Privacy policy

1. Who we are

The Cai Borșa website is run by ROMAN DAIANA-MĂDĂLINA ÎNTREPRINDERE INDIVIDUALĂ (a Romanian sole proprietorship), based in Borșa, Maramureș County, Romania (full identification details are shown on this page). Under Regulation (EU) 2016/679 (the “GDPR”), we are the controller of your personal data.

For any question about your data, you can contact us at madaroman55@yahoo.com or +40 757 828 173.

2. In short

• The site does not use Google Analytics, advertising pixels or any other tracking tools.
• The booking form does not send or store your data on the site. It simply writes a message that you choose to send us via WhatsApp or email.
• We only use your data to reply to you and to organise the activity you book. We don’t sell it and we don’t use it for advertising.

3. What data we process

When you ask for a quote or make a booking

Whether you use the form on the site, WhatsApp, the phone, email or messages on Facebook and Instagram, we may receive:

• your name;
• your phone number (on WhatsApp we see it automatically) or your email address;
• the activity you’d like, your preferred date and time of day;
• the number of adults and children and, if you tell us, the children’s ages;
• your riding experience and any other detail you choose to include in your message.

Please don’t send us health information in your message. If there is something important for your safety on the trail, you can tell us in person before the activity.

When you visit the site

Like any website, this one is hosted on a server. The hosting provider may automatically record, in technical logs, data such as your IP address, browser type, the page accessed and the time of access. This data is used only to keep the site running and secure. We don’t use it to identify you.

Fonts and videos are loaded from our own server, not from external services such as Google Fonts or YouTube.

4. Why we process data and on what legal basis

Purpose	Legal basis (GDPR)
Replying to your questions and sending you a quote	Art. 6(1)(b), steps taken at your request before entering into a contract
Organising the activity you booked (lesson, trail ride, carriage ride, photo session)	Art. 6(1)(b), performance of a contract
Keeping the records required by tax and accounting law, where applicable	Art. 6(1)(c), legal obligation
Keeping the site running and secure	Art. 6(1)(f), our legitimate interest

5. Children’s data

Bookings for children are made by a parent or legal guardian. We use the children’s ages only to choose the right activity and the right horse. The site is not aimed at children and does not knowingly collect data from people under 16.

6. Who we share data with

We don’t sell or rent out your data. It may reach, strictly as far as necessary:

• the communication services you choose (for example WhatsApp, provided by Meta, or your email provider). These services process data under their own privacy policies;
• the site’s hosting provider, for the technical logs described above;
• our accountant, if tax documents are issued;
• public authorities, only when the law requires us to.

Some of these services (for example WhatsApp) may transfer data outside the European Economic Area. They use the safeguards provided by the GDPR, such as standard contractual clauses or the EU–US Data Privacy Framework.

7. How long we keep data

• Conversations about a quote request are kept for as long as needed to reply and organise the activity, then for no longer than 12 months, so we can recognise you if you come back.
• Tax and accounting records, if any, are kept for the period required by law.
• The server’s technical logs are kept for the period set by the hosting provider, usually a few days or weeks.

8. Your rights

Under the GDPR, you have the right:

• to find out what data we hold about you and receive a copy (right of access);
• to have inaccurate data corrected (right to rectification);
• to have your data erased (right to be forgotten), within the limits of the law;
• to restrict processing;
• to receive your data in a structured format (right to data portability);
• to object to processing based on our legitimate interest;
• not to be subject to a decision based solely on automated processing. We make no such decisions.

To exercise any of these rights, write to us at madaroman55@yahoo.com. We will reply within one month.

If you are unhappy with how we process your data, you can lodge a complaint with the Romanian supervisory authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP): B-dul G-ral. Gheorghe Magheru nr. 28–30, sector 1, Bucharest, Romania, www.dataprotection.ro, or with the data protection authority in your own country.

9. Security

The site uses an encrypted connection (HTTPS) and does not keep databases of personal information. Only we can access our conversations with you, from protected devices.

10. Changes

We may update this policy when the way the site works or the law changes. The date of the last update is shown at the top of this page.