the Arkadia Apartments brand.
ARKADIA INOVATION SRL · email contact@arkadia.apartments · phone/WhatsApp +40 750 406 106.
2. What data we process and where it comes from
2.1 Availability searches
When you check availability you send the dates, the number of guests and, optionally, the area and purpose of your stay. We do not ask for your name, phone number or email address for a search.
2.2 Booking requests via WhatsApp
When you press “Request booking on WhatsApp”, the site records a request containing: the property, the dates, the number of guests, the purpose of stay (if you chose one), the page language, the page from which you sent the request, the page through which you entered the site, the address of the referring site, campaign parameters (UTM) if present, and a technical request identifier stored only as a cryptographic hash and used to avoid duplicates. WhatsApp then opens with a pre-filled message; you decide whether to send it. The site itself does not ask for your name, phone number or email address.
2.3 The WhatsApp conversation and the booking
If you write to us, we receive your WhatsApp profile name, phone number and messages. To handle your request and booking we may record in our internal booking system: your name, phone number, email address, city and country, preferred language, the stay preferences you share with us, the booked property and dates, the amounts and the related financial documents. Consent to marketing messages by email or WhatsApp is recorded separately and only if you give it.
2.4 Technical and security data
To limit abuse (for example automated mass requests), your IP address is used to limit the number of requests and is kept only as a cryptographic hash for about 24 hours. The web server keeps standard technical logs (IP address, date and time, requested page, browser) for 14 days, after which they are rotated and deleted.
2.5 Cookie preferences
Your choice is saved in your browser’s localStorage under the key arkadia_consent_v1 (the accepted categories and the date of your choice). This information is not sent to us.
2.6 Analytics and marketing, only with consent
If you accept the Analytics category we may use Google Analytics 4 through the Google tag (gtag.js), and the site keeps for the browsing session (sessionStorage) the entry page, the referring site and UTM parameters so that a booking request can be attributed correctly. If you accept the Marketing category we may use the Meta Pixel. These tools are never loaded before your consent and are loaded only if they are configured for the site. See the cookie policy.
2.7 Property photos
Property photos are served from our own servers. Loading them sends nothing to any third party. The Google map on the apartments page and on the apartments’ own pages loads only when you ask for it; only then does your browser connect to Google’s servers, which receive your IP address and the request’s technical details (see the cookie policy).
2.8 Bookings made through platforms
If you book through a platform on which the properties are listed (for example Airbnb, Booking.com, Travelminit), we receive the booking details from the platform. The platform’s own privacy policy applies to the processing it carries out.
2.9 Review request after your stay
If you booked directly with us (on the site, on WhatsApp or by phone), after check-out we may send you a message with a link to the apartment’s Google review form, and at most one reminder a few days later if your review has not yet appeared on Google. We send it on WhatsApp or by email, to the contact you used for the booking, and only to the person who made the booking; guests who booked through a platform do not get it. For this we use your first name, your contact, the apartment and your departure date. We tell you about the message in the booking confirmation, and you can refuse it at any time, free of charge, by replying “stop”; every message reminds you how. Once you refuse, you get no more messages of this kind: we keep only a note of your refusal, so that we do not write to you again. A review is optional and we offer nothing in return for it. If you write one, you publish it yourself on Google, with your Google account, and Google’s privacy policy applies to it.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Answering your booking request and preparing the booking | request details, contact details | Art. 6(1)(b) – steps taken at your request before entering into a contract / performance of the contract |
| Managing the booking and the stay | contact details, booking details | Art. 6(1)(b) |
| Accounting and tax records | billing details, amounts, documents | Art. 6(1)(c) – legal obligation |
| Website security and abuse prevention | hashed IP address, server logs | Art. 6(1)(f) – legitimate interest |
| Internal statistics on where requests come from | entry page, referrer, UTM parameters | Art. 6(1)(f) – legitimate interest; when kept in your browser for the session: consent, Art. 6(1)(a) |
| Analytics and marketing measurement | Google / Meta cookies and identifiers | Art. 6(1)(a) – consent, which you can withdraw at any time |
| Asking for a review after a direct booking’s stay | first name, the phone number or email address used for the booking, the apartment, the departure date | Art. 6(1)(f) – legitimate interest: learning what guests think and helping future guests choose; you can object at any time by replying “stop” |
| Marketing messages | phone number, email address | Art. 6(1)(a) – consent |
4. Who receives the data
We do not sell your data and we do not pass it on for other companies’ marketing. Only the following have access to it:
- Our infrastructure providers, which process the data on our behalf: hosting of the website and the database (Contabo, Germany), protection of the website (Cloudflare) and storage of backup copies (Google Ireland).
- WhatsApp (Meta), when you choose to write to us; WhatsApp’s privacy policy applies to your use of the app.
- Google and Meta, for analytics and marketing, only if you accepted those categories (see the cookie policy).
- Accountants, advisers and public authorities, where the law requires it.
Transfers outside the EEA. The website and the database are hosted in the EEA. Cloudflare, Google and Meta may also process data in the United States, under the EU–US Data Privacy Framework and, where applicable, the standard contractual clauses. The full list of providers and details of the safeguards: contact@arkadia.apartments.
5. How long we keep data
- Booking requests that do not lead to a booking: 24 months from the last contact, so that we can pick the conversation back up and understand demand by area and period.
- Confirmed bookings and the accounting documents that go with them: for the periods required by accounting and tax law.
- A note that you refused the review message: for as long as we keep the booking’s data, so that we do not write to you again.
- Backup copies: 90 days.
- Technical server logs: 14 days.
- Hashed IP address used for request limits: about 24 hours.
- Cookie preference: in your browser until you change it or clear the site data.
- Session attribution (sessionStorage): until you close the browser tab.
6. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object (including to processing based on legitimate interest). You can withdraw consent at any time, without affecting processing carried out before the withdrawal. To exercise these rights write to contact@arkadia.apartments. You may also lodge a complaint with the Romanian supervisory authority (ANSPDCP, www.dataprotection.ro).
7. Security
The site uses HTTPS. Access to the internal booking system is limited to authorised staff according to their role, and actions are logged. Documents uploaded to the internal system are scanned for malware and stored outside the public area of the server.
8. Changes
Any update to this policy will be published on this page together with its revision date.