Legal

Privacy policy

We are delighted to have you as prospective customers / visitors / subscribers of the services offered by Hotel Art Metropolis, operated and managed at Str. Parcului, nr. 19, Bistrita, Bistrita Nasaud County, Romania, by METROPOLIS CITY ART SRL, with its registered office at Str. Parcului, nr. 19, Bistrita, Bistrita Nasaud County, registered with the Trade Register under no. J2025065371005, unique registration code 52413271, hereinafter the ‘Company’.

The Company’s data protection officer can be contacted by email at office@hotelartmetropolis.ro. Hotel Art Metropolis, Str. Parcului, nr. 19, Bistrita, Bistrita Nasaud County, website hotelartmetropolis.ro, email receptie@hotelartmetropolis.ro, telephone +40 747 80 99 99, provides hotel accommodation, food and beverage, and event services.

Protecting the personal data of the prospective customers / customers / visitors / subscribers of the services offered at our hotel is very important to us.

The Company is a controller of personal data within the meaning of Article 4(7) of REGULATION (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the ‘GDPR’).

We hereby inform you that the Company, as controller, collects and processes, in whole or in part, the following categories of personal data of the prospective customers / customers / visitors / subscribers of the services offered:

  • surname, first name, age, including that of any minors accompanying you, address, domicile, residence, telephone number, email address, place and date of birth, citizenship, signature, sex;
  • identity card / passport / identity document / ID card / permit / membership card / licence / driving licence, date of birth, home address, etc.;
  • personal identification number (CNP) in accordance with the applicable legal provisions;
  • date of arrival, date of departure;
  • number of adults and children per booking / room;
  • the data needed to make payments: for bank card payments (card type, credit/debit card details, number, cardholder, expiry date, security code), for bank transfers (the customer’s bank account, the bank where the account is held) and/or the number and series of the holiday voucher / vouchers / tickets / gift cards, where the Company’s services are paid for with holiday vouchers / vouchers / tickets / gift cards;
  • the booking code of the stay or reservation, order number;
  • data collected from access cards (check-in/entry time, check-out/exit time);
  • the service package chosen;
  • image, voice;
  • health data, where necessary (e.g. illnesses, temperature, treatments, recommendations, Covid certificate, etc.);
  • the services you have used and their duration;
  • room number / location of the service;
  • registration number of your car, motorcycle or other vehicle;
  • IP address;
  • communication and marketing preferences.
  • any other data provided to us in accordance with the law.

We collect the personal data above, among other things, from contact forms, booking forms, registration forms, check-in, check-out, entry forms, exit forms, payment forms by bank card / bank transfer / holiday voucher / vouchers / tickets / gift cards, documents relating to the provision or use of services and access cards, and by email, telephone, social media platforms, the website, contracts, forms and documents that we use in our relationship with you.

Where you give us the personal data of other people in connection with the services offered or provided by the Company, data that we process in connection with those services, it is your responsibility to ensure that those people have been correctly and fully informed and that their consent to the processing has been obtained, where such consent is required.

The Company processes the personal data mentioned above for the following purposes:

(i) entering into and performing the services contract with you, including any related correspondence,

(ii) fulfilling its pre-contractual legal obligations (the process of booking accommodation and other services according to your choices, etc.) and its contractual obligations (during your stay and the provision of other services requested from and contracted with us),

(iii) providing hotel services (accommodation, etc.) and any other services we offer that you request, such as the hire of bicycles and/or other sports and leisure equipment.

(iv) fulfilling any legal obligation that may apply to the Company (for example: accounting and tax obligations and formalities, emergencies, legal obligations applicable to hotel service providers),

(v) exercising or defending the Company’s rights and legitimate interests (for example: managing the customer relationship),

(vi) verifying, internally assessing and controlling the flows, processes and activities carried out by the Company,

(vii) internal audit, financial audit and other types of reporting, in accordance with the applicable legal provisions and/or the requirements applicable to the Company (for example: checking compliance with internal policies and rules),

(ix) monitoring the security of people, premises and property; in this context, some indoor and/or outdoor areas of the Company’s premises (the car park and outdoor areas – courtyard, driveway, etc.) are under video surveillance, to guard and protect people, property, valuables, buildings and their enclosures,

(x) carrying out statistical and archiving operations requested by the authorities, where requested,

