Privacy Policy – Max International

1. Who we are

This Privacy Policy explains how SC MAX INT RO SRL
(“Max International”, “we”) processes the personal data of clients, visitors and users of the website.
- Registered office: Str. Brândușelor nr. 32, Râșnov, Brașov County, Romania
- Email: receptie@maxinternational.ro
- Reception phone: +40 371 235 352
We process data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national legislation.

2. What data we collect

We only collect the data you provide to us or that is generated automatically when you use our website and services, as applicable:
- Identification and contact data
– first name, last name;
– email address;
– phone number;
– postal address (for invoicing or correspondence).
- Data required for bookings and orders
– accommodation details (dates, room type, number of guests etc.);
– restaurant/club/terrace reservations;
– Spa & Fitness bookings;
– event tickets;
– special preferences (e.g. allergies, event-related requirements).
- Invoicing and payment data
– company name, tax registration number, address;
– tax details required in order to issue the invoice;
– transaction information (amount, payment method).
Online payments are handled by authorised payment processors; we do not store full card details.
- Technical / usage data
– IP address, browser type, operating system;
– pages visited, actions on the website, session duration;
– online identifiers and cookies (see the Cookie Policy).
- Data for communication and marketing
– communication preferences;
– responses to campaigns or surveys;
– history of your interactions with our newsletters or messages.

We do not intentionally request or process special categories of data (e.g. data on health, orientation, beliefs), except where you voluntarily choose to share certain information with us (e.g. food allergies for the restaurant).

3. Purposes and legal bases for processing

We process your data for the following purposes, on one or more legal bases:
- Bookings and provision of services
– room bookings through our reservation system (5StarDesk);
– table reservations (restaurant, club, terrace) through Wix Table Reservations;
– Spa & Fitness services through Wix Bookings;
– online orders – food, packages, memberships, vouchers – through Wix Restaurants Orders / Wix Stores;
– event tickets through Wix Events & Tickets.
Legal basis: performance of a contract or steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
- Invoicing and legal obligations
– issuing invoices, accounting records;
– compliance with tax legislation and other legal obligations.
Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
- Communication with you
– replying to enquiries sent through the contact forms, by email, phone or WhatsApp;
– updates on bookings, schedule changes, event access etc.
Legal basis: our legitimate interest in responding to enquiries and in ensuring that our services run smoothly (Art. 6(1)(f) GDPR) or, where applicable, performance of the contract.
- Marketing and commercial communications
– sending newsletters, offers, event invitations and information about our services and packages;
– remarketing campaigns on platforms such as Google, Meta (Facebook/Instagram) etc.
Legal basis: your consent (Art. 6(1)(a) GDPR).
You may withdraw your consent at any time, using the unsubscribe link in our emails or by contacting us.
- Analytics, statistics and website improvement
– analysing how the website and our services are used,
– measuring the performance of marketing campaigns,
– optimising content and the user experience.
For example, we use:
– Google Analytics 4 (GA4);
– Twipla Analytics (or similar services).
Legal basis: consent (for analytics cookies) and legitimate interest (aggregated analysis, without direct identification) – Art. 6(1)(a) and (f) GDPR.
- Protecting our rights and security
– preventing and detecting fraud;
– managing security incidents;
– establishing, exercising or defending legal claims.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Providing the data marked as mandatory in the booking forms is necessary in order to enter into or perform the contract — without it we cannot process your booking; all other fields are optional.

We do not take decisions based solely on automated processing that produce legal effects concerning you.

4. Where we obtain the data from

Data is mainly collected:
- directly from you, through:
– bookings and forms on the website;
– correspondence by email / phone / WhatsApp;
– your interaction with reception, the restaurant, the club, the spa and our events;
- automatically, through cookies and similar technologies when you use the website
(see the Cookie Policy for details).

5. Who we may share the data with

We do not sell or rent your data to third parties.
We may pass certain data to:

Partners who provide the services you request. When you request a service operated by one of our partners — a transfer or car rental, a guided tour, ATV riding or horse riding — we pass that partner only the data needed to provide that service. The partner becomes an independent controller for the data it receives and confirms availability, price and terms with you directly. For transfers and car rental our partner is ROJU TRAVEL COMPANY S.R.L. (trading as “Jacob Auto Rent”), VAT no. RO 43064369, J40/11819/2020, with its registered office at Str. Argentina nr. 25, Bucharest. The processing it carries out is described in its own privacy policy, at jacobautorent.ro/protectia-datelor.

For ATV & Buggy experiences, our partner is RAW VIBE S.R.L., CUI 46478861, J08/2205/2022, with its registered office at Str. Branului nr. 80, Tohanul Nou, Brașov County. We pass on your name and phone number, together with the date, time, number of people and vehicle type, so that they can confirm availability. At the meeting point the partner asks you directly for your ID and driving licence, for the rental contract you sign with them — that data does not pass through MAX International and never reaches us.

For horse-riding experiences and carriage rides, our partner is Centrul de Echitație Diana, in Râșnov, strada Cheia. We pass on your name and phone number, together with the date, time and number of people, so that they can confirm availability — riding bookings are confirmed manually, not automatically. If you book for children, we also pass on the participants’ ages. For safety, the partner may ask for further details about a participant’s age, experience or weight; you give those directly to them, on site.

Suppliers who help us operate. We use 5StarDesk to manage accommodation bookings, Brevo (Sendinblue SAS, France) to send confirmation emails, Wix.com Ltd. for the website, forms and payment processing (Wix Payments), and Google / Twipla for traffic analytics. They process the data solely on our instructions, as processors, under the data processing agreements concluded with them.

Public authorities, where the law requires us to.

We do not sell your data and we do not use it for anything other than the purposes set out above.

