Privacy and cookie policy

What personal data we use when you rent equipment from us, why we need it, how long we keep it and what your rights are.

Working draft — the final text must be reviewed by a lawyer before launch.

Fields in square brackets are filled in from the company settings before publication.

This is a translation provided for convenience. The Romanian version is the legally binding one.

This notice applies to the website, to online bookings and to rentals made at the rental desk, and is provided under Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018 (the Romanian law implementing the GDPR).

1. Who processes your data

The data controller is:

Name: [enter the legal name], trade name AVANT SKI
Registered office: [enter the address]
Tax ID (CUI): [enter the CUI] · Trade Register no.: [enter the Trade Register no.]
Email: contact@avantski.ro · Phone: +40 750 466 009
Data protection officer (if one has been appointed): [fill in or remove]

2. What data we collect

Identification and contact data

Your first and last name, phone number, email address and any notes you send us when booking.

Messages on WhatsApp

If you message us on WhatsApp, we receive your phone number, your profile name and the messages you send us. We use them only to reply to you and help you with your booking. The conversation goes through the WhatsApp service (WhatsApp Ireland Limited, part of the Meta group), which you use under WhatsApp’s own terms and privacy policy.

Data for fitting the equipment

For each participant: name, activity, height, weight, shoe size, skill level and, for children, age. We use this data to choose the sizes and to adjust the bindings safely.

Rental history

Bookings, rental periods, the equipment rented (with the code of each item), its condition on return, any damage and our communications with you.

Payment data

Amounts paid, payment method, date and transaction ID. We do not store card details.

Photo of the identity document

At pick-up we photograph the identity document of the adult who collects the equipment. The photo is stored encrypted and used only to identify the person in the event of damage, non-return or loss of the equipment. We do not store the personal identification number (CNP) separately and do not use it for any other purpose. You are informed before the photo is taken. To fill in the rental record quickly, the name and age can be read automatically from the document, directly on the device at the rental desk.

Signature on the tablet

The handwritten electronic signature you give on the tablet on the personal data agreement and on the declaration accepting the risks: the image of the signature, together with the exact text signed, the date and the time. We keep them as proof of the agreement.

Technical data

IP address, browser type and the server’s technical logs, used to operate and secure the website and to prevent abuse (for example, limiting the number of requests sent within a short time).

3. Purposes and legal bases

Entering into and performing the rental contract (Art. 6(1)(b) GDPR): the booking, preparing and adjusting the equipment, handover and return, emails about the booking, changes and cancellations.
Answering your questions (Art. 6(1)(b) and (f)): when you email us, message us on WhatsApp or call us, we use the details in your message to reply and, if you ask us to, to prepare your booking.
Legal obligations (Art. 6(1)(c)): issuing tax documents, keeping accounting records, responding to requests from the authorities.
Our legitimate interest (Art. 6(1)(f)) in protecting our property: the rented equipment is of significant value and leaves our centre on the basis of trust in the customer. The photo of the identity document, kept only for a short time after return, allows us to identify the person responsible if damage occurs or the equipment is not returned. We have assessed that your rights and freedoms do not override this interest, because the data are stored encrypted, access is restricted and deletion is automatic. The security of the website and the defence of any legal claims are also based on legitimate interest.
Proof of agreement and of information provided: the signature on the tablet documents that you have read the information notice and accepted the risks of the activity (performance of the contract and legitimate interest).
Separate consent for marketing (Art. 6(1)(a)): we only send you offers by email if you tick the dedicated box. Ticking it is not required to book, and you can withdraw your consent at any time, using the unsubscribe link or by writing to us.

The data for fitting the equipment are necessary for the rental. Without them we cannot prepare and adjust the equipment safely. We do not take decisions based solely on automated processing that produce legal effects concerning you; sizes suggested automatically are checked by our staff.

4. Who we share data with

The data are accessed only by our authorised staff, within the limits of each person’s role. We share them with:

The email service provider we use to send confirmations and notifications: [enter the email provider];
The cloud hosting providers of the application and database (Vercel Inc. and Supabase Inc.);
Google Ireland Limited, for visitor statistics (Google Analytics), only if you accept analytics cookies;
Our accountant or accounting firm: [fill in];
Public authorities, courts or insurers, only when required by law or to defend a right.

The providers act as processors, under contracts that oblige them to protect the data. We do not sell personal data.

