Privacy
Last updated · 29 September 2026
This policy explains what personal data we collect through the site, why, how long we keep it, who we share it with and what your rights are. It follows Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.
1. Who is responsible for your data
The data controller is Transilvania Steakhouse S.R.L., Tax ID RO46842716, Trade Register no. J2022005780123, registered office at Str. Dâmboviței nr. 77, ground floor, Cluj-Napoca, Cluj County, Romania. The restaurant is at Str. Constantin Brâncuși 119, Cluj-Napoca.
For any question about your data: dragos.mihaescu@icloud.com or +40 771 240 740.
2. What we collect and why
2.1 Booking requests
Data | Why | Legal basis |
|---|---|---|
Name, phone number | To confirm the booking and call you if needed | Art. 6(1)(b) GDPR: steps taken at your request before service |
Date, time, number of guests | To prepare your table | Art. 6(1)(b) GDPR |
Notes (optional) | To take your requests into account | Art. 6(1)(b) GDPR |
Allergies or medical restrictions, if you write them in "Notes" | To protect you from a health risk | Art. 9(2)(a) GDPR: your explicit consent |
About allergies. Health information is sensitive data. We use it only if you choose to give it to us, and sending the form with it counts as your explicit consent. You don't have to give it: you can also tell us at the restaurant. You can withdraw your consent at any time by writing to us.
2.2 Technical data
When you open the site, the server automatically logs your IP address, browser type, date, time and the page visited. We need this to run the site and protect it from attacks. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a secure site. We do not use this data to identify you.
2.3 Visit statistics (Google Analytics)
If you press "Accept" in the cookie bar, we use Google Analytics 4 to see, in aggregate, how many visitors we have, which pages they read and on which devices. IP addresses are anonymised and advertising features are off. The legal basis is Art. 6(1)(a) GDPR, your consent, which you can withdraw at any time by clearing the site's data in your browser. Google keeps this data for up to 14 months.
2.4 Google map
The home page shows a map to the restaurant. It comes from Google and loads only if you agree: either in the cookie bar or by pressing "Show the map". Only then does Google receive your IP address and may set its own cookies. See the Cookie policy.
3. What we don't do
- We don't sell or rent your data.
- We don't send you ads or newsletters you haven't asked for.
- We don't profile you or make automated decisions about you.
- We don't ask for or store card details.
4. Who else can access your data
- Restaurant staff, only as far as needed for your booking.
- Technical providers, as processors, under contract and only on our instructions:
Provider | What it does | Where the data is |
|---|---|---|
Vercel Inc. | Hosts the site | USA, with servers in the EU too |
Neon Inc. | Database with the bookings | EU (Frankfurt, Germany) |
Cloudinary Ltd. | Images on the site (no visitor data) | USA and EU |
- WhatsApp (Meta Platforms Ireland Ltd.): after you send the form, WhatsApp opens with your request already written to the restaurant's number. The message is sent from your own account, only if you tap Send, and is subject to WhatsApp's terms.
- Google Ireland Ltd., for Google Analytics as a processor, and for the map as an independent controller, both only with your consent.
- Public authorities, only where the law requires it.
Transfers outside the EU
Vercel and Cloudinary are US companies. Data transfers rely on the EU–US Data Privacy Framework or the standard contractual clauses approved by the European Commission, under Chapter V of the GDPR.
5. How long we keep data
- Booking requests: up to 90 days after the booking date, then deleted.
- Allergy notes: deleted once the booking has taken place.
- Server logs: up to 12 months.
- Complaints and correspondence: 3 years, the general limitation period in Romania.
6. Your rights
Under the GDPR (Articles 15–22), you have the right:
- of access: to find out what data we hold about you;
- to rectification: to have wrong data corrected;
- to erasure (the "right to be forgotten");
- to restriction of processing;
- to data portability: to receive your data in a usable format;
- to object to processing based on legitimate interest;
- to withdraw consent at any time, without affecting what was lawfully done before.
Send your request to dragos.mihaescu@icloud.com. We reply free of charge within one month. If the request is complex, this may be extended by two more months, and we will let you know.
7. Complaints
If you are not happy with our answer, you can complain to the Romanian data protection authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, sector 1, Bucharest, dataprotection.ro, or to the authority in your EU country of residence. You may also go to court.
8. Security
The site uses an encrypted connection (HTTPS). Access to bookings is password-protected and limited to the staff who need it. No system is completely secure, but if a problem puts your data at risk, we notify the authority within 72 hours, and you too if the risk is high.
9. Children
The site is not aimed at children under 16, and we do not knowingly collect their data. Family bookings are made by an adult.
10. Changes
We update this policy whenever the way we use data or the law changes. The date of the last update is shown at the top.