We use your personal data to understand how our visitors engage with our website and for marketing purposes. Ultimately, this allows us to publish the information that you read on our site.

These are the main reasons why we collect and use data about our visitors:

• To show you information that is relevant to you and to improve your experience on our site
• To provide the services you ask  for, such as bookings for the manor
• To carry out marketing analysis and send you communications when we have your permission or when permitted by law
• To enable us to show advertising on our site.

We think carefully about our use of personal data and below you can find the details of what we do to protect your privacy. This policy covers, among other topics:

• Information about your rights and our obligations
• Clarity about our dealings with you and transparency about how we collect and use your personal data
• Commitments on how we protect your personal data
• Commitments on how we will facilitate your rights and respond to your questions.

We will continue to examine how we can provide more clarity to our visitors about our use of data.

About this privacy policy
This privacy policy explains how we collect, use, share and transfer your personal data when you use the services provided on www.highlightpr.ro (“our site”).

Personal data is any information about you by which you can be identified. This can include information such as:

• your name, email address, phone number, mobile number;
• information about your device (such as the IP address, which is a numerical code to identify your device that can provide information about the country, region or city where you are based); and
• information relating to your personal circumstances and how you use our site.

Sometimes our site may contain links to third party sites and services. These sites and services have their own privacy policies. If you follow a link to a third party, you should read the privacy policy shown on their site.

Who we are and how to contact us
The data controller for our site is SC Highlight Public Relations SRL, 14, Bihorului Street, Sibiu. This means that we are responsible for deciding how and why we hold and use your personal data. If you want to contact us, you can find our contact details in the “How to contact us” section below.

What personal data we collect and how we use it
We collect personal data when you fill in a booking request form and when you browse our site. This information is used to provide information about our manor and events, display advertising and analyse how visitors use our site.

The personal data we collect when you fill in a booking request form or the general contact form
When you fill in a booking request form or the form in the contact page on www.highlightpr.ro we collect:

• your name;
• your email address;
• your phone number.

When you use our site we may also use cookies or similar technology to collect extra data, including:

• your IP address – a numerical code to identify your device and which can provide information about the country, region or city where you are based;
• your browsing history of the content you have visited on our site, including information on how you were referred to our site via another website; and
• details of your devices, for example, the unique device ID, unique advertising ID and browsers used to access our content.

We will not collect special categories of data – such as information about your race, political opinions, religion, health or sexual orientation – unless you have chosen to provide that information to us.

How we collect personal data
We collect personal data when you:

• use mobile devices to access our content;
• access our site, through cookies and other similar technology; and
• when you contact us via email, social media or similar technologies or when you mention us on social media.

Why we use your personal data
We use personal data collected through our site for a number of purposes, including the following:

• To send you information about our association and events.
• To carry out marketing analysis, for example we look at what you have viewed on our site and what information you have requested to better understand what your interests and preferences are, and to improve our marketing by making it more relevant to your interests and preferences.
• To sell advertising space on our site.
• For statistical purposes such as analysing the performance of our site and to understand how visitors use it.
• To respond to your booking queries and to resolve complaints.
• For security and fraud prevention, and to ensure that our site is safe and secure and used in line with our terms of use.
• To comply with applicable laws and regulations.

Legal grounds for using your personal data
We will only use your personal data where we have a legal ground to do so. We determine the legal grounds based on the purposes for which we have collected and used your personal data. In every case, the legal ground will be one of the following:

• Consent: For example, where you have provided your consent to receive marketing emails from us. You can withdraw your consent at any time. In the case of marketing emails you can withdraw your consent by clicking on the “unsubscribe” link at the bottom of the email.

• Our legitimate interests: Where it is necessary for us to understand our readers, promote our services and operate our site efficiently for the creation, publication and distribution of news, media and related content. For example, we will rely on our legitimate interest when we analyse what content has been viewed on our site, so that we can understand how it is used. It is also in our legitimate interest to carry out marketing analysis to determine what events and services may be relevant to the interests of our readers.

• Performance of a contract with you (or in order to take steps prior to entering into a contract with you): For example, where you have asked to book a room and we need to use your contact details in order to process your order and deliver the information.

• Compliance with law: In some cases, we may have a legal obligation to use or keep your personal data.

Using children’s personal data
We do not aim any of our products or services directly at children under the age of 13 and we do not knowingly collect personal data about children under 13. Some of our services may have a higher age restriction and this will be shown at the point of registration.

Security of your personal data
We have implemented appropriate technical and organisational controls to protect your personal data against unauthorised processing and against accidental loss, damage or destruction.
Unfortunately, sending information via the internet is not completely secure. Although we will do our best to protect your personal data once with us, we cannot guarantee the security of any personal data sent to our site while still in transit and so you provide it at your own risk.

Who we share your personal data with
If you are going to one of our events hosted by an event partner, we may share your personal data with that partner for event administration purposes.

Sometimes we may receive a letter, email or another form of communication from you that we consider to be significant to the activity of our association. We may decide to keep this in our archive for historic and archiving purposes.

We do not share your personal data with other people or organizations that are not directly linked to us except under the following circumstances:

• We may share your data with other organizations that provide services on our behalf such as dealing with online payments and other forms of payment processing, ie credit card transactions and preventing fraud.
• We may also share your data with our advertising partners, as set out in the section about Online Advertising below.
• We may reveal your personal data to any law enforcement agency, court, regulator, government authority or other organization if we are required to do so to meet a legal or regulatory obligation, or otherwise to protect our rights or the rights of anyone else.
• We may reveal your personal data to any other organization that buys, or to which we transfer all, or substantially all, of our assets and business. If this sale or transfer takes place, we will use reasonable efforts to try to make sure that the organisation we transfer your personal data to uses it in line with our privacy policy.