Transfers outside the European Economic Area. Some suppliers (for example Google or Meta) may process data on servers outside the EEA, in particular in the United States. Such transfers take place only with the safeguards required by the GDPR: the adequacy decision for the EU-US Data Privacy Framework or, where that does not apply, the standard contractual clauses approved by the European Commission.

Embedded third-party content. The car rental page includes a booking module provided by Rentsyst, through our mobility partner. The module is loaded directly from Rentsyst's servers and works independently of our site: if you make a booking through it, the data you enter goes to Rentsyst and to the partner, not to MAX International, and we have no access to it and do not store it. Rentsyst may set its own cookies. Processing carried out through this module is governed by the privacy policies of Rentsyst and of the partner.

Separately from this module, you can also book a car through MAX International — on our website, on WhatsApp or through a digital assistant that uses our services. In that case we send the partner, via the Rentsyst platform, your name, email address, phone number, the rental period and the car you chose, solely to make the booking. We do not keep this data after sending it. You sign the rental contract directly with the partner, who processes the data as an independent controller under its own privacy policy.

Transport partner links. On our website, in the “How to reach MAX” section, some transport links (for example Omio, for trains, buses and flights) belong to our partners. When you open such a link, the partner and its affiliate platform may record the click (for example through cookies on their website) so that they can pay us a commission if you book. We do not send them your data; we only receive a report with the number of bookings and the commission. What happens on their website is covered by their privacy policy. The price for you is the same.

6. Cookies and similar technologies

This site uses cookies and similar technologies for:
- the basic operation of the site;
- remembering your preferences (for example, language);
- traffic analytics (GA4, Twipla);
- marketing (where applicable).
Full details of the cookie types, how long they last and how you can manage your preferences are set out in our Cookie Policy.

7. Data retention periods

We keep data only for as long as it is needed for the purposes it was collected for, or for as long as the law requires. For example:
- billing data: in line with tax legislation (usually 5–10 years);
- booking data: for the duration of the contractual relationship + the statutory limitation period;
- data used for newsletters/marketing: until consent is withdrawn or an objection is raised;
- technical analytics data: in line with the Google Analytics 4 / Twipla settings (limited, configurable periods).
Once these periods expire, the data is deleted or anonymised.

Applicants (Careers page). If you apply for a position through the form on the Careers page, we process the data in your application — identification, contact details, professional experience and any other information you choose to include in your CV or message — in order to assess your application. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). We keep applications for no more than 6 months after the selection process ends, then delete them; if we would like to consider you for future positions, we ask for your consent separately. We do not pass applications on to third parties.

8. Your rights

As a data subject, you have the following rights:
- The right to be informed – to know what data we process and under what conditions;
- The right of access – to receive a copy of the data we hold about you;
- The right to rectification – to ask us to correct inaccurate data or complete incomplete data;
- The right to erasure (the “right to be forgotten”), in certain situations;
- The right to restriction of processing;
- The right to data portability, where applicable;
- The right to object to processing, including for direct marketing;
- The right to withdraw your consent at any time, where processing is based on consent;
- The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).
To exercise these rights, you can contact us at:
receptie@maxinternational.ro or through the contact details on the Contact page.

We will reply as soon as possible, within the time limits laid down by the GDPR.

9. Data security

We have implemented appropriate technical and organisational measures to protect personal data against:
- unauthorised access or processing;
- accidental loss, destruction or damage.
Although we do everything we can to protect the data, no transmission of information over the internet is 100% secure.

10. Updates to this policy

We may update this Privacy Policy from time to time, for example when:
- we change the services or technologies we use;
- legislative changes occur;
- we adapt our internal processes.
We will publish each updated version here, together with its date. For significant changes we will inform you by reasonable means (for example, a notice on the website).

11. Contact details

For any questions about the processing of your personal data or about this Policy, you can contact us at:

SC MAX INT RO SRL – Max International
Str. Brândușelor nr. 32
Râșnov, Brașov County, Romania
Email: receptie@maxinternational.ro
Reception phone: +40 371 235 352

12. The MAX International app (Android and iOS)

The MAX International app is developed by SC MAX INT RO SRL, and the same rules as in the chapters above apply to it. In addition, the app processes the following data:
- Your account: your name, email address and, if you provide it, your phone number — so you can sign in, see your booking and receive your room access code. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- The arrival registration form: the data required by law for the registration of tourists (name, date and place of birth, citizenship, type, series and number of the ID document, personal numeric code for Romanian citizens, address; for citizens of non-EU countries also sex, document expiry date and date of entry into the country). We send it to our booking system (5StarDesk) and, where the law requires it, to the competent authorities (for example the General Inspectorate for Immigration). Legal basis: legal obligation (Art. 6(1)(c) GDPR).
- Your phone's camera: used only if you choose to scan your ID document to fill in the form faster. The photo is read directly on the phone, is not sent anywhere and is not kept — not by us, not by anyone else. Only the form fields remain, which you check before sending.
- Your consent to receive WhatsApp messages, if you give it; you can withdraw it at any time.
- Partner links: in the guide, some transport links (for example Omio) belong to our partners. When you open such a link, the partner and its affiliate platform may record the click (for example through cookies on their website) so that they can pay us a commission if you book. The app does not send them your data; what happens on their website is covered by their privacy policy. The price for you is the same.
The app contains no ads, does not use location data, and does not sell or share your data for marketing purposes.
Deleting your account: in the app, on the Account screen → “Delete account”; or, without the app, by writing to receptie@maxinternational.ro with the subject “Account deletion”, from your account's email address. We delete the account and its associated data within 30 days at most. Arrival forms already submitted are kept for the period required by the legislation on the registration of tourists, then deleted.
Last updated: 19 October 2026.