Draupnir Adventures

Privacy Policy

Last updated: 2026-09-14

1. Introduction

This Privacy Policy explains how VWV REDCLOUD SRL (hereinafter the “Operator” or “we”) collects, uses, stores and protects the personal data of users of the website www.draupnir-adventures.ro (the “Site”), of clients and of other persons with whom we come into contact, in accordance with Regulation (EU) 2016/679 (GDPR), Law no. 190/2018 on measures implementing the GDPR, and the related applicable Romanian legislation. For further technical and procedural details, please also see the Personal Data Protection chapter of this document.

2. INFORMATION ABOUT THE OPERATOR

The Site is operated by:

  • Company name: VWV REDCLOUD SRL
  • Registered office: Aleea Carpați, nr. 37, Ap. 41, Târgu Mureș, Mureș County
  • Trade Register registration number: J16/1056/2017
  • Unique Registration Code (CUI): 37739453
  • Contact e-mail: adventure@draupnir.ro
  • Phone: 0746.271.311
  • (hereinafter referred to as the “Operator” or “we”)

3. WHAT DATA WE COLLECT

3.1. Data you provide directly

  • through the booking/contact form: first and last name, e-mail address, phone number, desired date, number of participants, content of the message;
  • through direct correspondence (e-mail, phone): the data necessary to identify you and to process the booking request.

3.2. Data collected automatically

When browsing the Site, the following may be collected automatically through cookies and similar technologies (detailed in the Cookie Policy): IP address; device type, browser and operating system; pages visited, time spent on the Site, traffic source; interaction data collected through analytics/marketing tools (for example Google Analytics, Meta/Facebook Pixel).

3.3. Special categories of data — the health declaration

The Operator does not request or process, through the Site, special categories of personal data (for example data concerning health, ethnic origin, religious beliefs). The declaration regarding state of health/fitness to participate in the route (according to section 12.4 of the Terms and Conditions) may constitute a special category of data and is collected directly by the Organizing Partner, not through the Site, exclusively on the basis of your explicit consent and for the purpose of ensuring the safety of the route (Art. 9(2)(a) GDPR); for this specific processing, the Organizing Partner acts as a separate data controller. Please do not include such information in messages sent through the form on the Site.

4. SOURCES OF DATA

Your personal data usually come directly from you (through the form on the Site, by e-mail or by phone). Exceptionally, we may also receive data from the assigned Organizing Partner, to the extent necessary to process the booking request (for example the confirmation or modification of a booking).

5. PURPOSES AND LEGAL BASES OF PROCESSING

Purpose - Legal basis

  • Responding to requests submitted through the form on the Site - Consent / pre-contractual steps at the request of the data subject (Art. 6(1)(a) and (b) GDPR)
  • Receiving and assigning the booking request to the Organizing Partner - Pre-contractual steps at the request of the data subject (Art. 6(1)(b) GDPR)
  • Communicating the identity of the assigned Organizing Partner to the Client - Legal obligation (Art. 6(1)(c) GDPR, in conjunction with GEO 34/2014)
  • Processing the online deposit payment (transaction identifier and status; the Operator does not see or store card details) - Performance of the contract / pre-contractual steps (Art. 6(1)(b) GDPR)
  • Photographs/video recordings taken during the route, used for marketing purposes - Consent (Art. 6(1)(a) GDPR), revocable at any time
  • Handling complaints relating to the Site - Performance of the contract / legal obligation (Art. 6(1)(b) and (c) GDPR)
  • Traffic analysis and improvement of the Site (analytics cookies) - Consent (Art. 6(1)(a) GDPR)
  • Marketing and remarketing (e.g. Facebook Pixel, targeted ads) - Consent (Art. 6(1)(a) GDPR)
  • Defending rights/legitimate interests (e.g. litigation) - Legitimate interest (Art. 6(1)(f) GDPR)
  • Fraud prevention and ensuring the security of the Site - Legitimate interest (Art. 6(1)(f) GDPR)

