Legal
Privacy Policy
Effective date: 1 January 2025. This policy explains how Carpathian Safari SRL collects, uses, and protects your personal data in line with GDPR.
1. Who we are
Carpathian Safari SRL ("we", "us", "our") is the data controller for personal data collected in connection with our hunting expeditions and website at carpathiansafari.com. We are registered under Romanian law and operate in compliance with Regulation (EU) 2016/679 (GDPR). Questions about your data can be directed to reservations@carpathiansafari.com.
2. Data we collect
We collect personal data only when necessary. This includes: identification data (full name, date of birth, nationality, passport number and expiry); contact details (email address, phone number, postal address); hunting credentials (hunting license country and number, firearm permit details); payment data (bank transfer references — we do not store card numbers); booking and expedition data (dates, package, hunter count, preferences); uploaded documents (passport scan, hunting license, firearm permit, insurance certificate); website usage data (IP address, browser type, pages visited, referral source) collected via analytics and advertising cookies with your consent.
3. How we use your data
We use your data to: process and manage your booking and expedition; verify compliance with Romanian hunting law and CITES requirements; communicate with you about your reservation, travel documents, and expedition logistics; process payments and issue invoices; apply for Romanian firearms import authorizations and CITES export permits on your behalf; comply with legal obligations including tax, anti-money-laundering, and environmental reporting; improve our services via aggregated, anonymised analytics.
4. Legal basis for processing
We process your data on the following lawful grounds: performance of a contract (your booking); compliance with a legal obligation (Romanian hunting law, CITES, tax, AML); our legitimate interests in operating a safe and lawful hunting business; your consent, where we request it (for marketing communications and non-essential cookies). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
5. Document storage and security
Identification and licensing documents you upload are encrypted at rest using AES-256 and stored in a restricted-access vault. Access is limited to the booking coordinator assigned to your expedition and, where legally required, Romanian government authorities. We do not use your documents for any purpose other than those stated in section 3. Documents are deleted within 90 days of expedition completion or booking cancellation, subject to any statutory retention requirement.
6. Who we share data with
We share your personal data only with: Romanian government authorities (Ministry of Environment, General Police Inspectorate, CITES authority) as legally required; our guide-warden teams for expedition logistics; payment processors for bank transfer verification; our technology sub-processors (hosting, email delivery, analytics) all operating under GDPR-compliant data processing agreements. We never sell your personal data or share it with third parties for their own marketing purposes.
7. International transfers
Our servers are located within the EU/EEA. If any sub-processor transfers data outside the EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions). You may request details of transfer mechanisms by contacting us.
8. Retention periods
Booking records and invoices are retained for 5 years to meet Romanian tax law requirements. Uploaded identity documents are deleted within 90 days of expedition completion. CITES and firearm import correspondence is retained for 3 years. Marketing preferences are retained until you withdraw consent. Website usage logs are retained for 13 months.
9. Your rights
Under GDPR you have the right to: access a copy of the personal data we hold about you; rectify inaccurate data; erase your data ("right to be forgotten") where no legal retention obligation applies; restrict or object to certain processing; data portability in a machine-readable format; withdraw consent at any time for consent-based processing; lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at anspdcp.ro, or with the supervisory authority in your EU country of residence.
10. Cookies
We use strictly necessary cookies for session management and authentication, and optional analytics/advertising cookies with your consent. You can manage or withdraw your cookie consent at any time via the banner on our website or by adjusting your browser settings. A full list of cookies in use is available in our Cookie Settings panel.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified by email to clients with active bookings and by a notice on our website. The current version is always available at carpathiansafari.com/privacy.
Data Controller: Carpathian Safari SRL · Brașov, Romania
Data Protection enquiries: reservations@carpathiansafari.com
Supervisory Authority: ANSPDCP (dataprotection.ro)