The controller of the personal data collected through travelportal.cyrix.ro is [LEGAL NAME], with its registered office at [REGISTERED ADDRESS], VAT ID [VAT], registered with the Trade Register under no. [J__/____/____], e-mail rezervari@cyrix.ro, phone 0784.111.118 (“we”).
This policy explains what data we collect, why, how long we keep it, to whom we disclose it and what your rights are. Processing is carried out in accordance with Regulation (EU) 2016/679 (“GDPR”) and the Romanian implementing Law no. 190/2018.
2. What categories of data we collect
Identification and contact data: first and last name, e-mail, telephone, billing address, company details if you book on behalf of a business (name, VAT ID, trade register number).
Travel-related data: date of birth, nationality, passport or identity document series and number, document validity, dietary or medical preferences you declare, details for accompanying minors.
Booking data: itinerary, departure dates, cabin type, number of travellers, history of requests and quotes received.
Payment data: payment confirmation, the last four digits of the card and the card type. We never store the full card number, expiry date or CVC code — these are processed exclusively by authorised payment processors.
Technical data: IP address, device and browser type, pages visited, date and time of access, session and cookie identifiers.
Communications: messages sent through the contact form, by e-mail or telephone, including their recording so that we can follow up on your request.
We do not intentionally collect special categories of data (for example, health data), except where you voluntarily provide them so that we can request an adapted service from the supplier (for example, a medical or dietary requirement on board). We do not collect data on criminal convictions.
3. Purposes and legal bases
We process data for the purposes below, each with its legal basis under Article 6 of the GDPR:
Handling the request and issuing the quote — basis: performance of the contract or pre-contractual steps (Art. 6(1)(b)).
Confirming and performing the booking, including transmitting data to the cruise line, carrier, hotel or insurer — basis: performance of the contract (Art. 6(1)(b)).
Invoicing, accounting and tax obligations — basis: legal obligation (Art. 6(1)(c)), under tax and accounting legislation.
Handling complaints and defence in disputes — basis: legitimate interest and legal obligation.
Marketing communications (newsletter) — basis: consent (Art. 6(1)(a)), which you may withdraw at any time. If you are an existing client, we may inform you about similar services under Romanian Law no. 506/2004, and you may object free of charge and simply.
4. How long we keep data
Requests that did not result in a booking: up to 12 months from the last contact.
Data relating to completed bookings: for the term of the contract and thereafter 5 years, to be able to respond to possible complaints.
Financial, accounting and invoicing documents: 10 years, under applicable tax and accounting legislation.
Marketing data: until consent is withdrawn, but no longer than 3 years from the last interaction.
Technical and security logs: up to 12 months.
Once the retention periods expire, data is deleted or irreversibly anonymised.
5. To whom we disclose data
We do not sell or rent your data. We disclose it strictly as necessary to:
Cruise lines, airlines, hotels, transfer operators and insurers — in order to conclude and perform the booking.
Authorised payment processors and banks — to process payments and issue invoices.
IT, web hosting, e-mail, accounting and audit service providers — as processors, under a data processing agreement and confidentiality obligations.
Public authorities (consumer protection, tax authority, courts, investigative bodies) — where a legal obligation exists.
Each recipient receives only the data necessary for the respective purpose. For cruise services, the cruise line may act as an independent controller for its own legal obligations (for example, passenger lists required by port authorities).
6. Transfers outside the European Economic Area
Cruise providers, airlines or payment processors may be established outside the European Economic Area (EEA). In such cases, the transfer takes place only where adequate safeguards exist under Chapter V of the GDPR: an adequacy decision of the European Commission, standard contractual clauses or other legal safeguards. You may request information about the applicable safeguards by writing to the e-mail address above.
7. Cookies and similar technologies
Cookies are small files stored on your device that allow the website to function and, with your consent, to measure audience. We use the following categories:
Strictly necessary — ensure the website works: browsing session, form security token (anti-fraud protection), language preference and the request cart. Basis: legitimate interest; they cannot be disabled.
Preference — remember settings such as your chosen language or currency for a consistent experience on return.
Statistics and analytics — help us understand which pages are useful. They are activated only with your consent and can be refused without limiting your use of the website.
Marketing — may be used to measure campaigns. They are activated only with your consent.
You can control cookies in your browser settings: delete them, block third-party cookies or block all cookies. Blocking strictly necessary cookies may prevent forms and booking from working correctly.
8. Your rights
Under Articles 15–22 of the GDPR you have the following rights, exercisable free of charge by a request sent to rezervari@cyrix.ro:
Right of access — to know whether we process your data and to receive a copy of it.
Right to rectification — correction of inaccurate data or completion of incomplete data.
Right to erasure (“right to be forgotten”) — in the cases provided by law, where no basis for processing remains.
Right to restriction of processing — while a challenge is being verified or where processing is unlawful.
Right to data portability — to receive the data you provided in a structured, commonly used and machine-readable format.
Right to object — you may object to processing based on legitimate interest, including direct marketing.
Right not to be subject to automated decision-making, including profiling, with significant effects. We do not take such automated decisions concerning you.
Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.
We reply to requests within one month, extendable by two months for complex cases, with notice to you. If you believe your rights have been infringed, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru no. 28-30, Sector 1, Bucharest, website www.dataprotection.ro. You may also apply to the competent court.
9. Data security
We take appropriate technical and organisational measures to protect data: encrypted HTTPS/TLS connection, role-based access control, hashed password storage, access logs, regular backups and minimisation of collected data. Card data never passes through our servers. Although no system can guarantee absolute security, in the event of a security incident posing a risk to your rights we will notify the competent authority within 72 hours and inform you directly, under Articles 33 and 34 of the GDPR.
10. Minors
This website is not addressed to children. We do not knowingly collect data from persons under 16 without the consent of parents or legal representatives. For bookings including minors, their data is provided by the parent or legal representative and is used exclusively for the booking and travel documents.
11. Changes to this policy
We may update this policy to reflect legislative changes or changes to our services. The version in force is always published on this page, together with the date of the latest update. If the changes are significant, we will notify you by e-mail or through a visible notice on the website.
12. Contact
For any question about the processing of personal data or to exercise your rights, you can contact us at rezervari@cyrix.ro or by phone at 0784.111.118, Monday to Friday, between 09:00 and 18:00. You may also use the contact form on the website.
