Privacy policy

The data controller is RESTAURANT LA MARIA SI ION SRL, with its registered office at Str. Rotundă nr. 1, bl. Y1B, sc. 2, et. 9, ap. 82, cam. 2, Sector 3, București, CUI 43718579, registered in the Trade Register under no. J2021002400409, share capital 400 lei, place of business (the restaurant): Splaiul Independenței 290, Regie student complex, București.

For any request about your data: gdpr@mariasiion.ro, phone 0753 473 781.

We do not ask for sensitive data. If you tell us about an allergy or a dietary restriction, this may be information about your health: we use it only to prepare your meal and for no other purpose. Please do not enter other sensitive data in the notes fields.

• Reservation request: name, phone, optional email, preferred date and time, guest count, area, occasion and notes. Purpose: receiving and confirming the reservation and contacting you.
• Reservation history, including visits, no-shows and preferences you share. Purpose: better table organisation and recognising returning guests.
• Contact form message: name, phone and/or email, subject and message. Purpose: replying to your request. We do not subscribe you to newsletters.
• Email, phone or WhatsApp communications: the data you share with us. Purpose: replying to your request.
• WhatsApp messages about your booking (confirmation, changes, reminder): only if you tick this option in the form. We use your phone number and the booking details.
• Promotional push notifications from the app (events, new dishes, offers): only with your separate consent, given with the switches in the app, which are off by default. We keep your choice, the date of each change and the version of the text shown, as proof of consent. Notifications about your reservations are not promotional.
• Promotional WhatsApp messages (events, guest artists, offers): only with your separate consent, given through the box that is unticked by default in the form or through the confirmation message you send on WhatsApp. We keep the phone number, name, date, source and version of the accepted text as proof of consent.
• Technical data: IP address, browser type and server logs. Purpose: security, operation and abuse prevention.
• Request for a private event (from the app): name, e-mail or phone, date, number of guests, preferences, indicative budget, any dietary restrictions and the messages exchanged with the restaurant. Purpose: to prepare the offer and the event, at your request (Art. 6(1)(b) GDPR). Dietary restrictions may be health data: we use them only for the event.
• Requests about your data (GDPR): name, e-mail or phone, the type and description of the request. Purpose: to handle them and to prove that we met the legal deadlines (Art. 6(1)(c) GDPR). Kept for 3 years after the request is closed.

Your name and phone number are needed to take a booking or to reply to you; without them we cannot record the request. The other fields are optional.

• pre-contractual steps at your request: arranging reservations submitted through the form, phone or app — GDPR Article 6(1)(b);
• your consent: promotional WhatsApp messages — Art. 6(1)(a) GDPR and Art. 12 of Romanian Law no. 506/2004. You can withdraw it at any time, free of charge, by writing STOP on WhatsApp;
• your consent to promotional push notifications from the app — Art. 6(1)(a) GDPR. You can withdraw it at any time in the app (Account → Notifications), and consent given on one channel does not cover another channel;
• legitimate interest in replying to your contact form message — GDPR Article 6(1)(f);
• our legitimate interest in website security and reservation organisation — GDPR Article 6(1)(f).

We do not sell or rent your data. We send you promotional messages only if you have agreed to receive them.

• Meta Platforms (WhatsApp Business), for WhatsApp messages exchanged with the restaurant;
• the email delivery provider, for example for reservation confirmations, which processes messages strictly for delivery;
• the providers hosting the website and the database (Vercel Inc. and Neon, Inc.), on whose infrastructure the application runs;
• public authorities only where required by law.

If a provider processes data outside the EEA, transfers use appropriate safeguards, such as European Commission-approved standard contractual clauses or an adequacy decision.

We keep data only as long as needed for the purpose we received it for. Erasure and anonymisation run automatically every day:

• booking notes, including any allergies you told us about: erased 30 days after the booking date;
• name, phone number and e-mail in bookings: anonymised 12 months after the booking date. Only statistics remain (date, time, number of guests, area), and a customer profile left without bookings is erased;
• messages sent through the contact form: erased 12 months after they arrive;
• WhatsApp conversations with the restaurant: erased 90 days after the last message;
• records of the messages we send (e-mail, WhatsApp, notifications): erased after 12 months at most;
• consent to promotional messages: kept while you are subscribed. After you unsubscribe, the proof of the consent and of its withdrawal is kept for 3 years (the general limitation period), then erased; the number stays only in irreversibly encrypted form (a hash) on an exclusion list, so we never write to you again;
• private event requests: once the request is closed, 24 months after the event date the contact details, notes and messages are anonymised; only the date, number of guests, budget and offer remain, as a business record;
• the log of staff actions in the administration area: 24 months, for security.

Technical logs are kept briefly for security.

Under the GDPR, you have the right:

• to access your data and receive a copy;
• to correct inaccurate data;
• to erasure, the right to be forgotten;
• to restrict processing;
• to data portability;
• to object to processing;
• to withdraw consent at any time without affecting the lawfulness of earlier processing;
• to complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

You can exercise your rights by filling in the request form or by writing to us at the contact address above. We record the request and give you a reference number. We reply within one month of receipt; in complex cases or if we receive many requests, the deadline may be extended by up to two further months, and we will tell you about the extension and the reason within the first month.

If we have reasonable doubts about your identity, we may ask for additional information, strictly as much as is needed for verification. We do not automatically erase all data upon the first request: some must be kept for a period under the law (for example accounting records), and in that case we explain what can and cannot be erased.

ANSPDCP — B-dul G-ral Gheorghe Magheru 28-30, Sector 1, Bucharest; email anspdcp@dataprotection.ro; www.dataprotection.ro.

We apply reasonable technical and organisational safeguards against unauthorised access, loss or disclosure: HTTPS encryption, access limited to authorised staff and GDPR-compliant providers.

We do not take decisions based solely on automated processing that produce legal effects on you (Art. 22 GDPR), and we do not carry out profiling.

We may update this policy. The last update date is shown above.