Any organizations which access your data in the course of providing services on our behalf will be governed by strict contractual restrictions to make sure that they protect your data and keep to all data privacy laws that apply. We may also independently audit these service providers to make sure that they meet our standards.

We will not share your personal data with anyone else for their own marketing purposes unless we have your permission to do this.

Some of our webpages use social plug-ins from other organizations (such as the “Facebook Like” function). These other organizations may receive and use personal data about your visit to our site. If you browse our site, information they collect may be connected to your account on their site. For more information on how these organizations use personal data, please read their privacy policies.

International data transfers
Data we collect may be transferred to, stored and processed in any country or territory where one or more of our association or service providers are based or have facilities. While other countries or territories may not have the same standards of data protection as those in your home country, we will continue to protect personal data that we transfer in line with this privacy policy.

Whenever we transfer your personal data out of the European Economic Area (EEA), we ensure similar protection and put in place at least one of these safeguards:

• We will only transfer your personal data to countries that have been found to provide an adequate level of protection for personal data.
• We may also use specific approved contracts with our service providers that are based in countries outside the EEA. These contracts give your personal data the same protection it has in the EEA .
• Where we use service providers in the United States, we may transfer personal data to them if they are part of the Privacy Shield scheme, which requires them to provide a similar level of protection of your personal data to what is required in the EEA.

How long we keep your personal data
We keep your personal data for only as long as we need to. How long we need you personal data depends on what we are using it for, as set out in this privacy policy. For example, we may need to use it to answer your queries about a booking or event and as a result may keep personal data while you are still attending that event or check in to our manor.

If we no longer need your data, we will delete it or make it anonymous by removing all details that identify you. If we have asked for your permission to process your personal data and we have no other lawful grounds to continue with that processing, and you withdraw your permission, we will delete your personal data. However, when you unsubscribe from marketing communications, we will keep your email address to ensure that we do not send you any marketing in future.

How we may contact you
Marketing communications and editorial newsletters. If we have your permission, we may send you materials we think may interest you, such as news about our association and events. Depending on your marketing preferences, this may be by email, phone or SMS.

You can decide not to receive these emails at any time and will be able to “unsubscribe” directly by clicking a link in the email.

Responding to your queries or complaints
If you have raised a query or a complaint with us, we may contact you to answer your query or to resolve your complaint.

Cookies and similar technology
When you visit our site, we may collect personal data from you automatically using cookies or similar technology. A cookie is a small file that can be placed on your device that allows us to recognise and remember you.

This privacy policy includes our cookie policy, where you can find details of our key advertising partners.

Online advertising
Advertising on our site that is based on cookies and similar technology

We use personalized online advertising on our site. This allows us to deliver more relevant advertising to people who visit www.highlightpr.ro. It works by showing you adverts that are based on your browsing patterns and the way you have interacted with our site. It then shows you adverts which we believe may interest you.
When you browse our site, some of the cookies and similar technology we place on your device are advertising cookies, so we can understand what sort of pages you are interested in. We can then display advertising on your browser based on these interests. For instance if you have been reading a lot of food and drink articles, we may show you more advertisements for food and drink.

We do not collect or use information such as your name, email address, postal address or phone number for personalized online advertising.

We may also share online data collected through cookies and similar technology with our advertising partners. This means that when you are on another website, you may be shown advertising based on your browsing patterns on www.highlightpr.ro. We may also show you advertising on www.highlightpr.ro website based on your browsing patterns on other sites that we have obtained from our advertising partners.

Online retargeting is another form of online advertising that allows us and some of our advertising partners to show you advertising based on your browsing patterns and interactions with a site away from our site.

For example, if you have visited the website of an online clothes shop, you may start seeing adverts from that same shopping site displaying special offers or showing you the products you were browsing. This allows companies to advertise to you if you leave their website without making a purchase.

Advertising that we place on our site or on other sites
We also use personalized online advertising to promote our own services. This means that you may see advertising for our products and services on our site and when you are on other, third party websites, including social media platforms.

Your rights with regard to the personal data that we hold about you
You can contact us with regard to the following rights in relation to your personal data:

• If you would like to have a copy of the personal data we hold on you or if you think that we hold incorrect personal data about you, please write to the Data Protection Officer at stories@highlightpr.ro. We will deal with requests for copies of your personal data or for correction of your personal data within one month. If your request is complicated or if you have made a large number of requests, it may take us longer. We will let you know if we need longer than one month to respond. You will not have to pay a fee to obtain a copy of your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.
• Where you have provided us with consent to use your personal data, you can withdraw this at any time.
• You also have the right to ask us to delete your personal data or restrict how it is used. There may be exceptions to the right to erasure for specific legal reasons which, if applicable, we will set out for you in response to your request. Where applicable, you have the right to object to processing of your personal data for certain purposes.
• If you do not want us to use your personal data for marketing analysis, you can write us at stories@highlightpr.ro.

If you want to make any of these requests, please write us at stories@highlightpr.ro.

We may need to request specific information from you to help us confirm your identity.

Contact us for information about how we use your personal data
If you have any questions about how we use your personal data or if you have a concern about how your personal data is used, please contact the Data Protection Officer by email, at stories@highlightpr.ro.

Complaints will be dealt with by the Data Protection Officer and will be responded to within 30 days.

If you are not satisfied with the way your concern has been handled, you can refer your complaint to the The National Supervisory Authority For Personal Data Processing – www.dataprotection.ro.

If you have a question about anything else, please see our Contact page.

Changes to the Privacy Policy
If we decide to change our privacy policy we will post the changes here. If the changes are significant, we may also choose to email all our registered users with the new details. If required by law, we will get your permission or give you the opportunity to opt out of any new uses of your data.

May 2018: updated to reflect changes resulting from the General Data Protection Regulation.