(xi) providing statistics,

(xii) direct marketing / advertising / publicity / competitions / measuring satisfaction / campaigns organised by the controller, etc., where you have given your consent to this and to receiving commercial messages by email / SMS / telephone about the services offered by METROPOLIS CITY ART SRL

The legal basis of the processing for each of the purposes above is one or more of the following:

(i) the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract – Article 6(1)(b) GDPR,

(ii) compliance with a legal obligation to which the controller is subject – Article 6(1)(c) GDPR,

(iii) the legitimate interest of METROPOLIS CITY ART SRL – Article 6(1)(f) GDPR,

(iv) the data subject has given consent to the processing of their personal data, where applicable – Article 6(1)(a) GDPR.

Storage period

The Company stores personal data for the time needed to achieve the purposes of the processing, in compliance with the legal regulations in force, and for the whole duration of any applicable legal term, where applicable, and afterwards in accordance with the financial, accounting and archiving rules laid down by law, as well as for the applicable limitation period, to protect the controller’s legitimate interests. If the Company determines that it has a legitimate interest or a legal obligation to continue processing your personal data for other purposes, you will be informed accordingly.

If there is a legal obligation to archive the data, it will be archived in whole or in part in accordance with the law. Once the processing has ended, the data will be deleted or destroyed, depending on the medium on which it was stored, or may be anonymised.

Other companies in Romania and/or abroad may have access to, or be given, the personal data mentioned above for internal administrative purposes, to protect the Company’s rights, interests and assets and/or to fulfil an applicable legal requirement, where applicable, on the basis of the controller’s legitimate interest and/or an applicable legal provision, some of these companies acting as processors for the Company for certain processing of personal data. All necessary measures are taken in connection with this access or disclosure to ensure an adequate level of protection, so that the data is properly protected wherever it is transferred. To this end, we also ensure that the data processing principles and the conditions of Article 44 et seq. GDPR are respected, to ensure an adequate level of protection in all cases. An adequate level of protection may be ensured, among other things, through standard contractual clauses.

The personal data mentioned above may also be disclosed to the following recipients: the data subject, the legal representatives of the data subject, of the controller, of its processors or representatives, METROPOLIS CITY ART SRL, the controller’s contractual partners, such as auditors, providers of technical maintenance, IT, customer management applications, tax, duties, financial, archiving, mail distribution, control and legal services (lawyers, notaries, etc.), subcontractors and customers, within the limits of their obligations towards the controller.

Where the Company has a legal obligation to do so, personal data will be disclosed to public authorities / institutions / bodies, such as courts, investigating authorities, tax administrations, municipalities and supervisory authorities.

Your data may also be disclosed to external service providers, customers and suppliers, where this is necessary to provide a particular service or to manage business relationships.

Data may be transferred to suppliers and partners involved in operating the services:

  • Netopia Payments
  • D-EDGE
  • OTA
  • CMS (WordPress)
  • Opera
  • Hubspot
  • Hosting and maintenance providers
  • Online analytics and marketing platforms (Google, Meta, TikTok, Linkedin)

If personal data is transferred to a country outside the European Economic Area, we ensure that the conditions of Article 44 et seq. GDPR are respected, to ensure an adequate level of protection, such as: (i) a transfer to any country that the European Commission considers to ensure an adequate level of protection; or (ii) a transfer subject to a data transfer mechanism or other appropriate safeguards, as required by the GDPR.

The personal data mentioned above is not subject to automated decision-making, including profiling.

Rights of data subjects

In connection with the processing of personal data, you have the following rights: the right to be informed, the right of access to your data, the right to rectification, the right to erasure (‘the right to be forgotten’), the right to restriction of processing, the right to data portability, the right to object, the right not to be subject to an automated individual decision, the right to lodge a complaint with a supervisory authority, the right to an effective judicial remedy, and the right to withdraw your consent, where it has been given.

For more information on how to exercise the rights above, and if you have any questions about any aspect of personal data protection, you can send a written, signed and dated request to receptie@hotelartmetropolis.ro.

The Company constantly assesses and improves the security measures it has implemented to ensure that personal data is processed securely and safely.

Changes to the terms

This information notice may be updated, amended or improved at any time, and the amended, updated or improved version will be brought to your attention through our website hotelartmetropolis.ro

Date 10.10.2026