5. Transfers outside the EEA

Some providers (for example the cloud hosting providers, and Google for statistics) may process data outside the European Economic Area, including in the US. In these cases the transfer is based on an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework, for certified providers) or on standard contractual clauses approved by the Commission, with additional safeguards. You can ask us for a copy of the safeguards applied. Database hosting region: [fill in, e.g. EU (Frankfurt)].

6. How long we keep data

Photo of the identity document: deleted automatically 14 days after the rental ends. If a damage claim is pending, it is kept until the claim is resolved.
Personal booking access link: valid until 30 days after the end of the rental period.
Booking and rental data: [enter the period, e.g. 3 years from the last rental, for possible claims].
Tax and accounting documents: the periods set by accounting and tax legislation [enter the period, checked with the accountant].
Documents signed on the tablet: [enter the period, e.g. the general 3-year limitation period from the end of the rental].
Data used for marketing: until you withdraw your consent.
WhatsApp conversations: [enter the period, e.g. 12 months from the last message].
Technical logs: [enter the period, e.g. 90 days].

On request or when the period expires, the data are deleted or anonymised, except for data that the law requires us to keep.

7. Your rights

You have the right:

to access your data and receive a copy of it;
to have inaccurate data rectified;
to have your data erased when there is no longer a basis for keeping it;
to restriction of processing;
to portability of the data you provided, processed on the basis of a contract or consent;
to object to processing based on legitimate interest, on grounds relating to your particular situation;
to withdraw your consent to marketing at any time, without affecting the processing carried out before.

To exercise your rights, write to us at contact@avantski.ro. We reply within one month of receiving your request; this period may be extended by two further months for complex requests, in which case we will let you know. We may ask for additional information to confirm your identity.

You have the right to lodge a complaint with the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, dataprotection.ro.

8. Cookies and local storage

Without your consent, we only use mechanisms that are strictly necessary for the website to work:

avs_session — session cookie for staff sign-in to the admin area. It is set only when employees sign in, is HttpOnly and expires after at most 12 hours or on sign-out. Website visitors do not receive it.
sessionStorage in the browser — temporarily keeps the draft of the booking form (period, participants, sizes), so you don’t lose your data if you reload the page, and a technical counter used when the page reloads automatically while we wait for an online payment to be confirmed. The data stay only on your device, are not sent to us until you confirm the booking, and are deleted when you close the tab or after the booking is submitted.
localStorage in the browser — your choice about analytics cookies (avs-cookie-analytics), so that we don’t ask you on every visit. It stays only on your device.

With your consent, requested through the banner on your first visit, we also use Google Analytics (Google Ireland Limited) to see which pages are read, on which devices and from which sources visitors come. Google Analytics sets the _ga and _ga_* cookies, kept for up to 13 months, and receives the page address, technical browser data and approximate location. Google does not store the IP address. We do not use this data for advertising and do not link it to bookings.

Without consent, the Google code is not loaded and no analytics cookie is set.
Pages opened with the personal booking link (the booking page and the confirmation) are never measured, so that the link does not reach Google.
You can withdraw your consent at any time using the “Cookie settings” link in the site footer. Measurement then stops and the _ga cookies are deleted from your browser.

We do not use advertising cookies.

The WhatsApp button on the site is a simple link: it loads nothing from WhatsApp and sets no cookies until you press it. It then opens the WhatsApp app or website, which have their own policy.

The links to our Instagram, Facebook, and TikTok pages are simple links: the site loads no buttons, plugins or scripts from social networks. When you click one, that network opens, with its own privacy policy.

If we add other optional cookies, we will only use them after asking for your consent, and we will update this section.

9. Data security

We use encrypted connections (HTTPS), account- and permission-based access for staff, audit logs for important operations and additional encryption for photos of identity documents. Personal booking access links are unique and valid for a limited time; do not share them with anyone.

10. Data of minors

Children’s data (name, age, data for fitting the equipment) are provided to us by the adult making the booking, who declares that they are entitled to do so (a parent, guardian or person to whom the child has been entrusted). We use them only for the rental and do not send marketing communications to minors.

11. Changes to this policy

We may update this policy when the way we process data changes. The current version is published on this page; we announce important changes on the website or by email. See also the Rental terms and conditions.

Last updated: [enter the publication date]