6. RECIPIENTS OF THE DATA

Your data may be disclosed to the Operator's processors, to the extent necessary to provide the Site's service, including:

  • the Stripe payment processor – for processing the deposit paid online; the payment is directed to the own account of the assigned Organizing Partner, and the Operator does not see or store card details;
  • VWV REDCLOUD SRL – hosting of the Site and the database, provided through the Operator's own technical infrastructure (VWV REDCLOUD SRL) — this therefore does not involve transferring the data to a third party distinct from the Operator;
  • Google Analytics – exclusively on the basis of your consent to statistics cookies;
  • Meta Platforms (the Meta/Facebook Pixel module) – exclusively on the basis of your consent to marketing cookies;
  • the assigned Organizing Partner, when your booking request is directed to it, for the purpose of confirming and carrying out the booking;
  • Public authorities, where required by law (for example tax authorities, judicial authorities).

The Operator does not sell or rent your personal data to third parties for their own commercial purposes.

Clarification regarding the status of the Organizing Partner: to the extent that the assigned Organizing Partner processes your booking data and, where applicable, health data (section 3.3) for its own purposes and in its own interest, in order to perform its own contract with you, it acts as a separate data controller and not as a processor of the Operator. Clarification regarding international transfers: Stripe, Google Analytics and Meta Platforms may involve the transfer of certain data to the United States of America; any such transfer is carried out in compliance with the safeguards provided by the GDPR (Standard Contractual Clauses and/or the provider's adherence to the Data Privacy Framework, as applicable).

7. RETENTION PERIOD

Data category - Retention period

  • Data from the contact/booking form (without a completed transaction) - Maximum 1 year from the last contact
  • Data on confirmed bookings, transmitted to the Organizing Partner - For the period necessary to carry out the booking, and thereafter in accordance with the Organizing Partner's own policy
  • Data on the deposit payment (transaction identifier) - The transaction identifier is kept by the Operator for the period necessary to reconcile payments with the Stripe processor; the related tax documents are kept by the Organizing Partner in accordance with the statutory financial and accounting archiving periods applicable to it, usually 5-10 years
  • Photographs/recordings used with consent for marketing purposes - Until consent is withdrawn
  • Data collected through cookies - According to the specific duration of each type of cookie, as indicated in the Cookie Policy
  • Data on complaints - For the duration of the resolution and thereafter for the statutory limitation period

8. DATA SECURITY

The Operator implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction or accidental disclosure, including: access control to systems, regular updating of security solutions, and limiting access to data to staff/partners who need it to perform their tasks. Further details on security measures and the incident notification procedure are available in the Personal Data Protection chapter.

9. RIGHTS OF THE DATA SUBJECT

Under the GDPR, you have the right to: request access to your personal data; request the rectification of inaccurate or incomplete data; request the erasure of data (the “right to be forgotten”), within the limits of the law; request the restriction of processing; object to processing, including for direct marketing purposes; request data portability; withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal; lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro; and the right to apply to the competent courts.

To exercise these rights, you can contact us at the e-mail address adventure@draupnir.ro The detailed procedure for exercising these rights is described in the Personal Data Protection chapter.

10. DATA OF MINORS

The Site is intended for persons with full legal capacity. The Operator does not knowingly collect personal data of minors through the Site. According to section 12.2 of the Terms and Conditions, minors may participate in routes only as passengers of an adult, and the written consent of the parent/legal guardian is collected directly by the Organizing Partner, not through the Site. If you become aware that a minor has provided us with personal data through the Site, please contact us so that we can take the necessary measures.

11. CHANGES TO THE POLICY

This Privacy Policy may be updated periodically to reflect changes in legislation or in the Operator's practices. We recommend that you check this page periodically to stay informed of any changes. The date of the last update is indicated at the beginning of the document.

12. CONTACT

For any questions regarding the processing of your personal data, you can contact us at the e-mail address adventure@draupnir.ro or by phone at 0746.271.311.