This is the current version, valid at this time, created on 01.03.2026 when the website was launched and updated on 20.03.2026.

This is the Privacy Policy applicable to the website www.haplea.ro  in which we detail the types of information we collect, how it is used and protected, as well as the options available to visitors regarding the use of their own information.

We understand the importance of privacy and we are committed to protecting the personal information of our users. 

We are constantly concerned with the quality, accessibility and clarity of the information presented to data subjects, so if you have a question or concern about the aspects presented, you can send it to brasov@haplea.ro or to the contact details provided below. 

The role and necessity of the Privacy Policy

This document is an information notice through which the organisation describes how it collects, manages and processes the personal data of the users of this website. 

Through this policy, the organisation demonstrates compliance with the principle of accountability provided by the legislation in force, in particular regarding the fairness and transparency of personal data processing. 

Regulation No. 679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as subsequently amended and supplemented, hereinafter referred to as the GDPR Regulation, requires that users be provided with certain information when their data is processed. 

Our objectives are:

• to ensure the transparency of information, communications and the ways in which data subjects can exercise their rights;
• to comply with the legal provisions on the protection of personal data;
• to protect personal data and respect your privacy;
• informing users about how their data is collected, stored and used in order to protect it, comply with the law and promote our legitimate interests (marketing communications, customer information, legal obligations).

This policy takes effect from the date of publication and/or update, as applicable.  

Who we are and how you can contact us

The data controller for www.haplea.ro  is CSS TRADITIONAL SRL, CUI: 41783104, registration number: J08/3179/2019, with its address in Brașov, Bdul. Saturn 38 C.

Contact details

E-mail: brasov@haplea.ro

The purposes and legal basis of data processing

The personal data processed is provided by you online, by phone or directly.

Data will be processed only if there is a legitimate interest, explicit consent or a legal obligation.

Our main purposes for processing your personal data are to communicate with you, for marketing purposes, and to send the newsletter to users who have chosen to receive such information.

These purposes are real, current and lawful. We do not process your personal data for secondary objectives that conflict with the primary objectives for which your personal data was originally collected, except with your prior consent, a legal basis or a legitimate interest. We would like to specify that we do not collect or process data that conflicts with our stated purpose.

We may run e-mail marketing campaigns based on interest profiles, called Custom Audiences, depending on the e-mails you open, the services you access or the objectives you clearly express. Custom Audiences are used in e-mail marketing to send you promotional content.

Only if you have explicitly consented on the Meta platforms can Custom Audiences be used to create personalised audiences so that you receive relevant advertising from us. Using the Meta ADS or Google Adwords platforms, Custom Audiences may be used to develop similar audiences (potential consumer profiles). 

The data collected may be processed for legitimate interest purposes to provide statistics that help us develop new products, make necessary changes, make wiser business decisions or achieve the highest possible standards for potential customers. The data processed is non-sensitive personal data. 

The legal bases for processing your "non-sensitive" personal data are: your consent, a contract to which you are a party, a request from you prior to entering into a contract, a justified request regarding the processing of your personal data, the requirement to comply with a legal obligation to which we are subject, our legitimate interest or that of a third party.

We process your personal data in accordance with legitimate, lawful, real and present interests.

Your rights, freedoms and interests are appropriately protected by us.

We provide comprehensive explanations in this document clarifying how our legal and legitimate interests take precedence over your fundamental interests, rights and freedoms, while respecting and not infringing them. The processing of your "sensitive" personal data is based on the fact that it is publicly available through your actions, such as posting comments on the website or sending it directly to us. We do not collect, retain or process sensitive personal data in any way.

The personal data processed and how it is processed.

We collect personal data from users who provide it voluntarily through web forms, such as booking forms or messages, when you request to subscribe to our newsletter, as well as when we send marketing communications by e-mail or phone.

The information we collect may include, but is not limited to, your name, e-mail address, phone number, company name and address. We may also obtain data directly from you by e-mail or by phone.

When you visit our website, we collect the following data: your IP address, pages visited, date and time of the visit, browser and device used. We specify that this data is collected and processed anonymously, so it is not associated with an identifiable natural person.

When you sign up for our newsletter, we collect the following data: your name, e-mail address and phone number. 

When you send a message through our booking/contact form, we collect the following data: your name, e-mail address, phone number and the data in the message you sent, if applicable.

We use Google Analytics to collect data about how the website is used, including the data mentioned above. Google Analytics uses cookies to collect this data. You can find out more about how Google uses data at https://policies.google.com/privacy. 

In addition, we may collect your personal data through automated profiling processes and automated decisions. Automated profiling processes are used to analyse user behaviour online and to provide personalised recommendations. 

We do not collect any sensitive personal information.

We use your personal data to: 

• respond to messages sent through our booking/contact form;
• send our newsletter;
• improve our website and services; 
• monitor and analyse the use of the website through Google Analytics;
• provide personalised recommendations through automated profiling processes.

We will not use your personal data for purposes other than those mentioned above without your consent.

CSS TRADITIONAL SRL is the organisation responsible for collecting and processing personal data and decides how and why this data is processed. Users are informed through this Privacy Policy.

