Information on data processing

1. The controller
2. What data we use and where it comes from
3. Purpose and lawful basis
4. How long we keep the data
5. Where the data is kept and who receives it
6. Your rights
7. How to exercise your rights
8. Legal framework

1. The controller

DACIAN FLORIN DEDU SRL is the controller of personal data within the meaning of GDPR art. 4(7).

2. What data we use and where it comes from

Our activity is exclusively B2B. We address accommodation providers (companies, authorised self-employed persons and sole proprietorships), not consumers. We use public data only:

• Google Maps: public business listings, collected with our own tool. We use the information published by accommodation providers: the property name, phone number, town and, where published, the address, e-mail and website.
• SITUR (General Directorate for Tourism, Ministry of Economy, Entrepreneurship and Tourism): the list of classified accommodation, published by the ministry on se.situr.gov.ro, updated daily: property name and type, category, town, operator, tax ID (CUI) and, where published, e-mail and website. The list has no phone number; we take it from ANAF, by tax ID. The ministry does not state a licence for this list.
• ANAF (the National Agency for Fiscal Administration): newly registered companies, from its public service: tax ID (CUI), name, address, CAEN activity code and phone number, if declared.
• ONRC (the National Trade Register Office): the open dataset published on data.gov.ro.

In addition, we keep the evidence of your consent or refusal: the text sent, the date and time it was sent, your answer, the date and time of the answer, the channel and the campaign.

The contact details of a legal entity are not personal data. However, the GDPR applies when a number identifies a natural person, for example the phone number of the owner, of an authorised self-employed person or of a sole proprietorship. That is why we apply the same rules to all contacts.

3. Purpose and lawful basis

No answer, silence or inactivity is not considered consent. We do not take automated decisions with legal effects concerning you.

How consent is given on each channel: in the automated call, key 1 for YES and key 2 for NO (key 8 opts you out at any time); by SMS, the reply “last 3 digits of the number + DA” (for example “426 DA”), while a refusal is accepted in any wording (NU, STOP); by e-mail, the YES and NO buttons open a page with a unique link where the choice is recorded; on WhatsApp we never make the first contact: we write only after a YES given in a call, by SMS or by e-mail (including WhatsApp), or if the person wrote to us first on WhatsApp, and the consent question also if the person agreed verbally to receive it, in a call I made personally (consent counts only after the reply on WhatsApp); in the conversation, 1 or DA to consent and 2 or NU to refuse, and NU or STOP stops contact. Each answer is kept with the date and time, as evidence.

4. How long we keep the data

• No answer: the data stays in the prospect list. A new request may be made after 12 months.
• Consent (YES): for as long as the consent is valid (12 months), and afterwards as evidence of it.
• Refusal (NO): the number is kept in the opt-out list, precisely so that the refusal is respected and you are not contacted again.
• Voice messages: in automated calls and with the answering robot we do not record the conversation, only the voice messages you choose to leave us (with the robot, in voicemail or via “Leave a message” during a call). We keep them until your request is resolved, for 30 days at most, and then they are deleted automatically.

5. Where the data is kept and who receives it

The application, databases, consent register and logs are hosted on an on-premise server, on the company's own infrastructure. The application is not public: it runs only inside a private network (VPN), with access by username and password, and is operated by the Administrator. The application and prospect data are not hosted by third parties and are not sold; only this public website is delivered through Cloudflare. We use the following providers:

• Orange România S.A.: carrying calls and SMS messages.
• WhatsApp: delivering WhatsApp messages. WhatsApp messages are transmitted through Meta Platforms, which may process the numbers and messages outside the EU; the transfer is based on the EU-US Data Privacy Framework.
• OpenAI (USA) and ElevenLabs (United Kingdom): used only to generate the voice of audio messages from texts we write; we do not send these providers phone numbers, names or any other personal data.
• Cloudflare, Inc. (USA): the content delivery network (CDN) and secure tunnel through which this public website is delivered. It sees website visitors' IP addresses and technical data (browser, requested page, time). It has no access to the application or to prospect data. The transfer is based on the EU-US Data Privacy Framework, under which Cloudflare is certified.
• Tailscale, Inc. (USA): the private network (VPN) through which the administrator connects to the server. It sees the IP addresses and metadata of connected devices (device name, operating system, connection time), not application data or prospect data. Tailscale is not on the EU-US Data Privacy Framework list (checked 14 October 2026); the transfer is based on the standard contractual clauses (SCCs) in Tailscale's data processing addendum (DPA).

Cookies and browser storage

This website sets no tracking, analytics or advertising cookies and loads no external scripts. In your browser (localStorage) we keep only two things: the language you chose in the language picker and the fact that you closed the cookie notice. This storage is strictly necessary for features you request (art. 4(6)(b) of Law no. 506/2004), contains no personal data and you can delete it at any time in your browser settings. Cloudflare, which delivers the website, may in some situations set a technical security cookie, strictly necessary to protect against automated traffic.

6. Your rights

• The right to be informed about the source of the data and the purpose of processing (GDPR art. 14).
• The right of access, rectification and erasure (GDPR art. 15–17).
• The right to object to direct marketing, at any time and free of charge (GDPR art. 21).
• The right to withdraw consent as easily as it was given (GDPR art. 7(3)).
• The right to lodge a complaint with the Romanian Data Protection Authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro.

7. How to exercise your rights

Reply NU (no) to any message, press key 8 during the call or write to us at [email protected]. You can also call us on +40 743 322 426. Objections are applied immediately, on every channel. Details are on the Opt out page.

If you reply “INFO” or “de unde aveți numărul” (“where did you get my number”), you will automatically receive a message with the data source, the purpose and our contact details.

How we handle requests and security incidents

We answer requests about your rights without undue delay and within one month of receipt at the latest (GDPR art. 12(3)). If the request is complex or we receive many requests, the period may be extended by two further months; in that case we tell you within the first month and explain why. You can send your request by e-mail to [email protected], by phone at +40 743 322 426 or through the Opt out of being contacted page. Please state the phone number or e-mail address the request relates to.

If a personal data breach occurs that may affect people's rights, we notify the Romanian Data Protection Authority (ANSPDCP) within 72 hours of becoming aware of it, where the law requires it (GDPR art. 33). If the breach is likely to result in a high risk to you, we also inform you directly, without undue delay (GDPR art. 34).

8. Legal framework

The company has requested the opinion of ANSPDCP. We also follow Guidelines 05/2020 of the European Data Protection Board on consent.

This English version is provided for information; the Romanian version is the reference text.

Last updated: 15.10.2026.