This Privacy Policy explains how SC MAX INT RO SRL
(“Max International”, “we”) processes the personal data of clients, visitors and users of the website.

• Registered office: Str. Brândușelor nr. 32, Râșnov, Brașov County, Romania

• Email: office@maxinternational.ro

• Reception phone: (+40) 368 435 012 / (+40) 757 165 458

We process data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national legislation.

We only collect the data you provide to us or that is generated automatically when you use our website and services, as applicable:

1. Identification and contact data

   • first name, last name;

   • email address;

   • phone number;

   • postal address (for invoicing or correspondence).

2. Data required for bookings and orders

   • accommodation details (dates, room type, number of guests etc.);

   • restaurant/club/terrace reservations;

   • Spa & Fitness bookings;

   • event tickets;

   • special preferences (e.g. allergies, event-related requirements).

3. Invoicing and payment data

   • company name, tax registration number, address;

   • tax details required in order to issue the invoice;

   • transaction information (amount, payment method).
     Online payments are handled by authorised payment processors; we do not store full card details.

4. Technical / usage data

   • IP address, browser type, operating system;

   • pages visited, actions on the website, session duration;

   • online identifiers and cookies (see the Cookie Policy).

5. Data for communication and marketing

   • communication preferences;

   • responses to campaigns or surveys;

   • history of your interactions with our newsletters or messages.

We do not intentionally request or process special categories of data (e.g. data on health, orientation, beliefs), except where you voluntarily choose to share certain information with us (e.g. food allergies for the restaurant).

We process your data for the following purposes, on one or more legal bases:

1. Bookings and provision of services

   • room bookings through our reservation system (5StarDesk);

   • table reservations (restaurant, club, terrace) through Wix Table Reservations;

   • Spa & Fitness services through Wix Bookings;

   • online orders – food, packages, memberships, vouchers – through Wix Restaurants Orders / Wix Stores;

   • event tickets through Wix Events & Tickets.

   Legal basis: performance of a contract or steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

2. Invoicing and legal obligations

   • issuing invoices, accounting records;

   • compliance with tax legislation and other legal obligations.

   Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

3. Communication with you

   • replying to enquiries sent through the contact forms, by email, phone or WhatsApp;

   • updates on bookings, schedule changes, event access etc.

   Legal basis: our legitimate interest in responding to enquiries and in ensuring that our services run smoothly (Art. 6(1)(f) GDPR) or, where applicable, performance of the contract.

4. Marketing and commercial communications

   • sending newsletters, offers, event invitations and information about our services and packages;

   • remarketing campaigns on platforms such as Google, Meta (Facebook/Instagram) etc.

   Legal basis: your consent (Art. 6(1)(a) GDPR).
   You may withdraw your consent at any time, using the unsubscribe link in our emails or by contacting us.

5. Analytics, statistics and website improvement

   • analysing how the website and our services are used,

   • measuring the performance of marketing campaigns,

   • optimising content and the user experience.

   For example, we use:

   • Google Analytics 4 (GA4);

   • Twipla Analytics (or similar services).

   Legal basis: consent (for analytics cookies) and legitimate interest (aggregated analysis, without direct identification) – Art. 6(1)(a) and (f) GDPR.

6. Protecting our rights and security

   • preventing and detecting fraud;

   • managing security incidents;

   • establishing, exercising or defending legal claims.

   Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Providing the data marked as mandatory in the booking forms is necessary in order to enter into or perform the contract — without it we cannot process your booking; all other fields are optional.

We do not take decisions based solely on automated processing that produce legal effects concerning you.

Data is mainly collected:

• directly from you, through:

  • bookings and forms on the website;

  • correspondence by email / phone / WhatsApp;

  • your interaction with reception, the restaurant, the club, the spa and our events;

• automatically, through cookies and similar technologies when you use the website
  (see the Cookie Policy for details).

We do not sell or rent your data to third parties.
We may pass certain data to:

Partners who provide the services you request. When you request a service operated by one of our partners — a transfer or car rental, a guided tour, ATV riding or horse riding — we pass that partner only the data needed to provide that service. The partner becomes an independent controller for the data it receives and confirms availability, price and terms with you directly. For transfers and car rental our partner is ROJU TRAVEL COMPANY S.R.L. (trading as “Jacob Auto Rent”), VAT no. RO 43064369, J40/11819/2020, with its registered office at Str. Argentina nr. 25, Bucharest. The processing it carries out is described in its own privacy policy, at jacobautorent.ro/protectia-datelor.

