Palatul Parlamentului

Legal

Privacy Policy

Last updated: 7 August 2026

1. Introduction

This Privacy Policy explains how SKL PRO TRAVEL S.R.L. (“we”, “us”, or “our”) collects, uses, stores, and protects personal data when you visit palatulparlamentului.com(the “Website”), contact us, or otherwise interact with our online presence relating to English guided tours of the Palace of Parliament in Bucharest.

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — “GDPR”), Law no. 190/2018 on measures implementing the GDPR in Romania, and other applicable Romanian and EU law, including ePrivacy rules on cookies and similar technologies.

2. Data controller

The controller of your personal data is:

For privacy requests, please use the email address above (or the contact details published on the Website) and mark your message “Data protection”.

3. Scope of this Website

The Website is a presentation and information site for Palace of Parliament tours operated by SKL PRO TRAVEL S.R.L.. It does not process payments or conclude the booking contract on this domain.

When you click a booking button or similar call-to-action, you are redirected to an external booking application. Data you submit there (including payment card details) is processed by that booking partner under its own privacy notice and terms. We are not the controller of payment data collected on the partner checkout unless we expressly state otherwise at the time of booking.

4. Categories of personal data we process

Depending on how you use the Website, we may process:

  • Identity and contact data: name, email address, and any other details you include in a message (for example preferred tour date or party size) when you use the contact form, email us, or message us via phone or WhatsApp.
  • Communication content: the text of your enquiry and our correspondence with you.
  • Technical and usage data: IP address, approximate location derived from IP, browser type and version, device/OS information, referring URL, pages viewed, timestamps, and similar diagnostic data — in particular when analytics cookies are enabled with your consent.
  • Consent records: your cookie preference choice (necessary / analytics), version of the consent schema, and the time of your decision, stored in a first-party cookie so we can honour your choice.
  • Security and abuse-prevention data: limited request metadata (for example IP-derived keys) used to rate-limit the contact form and reduce spam or automated abuse.

We do not intentionally collect special categories of personal data (Art. 9 GDPR) through this Website. Please do not include sensitive information in free-text messages unless it is strictly necessary for your enquiry.

5. How we collect data

  • Directly from you: contact form fields, email, phone, or WhatsApp messages.
  • Automatically: through cookies, local storage, server logs, and (only after consent, where required) Google Analytics on eligible devices / viewports as described in our Cookie Policy.
  • From service providers: hosting and email infrastructure may generate technical logs needed to operate and secure the service.

6. Purposes and legal bases

We process personal data for the following purposes and legal bases:

  • Operating, maintaining, and securing the Website (including hosting, error handling, and abuse prevention) — Art. 6(1)(f) GDPR (legitimate interests: providing a secure, functional information site).
  • Responding to enquiries and taking steps at your request before a potential booking — Art. 6(1)(b) GDPR (pre-contractual measures) and/or Art. 6(1)(f) GDPR (legitimate interest in answering customer questions).
  • Audience measurement / analytics (Google Analytics 4), only where you have given consent — Art. 6(1)(a) GDPR. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
  • Remembering cookie preferences — necessary for compliance with ePrivacy / consent requirements and Art. 6(1)(c) and/or (f) GDPR as applicable.
  • Complying with legal obligations (for example responding to lawful requests by authorities, keeping records required by fiscal or consumer law where applicable) — Art. 6(1)(c) GDPR.
  • Establishing, exercising, or defending legal claims — Art. 6(1)(f) GDPR.

Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object to processing based on legitimate interests as described in section 11.

7. Cookies and similar technologies

We use strictly necessary cookies (including to store your consent choice) and, only with your permission, analytics technologies. Full details — including cookie names, purposes, and durations — are set out in our Cookie Policy.

8. Recipients and processors

Depending on the context, data may be disclosed to or processed by:

  • Hosting and infrastructure providers that run the Website (for example Vercel Inc. and related edge/CDN services).
  • Email / SMTP providers used to deliver contact-form notifications to our inbox.
  • Google Ireland Limited / Google LLC for Google Analytics, only if you consent to analytics.
  • External booking partners when you leave the Website to complete a reservation — under their own privacy terms for data you submit on their systems.
  • Messaging platforms(for example WhatsApp / Meta) if you choose to contact us through those channels — governed by the platform's terms and privacy policy.
  • Professional advisers (legal, accounting) and public authorities where required by law or necessary for claims.

We require processors to process personal data only on our documented instructions and to implement appropriate security measures, where GDPR applies to the relationship.

9. International transfers

Some providers (including hosting and analytics vendors) may process data in countries outside the European Economic Area (EEA). Where that occurs, we rely on appropriate safeguards recognised under GDPR Chapter V — typically the European Commission's Standard Contractual Clauses (SCCs), and where applicable an adequacy decision — together with any supplementary measures required by the provider's transfer mechanism.

Google Analytics is configured with IP anonymisation where supported. Analytics scripts are loaded only after consent and only in contexts where our consent interface applies (see Cookie Policy).

10. Retention

We keep personal data only as long as necessary for the purposes above:

  • Contact enquiries and correspondence: typically up to 24 months after the last meaningful exchange, unless a longer period is needed for an ongoing request, booking follow-up, or legal claim.
  • Cookie consent record (pp_cookie_consent): up to 12 months (cookie max-age), after which you may be asked again.
  • Analytics data:according to the retention settings configured in our Google Analytics property (and Google's product terms).
  • Server / security logs: for short operational periods needed for security, debugging, and abuse prevention, unless a longer retention is required for an incident investigation.
  • Legal / fiscal records: for the periods required by Romanian law where such records apply to us.

When retention ends, we delete or irreversibly anonymise the data, unless further storage is required by law.

11. Your rights

Under the GDPR, you may have the right to:

  • Access — obtain confirmation whether we process your data and receive a copy (Art. 15).
  • Rectification — correct inaccurate or incomplete data (Art. 16).
  • Erasure(“right to be forgotten”) where applicable (Art. 17).
  • Restriction of processing in the cases set out in Art. 18.
  • Data portability for data you provided, where processing is based on consent or contract and carried out by automated means (Art. 20).
  • Object to processing based on legitimate interests, including profiling related to such processing (Art. 21).
  • Withdraw consent at any time where processing is based on consent (Art. 7(3)), without affecting prior lawful processing.
  • Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Art. 22) — we do not carry out such decision-making on this Website.

To exercise these rights, contact us using the details in section 2. We may need to verify your identity before responding. We will reply within the time limits set by GDPR (generally one month, extendable in complex cases).

12. Complaints

If you believe your data protection rights have been infringed, you may lodge a complaint with the Romanian supervisory authority:

  • Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
  • Website: www.dataprotection.ro

You may also contact the consumer protection authority (ANPC) for consumer matters unrelated to data protection, and use available alternative dispute resolution channels where applicable. You also have the right to seek a judicial remedy.

13. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. These include HTTPS transport, access controls for administrative systems, and rate-limiting on the contact form. No method of transmission or storage is completely secure; if we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will act as required by GDPR Articles 33–34.

14. Children

The Website is intended for adults arranging travel and tour bookings. We do not knowingly collect personal data from children through this presentation site. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

15. Links to third-party sites

The Website may link to third-party websites, maps, review platforms, or booking applications. We are not responsible for the privacy practices of those sites. Please review their policies before submitting personal data.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The “Last updated” date at the top will be revised when we do. Where required by law, we will take additional steps to inform you of material changes. We encourage you to review this page periodically.

17. Related documents

Please also read our Cookie Policy and Terms & Conditions.