Privacy Policy (GDPR) – Timișoara City Tours

Last updated: 29 October 2026

This policy explains which personal data we collect when you visit www.timisoaracitytours.com or book a tour, why we use it and what rights you have under the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. Data controller

CODRE DAN-MARIAN ÎNTREPRINDERE INDIVIDUALĂ (Timișoara City Tours), CUI 44452717, Str. Alba Iulia nr. 7, Timișoara 300077, Romania. For any question about your data: office@timisoaracitytours.com.

2. What data we collect

Booking data: name, e-mail address, phone number, country, the tour, date, time, language, number of participants, pickup address (if you give one), amounts paid and refunded, the booking and payment reference.
Payment data: card payments are made on NETOPIA Payments’ secure page. We receive only the result of the payment and its reference, never your card number.
Messages: what you write to us by e-mail or WhatsApp, including cancellation requests.
Usage data: technical data such as IP address, browser and pages visited, kept by our hosting provider for security, and – only if you accept analytics cookies – statistics collected by Google Analytics.

3. Why we use it and on what legal basis

To provide the tour you booked: confirmation e-mails, organising the guide and meeting point, contacting you about changes (Art. 6(1)(b) GDPR – performance of a contract).
To process payments, cancellations and refunds (Art. 6(1)(b) GDPR).
To keep accounting and tax records (Art. 6(1)(c) GDPR – legal obligation).
To keep the Website secure and handle complaints (Art. 6(1)(f) GDPR – legitimate interest).
To measure how the Website is used, only with your consent given in the cookie banner (Art. 6(1)(a) GDPR). You can withdraw it at any time.

We do not sell your data and we do not send newsletters or advertising without your separate consent.

4. Who receives your data

Our guides, only the details needed to run your tour.
NETOPIA Payments, which processes card payments and refunds.
Our website hosting and e-mail providers, which store the Website and deliver our e-mails.
Google Ireland Ltd. (Google Analytics), only if you accept analytics cookies; data may be transferred to the USA under the EU–US Data Privacy Framework.
Public authorities, only when the law requires it.

5. How long we keep it

Booking and payment records: for as long as Romanian accounting law requires (currently up to 10 years).
Messages and cancellation requests: up to 3 years after your tour, to handle possible complaints.
Unfinished bookings (payment not completed): up to 12 months.
Analytics data: at most 14 months.

6. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability and to withdraw your consent at any time. Write to office@timisoaracitytours.com; we answer within one month. You also have the right to complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or to the authority in your country.

7. Security

The Website uses an encrypted connection (HTTPS), payments are handled only by NETOPIA Payments, and access to booking data is limited to the people who need it.

8. Children

Bookings must be made by an adult. We do not knowingly collect data from children under 16.

9. Changes

We may update this policy; the date at the top shows the latest version. If the language versions differ, the Romanian version prevails.