For ATV & Buggy experiences, our partner is RAW VIBE S.R.L., CUI 46478861, J08/2205/2022, with its registered office at Str. Branului nr. 80, Tohanul Nou, Brașov County. We pass on your name and phone number, together with the date, time, number of people and vehicle type, so that they can confirm availability. At the meeting point the partner asks you directly for your ID and driving licence, for the rental contract you sign with them — that data does not pass through MAX International and never reaches us.

For horse-riding experiences and carriage rides, our partner is Centrul de Echitație Diana, in Râșnov, strada Cheia. We pass on your name and phone number, together with the date, time and number of people, so that they can confirm availability — riding bookings are confirmed manually, not automatically. If you book for children, we also pass on the participants’ ages. For safety, the partner may ask for further details about a participant’s age, experience or weight; you give those directly to them, on site.

Suppliers who help us operate. We use 5StarDesk to manage accommodation bookings, Brevo (Sendinblue SAS, France) to send confirmation emails, Wix.com Ltd. for the website, forms and payment processing (Wix Payments), and Google / Twipla for traffic analytics. They process the data solely on our instructions, as processors, under the data processing agreements concluded with them.

Public authorities, where the law requires us to.

We do not sell your data and we do not use it for anything other than the purposes set out above.

Transfers outside the European Economic Area. Some suppliers (for example Google or Meta) may process data on servers outside the EEA, in particular in the United States. Such transfers take place only with the safeguards required by the GDPR: the adequacy decision for the EU-US Data Privacy Framework or, where that does not apply, the standard contractual clauses approved by the European Commission.

Embedded third-party content. The car rental page includes a booking module provided by Rentsyst, through our mobility partner. The module is loaded directly from Rentsyst's servers and works independently of our site: if you make a booking through it, the data you enter goes to Rentsyst and to the partner, not to MAX International, and we have no access to it and do not store it. Rentsyst may set its own cookies. Processing carried out through this module is governed by the privacy policies of Rentsyst and of the partner.

This site uses cookies and similar technologies for:

• the basic operation of the site;

• remembering your preferences (for example, language);

• traffic analytics (GA4, Twipla);

• marketing (where applicable).

Full details of the cookie types, how long they last and how you can manage your preferences are set out in our Cookie Policy.

We keep data only for as long as it is needed for the purposes it was collected for, or for as long as the law requires. For example:

• billing data: in line with tax legislation (usually 5–10 years);

• booking data: for the duration of the contractual relationship + the statutory limitation period;

• data used for newsletters/marketing: until consent is withdrawn or an objection is raised;

• technical analytics data: in line with the Google Analytics 4 / Twipla settings (limited, configurable periods).

Once these periods expire, the data is deleted or anonymised.

Applicants (Careers page). If you apply for a position through the form on the Careers page, we process the data in your application — identification, contact details, professional experience and any other information you choose to include in your CV or message — in order to assess your application. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). We keep applications for no more than 6 months after the selection process ends, then delete them; if we would like to consider you for future positions, we ask for your consent separately. We do not pass applications on to third parties.

As a data subject, you have the following rights:

• The right to be informed – to know what data we process and under what conditions;

• The right of access – to receive a copy of the data we hold about you;

• The right to rectification – to ask us to correct inaccurate data or complete incomplete data;

• The right to erasure (the “right to be forgotten”), in certain situations;

• The right to restriction of processing;

• The right to data portability, where applicable;

• The right to object to processing, including for direct marketing;

• The right to withdraw your consent at any time, where processing is based on consent;

• The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

To exercise these rights, you can contact us at:
office@maxinternational.ro or through the contact details on the Contact page.

We will reply as soon as possible, within the time limits laid down by the GDPR.

We have implemented appropriate technical and organisational measures to protect personal data against:

• unauthorised access or processing;

• accidental loss, destruction or damage.

Although we do everything we can to protect the data, no transmission of information over the internet is 100% secure.

We may update this Privacy Policy from time to time, for example when:

• we change the services or technologies we use;

• legislative changes occur;

• we adapt our internal processes.

We will publish each updated version here, together with its date. For significant changes we will inform you by reasonable means (for example, a notice on the website).

For any questions about the processing of your personal data or about this Policy, you can contact us at:

SC MAX INT RO SRL – Max International
Str. Brândușelor nr. 32
Râșnov, Brașov County, Romania
Email: office@maxinternational.ro
Reception phone: (+40) 368 435 012 / (+40) 757 165 458