Privacy Policy

Last updated: January 30, 2026

Oak Tree Travel SRL (“we”, “us”, “our”), a Romanian limited liability company with registered office in [insert full address, e.g., Sibiu, Romania], tourism license no. 194 issued by the Romanian Ministry of Tourism, operates the website https://romania-tours.travel (the “Website” or “Service”).

We are committed to protecting your privacy and complying with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Law no. 190/2018, and other applicable Romanian data protection laws. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal data when you visit our Website, make inquiries, book tours/services, or interact with us.

By using the Service, you acknowledge that we process your personal data as described below. If you do not agree, please do not use the Website or provide us with your data.

1. Who is the Data Controller? Oak Tree Travel SRL is the data controller for the personal data we process. Contact details:

Email: office@romania-tours.travel]
Phone: +4 0740 205 877
Postal address: Sibiu, Agarbiciu, street 5, bl. 15, ap. 21

We have not appointed a Data Protection Officer (DPO) as it is not mandatory for our scale of processing, but you can contact us directly for any privacy queries.

2. What Personal Data Do We Collect? We collect the following categories of personal data:

Identification and contact data: Name, email address, telephone number, postal address (provided via booking forms, inquiries, or emails).
Booking/travel-related data: Passport/ID details, date of birth, nationality, travel preferences, special requirements (e.g., dietary, mobility), payment details (processed securely via third-party providers; we do not store full card data).
Technical/log data: IP address, browser type/version, pages visited, time/date of visit, device information (collected automatically).
Cookies and similar technologies: Usage data via cookies
Marketing/communication data: If you subscribe or consent, preferences for newsletters/offers.

We do not collect special categories of data (e.g., health, religion) unless you voluntarily provide them for travel arrangements (e.g., allergies), in which case we process them with your explicit consent or for vital interests.

3. How Do We Collect Your Data?

Directly from you (forms, emails, phone, bookings).
Automatically (cookies, server logs).
From third parties (e.g., booking platforms, partners) only with your consent or as necessary for the service.

4. Why Do We Process Your Data and on What Legal Basis? (GDPR Art. 6) We process personal data only when we have a lawful basis:

Purpose	Personal Data Categories	Legal Basis
Responding to inquiries/providing quotes	Contact, identification	Legitimate interests (Art. 6(1)(f)) or pre-contractual steps (Art. 6(1)(b))
Booking & performing tourism services (tours, accommodations, transport)	All relevant booking data	Performance of contract (Art. 6(1)(b))
Managing payments & invoicing	Payment/contact details	Legal obligation (Art. 6(1)(c)) & contract
Sending service-related communications (e.g., itinerary updates)	Contact details	Contract (Art. 6(1)(b))
Marketing/newsletters (if subscribed)	Email, preferences	Consent (Art. 6(1)(a)) – withdraw anytime
Website analytics & improvement	Log/cookie data	Legitimate interests (Art. 6(1)(f))
Compliance with legal obligations (e.g., tax, tourism reporting)	Identification/booking data	Legal obligation (Art. 6(1)(c))
Protecting rights/safety (e.g., insurance claims)	Relevant data	Legitimate interests / vital interests

5. Who Do We Share Your Data With? We share data only as necessary:

Service providers/processors (e.g., accommodation/hotels, transport companies, payment gateways, email services like Mailchimp) – bound by GDPR-compliant agreements.
Authorities if required by law (e.g., border police for tourism reporting).
Insolvency insurer or legal advisors in specific cases.

No sales of data. No transfers outside EEA unless GDPR safeguards (e.g., Standard Contractual Clauses) apply – currently none.

6. Data Retention We retain data only as long as necessary:

Contract data: Up to 3–10 years after service (legal/tax obligations).
Inquiry data: 1 year if no booking.
Marketing consent: Until withdrawal.
Logs: Up to 1–2 years for security.

Afterwards, data is anonymized or deleted.

7. Your Data Subject Rights (GDPR Chapter 3) You have the right to:

Access your data (copy).
Rectify inaccurate data.
Erase data (“right to be forgotten”) where applicable.
Restrict processing.
Object to processing (e.g., legitimate interests/marketing).
Data portability.
Withdraw consent (where consent-based) – does not affect prior processing.

Requests are free and handled within 1 month (extendable). Contact us at the details above.

8. Security of Your Data We implement appropriate technical and organizational measures (e.g., encryption, access controls) to protect data. However, no transmission/storage is 100% secure.

9. Cookies We use cookies for functionality, analytics, etc. You can manage preferences via your browser or our cookie banner.

10. Children’s Privacy Our Service is not directed at children under 16. We do not knowingly collect data from minors under 16 without parental consent (or 18 in general). If we become aware, we delete it.

11. Links to Other Sites We are not responsible for third-party privacy practices.

12. Changes to This Privacy Policy We may update this Policy. Material changes will be posted here with the new date. Continued use constitutes acceptance.

13. Complaints If unsatisfied, contact us first. You can lodge a complaint with: