Privacy policy

1. Data controller

Personal data received through the website telegondolapiatraneamt.ro and the online shop bilete.telegondolapiatraneamt.ro are processed by PERLA INVEST SRL, with its registered office at Str. Gării nr. 7, Piatra Neamț, jud. Neamț, registered with the Trade Register under No J2006001193275, tax identification code RO19101430, share capital 30.871.000 lei (“Perla Invest”), as controller, in accordance with Regulation (EU) 2016/679 (“GDPR”) and Romanian data protection law. Contact details: telephone 0724 538 928, email office@perlainvest.ro.

2. What data are processed

When visiting the website and the shop: the IP address, browser type and pages accessed, recorded automatically in the server logs.

When buying tickets:

• name, email address and, if provided, telephone number;
• for invoices made out to a company: the company name, tax identification code, Trade Register number and address;
• order details: the tickets bought, the amount paid, the date of the order, the payment result reported by NETOPIA Payments, and the IP address and browser from which the order was placed;
• for each ticket: the code, the period of validity and the scans at the stations (date, time and station).

For a cancellation request: the name, email address, order code, the reason if one is given, and the date and time of the request.

When contacting Perla Invest by email or telephone: the data contained in the message.

Bank card details do not reach Perla Invest. They are entered on the secure NETOPIA Payments page, which reports only the result of the payment.

3. Purposes and legal bases of processing

• issuing, delivering and checking tickets, refunds and communications relating to the order — for the performance of the contract (Article 6(1)(b) GDPR);
• issuing invoices, keeping accounting records and archiving — for compliance with legal obligations (Article 6(1)(c) GDPR);
• security of the website and the shop, prevention of fraud and of repeated use of the same ticket, and handling of complaints — on the basis of the legitimate interest of Perla Invest (Article 6(1)(f) GDPR);
• sending offers and news by email — only with consent given when ordering, by ticking the dedicated box (Article 6(1)(a) GDPR).

The name, the email address and, for invoices made out to a company, the company details are required to issue the tickets and the invoice; without them the order cannot be placed. The telephone number is optional and is used only to contact the customer about the order.

Consent to receive offers may be withdrawn at any time by a message to the contact address or through the unsubscribe link in each promotional message. Withdrawal of consent does not affect the order.

4. Recipients of the data

The data are accessed only by Perla Invest employees responsible for sales, access control and accounting, and are disclosed, to the extent necessary, to:

• NETOPIA Payments, for processing card payments and refunds;
• Brevo (Sendinblue SAS, France), for sending the emails containing tickets, invoices and confirmations;
• Hetzner Online GmbH, for hosting the shop’s servers in data centres in the European Union;
• Cloudflare, Inc. (United States), through its Turnstile service, for the security check on the order form and on the cancellation form, which distinguishes real visitors from automated programs; the IP address and technical data about the browser are processed on the basis of the legitimate interest in protecting the shop and payments against abuse; the transfer takes place under the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework;
• Romarg, for hosting the information website in Romania;
• the accounting services of Perla Invest;
• public authorities, in the cases provided for by law, including the National Agency for Fiscal Administration (ANAF), for the reporting of invoices.

Providers that process data on behalf of Perla Invest do so under a contract and only for the service they provide. The data are not sold or rented.

5. Transfers of data outside the European Union

Order data are stored in the European Union. The Google Maps maps on the website, loaded only with the visitor’s consent, may involve the transfer of certain technical data to Google LLC in the United States, on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework. Details are given in the Cookie policy.

6. Retention periods

• orders, invoices, refunds and cancellation requests: 5 years from the end of the year in which they were issued or sent, the archiving period laid down by Accounting Law No 82/1991, or longer if required by law;
• ticket scans at the stations: 12 months from the expiry of the ticket;
• data used for offers: until consent is withdrawn;
• correspondence not relating to an order or a complaint: no more than 12 months;
• server logs: no more than 90 days, except for those needed to investigate a security incident.

After these periods, the data are deleted or anonymised.

7. Rights of data subjects

Any person whose data are processed has the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent, without affecting the processing carried out before withdrawal.

Requests are sent to office@perlainvest.ro and are answered within one month at the latest. The right to erasure does not apply to data that Perla Invest is required by law to keep, such as invoices.

Complaints about the processing of data may be lodged with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) (dataprotection.ro).

8. Data security

The connection to the website and the shop is encrypted (HTTPS). Access to orders is restricted to authorised employees, each with a personal account and two-factor authentication. The link to each order page is unique and is sent only to the buyer.

Perla Invest never asks for card details by email or telephone.

9. Other information

Perla Invest does not take decisions based solely on automated processing of data and does not create customer profiles.

Online orders may be placed only by adults. Tickets for children are bought by their parents or by other adults.

This policy may be updated. The version in force is the one published on this page, with the date of the last update.