Information regarding the recipients (or categories of recipients) of the data, the data storage period, details of transfers to third countries, their actions and details of the relevant safeguards 

Recipients of the data

We assure you that we do not collect, process or disclose your sensitive data to third parties.  

However, third parties with whom we have a contractual relationship may process your non-sensitive personal data for our legitimate or legal interests, such as Google Analytics for statistics. 

We only work with internal or external providers who offer us sufficient guarantees of credibility and legality to handle your data. We may share some of your personal data with our providers in order to offer you services free of charge or paid for by CSS TRADITIONAL SRL, but we only do so for specific purposes and categories, such as:

• Accounting and legal services: first and last name, address, personal identification number, entity name, other fiscal data;
• Invoicing services: first name, last name, e-mail address, phone number, address;
• Courier/postal services: first name, last name, e-mail address, phone number, address;
• SMS sending services: phone number;
• Newsletter services: e-mail address;
• E-mail services (SMT): e-mail address, first and last name;
• Online statistics services (Google Analytics and Facebook Pixel Code): actions on the website, duration of a visit, pages visited, purchases, IP. These services do not collect personal data such as first and last name; the applications store and process only actions.
• Comment services: name and e-mail address;

The website may contain links to other websites. Please note that we are not responsible for the privacy practices of other websites. We encourage users to be careful when leaving the website and to read the privacy policies of every website that collects personal information.

Data storage period

We limit the retention of your personal data to the period necessary to fulfil our intended processing objectives. We periodically assess the need to retain your personal data: every year, we review the data collected and processed in order to sort it and keep only the data for which the purpose of processing is still current.

We delete your personal data within a predetermined time frame: one year after the end of your association with us, in the case of concluded communications and in the case of unopened newsletters once the recipient no longer accesses their content, or according to the period established by the legislation in force (e.g. 10 years for commercial contracts and invoices). We also delete your data at your request, except for data whose provision and processing is required by law, which we delete within the legal deadline. 

However, if the retention of your personal data is mandatory for legal purposes, we may retain your personal data.

Data security 

We make sure your personal data is kept safe by implementing appropriate technical and organisational measures and by ensuring an adequate level of security. We take measures to prevent unauthorised or unlawful processing, accidental or unlawful loss, accidental or unlawful destruction, as well as any other accidental or unlawful damage. We have procedures in place to detect possible security breaches, including documenting incidents, identifying the personal data affected, documenting the actions taken to remedy the breach, limiting the consequences and recovering the personal data. 

If there is a reasonable degree of certainty that a breach of the security of the processing of your personal data has occurred, we will notify our company's management and designate a responsible person to analyse the impact of the breach, inform the relevant staff in our organisation and determine whether a notification to the Supervisory Authority is necessary and whether we need to inform you directly about the incident. 

We make efforts to prevent the accidental or unlawful loss of personal data, as well as its alteration, disclosure or unauthorised access. If applicable, we will notify the Supervisory Authority and inform you directly about the security breach and the possible risk to your rights and freedoms. We will do our best to minimise the risk of immediate harm. 

If we have taken appropriate measures to render your personal data incomprehensible to any person who is not authorised to access it, immediately after the security incident, and we have taken measures to ensure that the high risk to your rights and freedoms is no longer likely to materialise, or if it would involve disproportionate effort, we are not obliged to inform you directly about the security incident, but we will make a public notification, in an appropriate manner.

The rights of the data subject 

The rights of the data subject regarding the processing of their personal data under the GDPR are the following:

• The right to be informed: the right to be informed about the collection and processing of personal data.
• The right of access: the right to obtain access to the personal data processed and to obtain information about how it is processed.
• The right to rectification: the right to request the correction of inaccurate or incomplete personal data.
• The right to erasure (the right to be forgotten): the right to request the deletion of personal data where it is no longer necessary for the purpose for which it was collected or processed, or where the data subject withdraws consent.
• The right to restriction of processing: the right to request the restriction of the processing of personal data in certain circumstances, such as contesting the accuracy of the personal data or contesting the lawfulness of the processing.
• The right to data portability: the right to receive personal data in a structured, commonly used and easily readable format and to request its transmission to another data controller.
• The right to object: the right to object to the processing of personal data in certain circumstances, such as processing for direct marketing or processing based on the controller's legitimate interest.

You have the right to request subscription to or unsubscription from the newsletter (content marketing materials, marketing communications, etc.).

In order to exercise these rights, data subjects must send a written request by e-mail. We cannot accept verbal requests without assessing the content of the request and identifying the requester. The request must clearly and precisely describe the right you wish to exercise. In addition, you must provide a copy of an identification document, such as an identity card or a passport, to confirm your identity. Other information in the identity document, such as the photograph, may be covered. We do not accept other ways of confirming your identity, especially where you want us to provide you with the personal data we hold, as this could lead to the disclosure of your data to other people. If you have alternatives to this method of identity confirmation, please let us know and we will assess them individually. We specify that the use of the information in your identity document is limited to confirming your identity and will not lead to your personal data being stored for longer than necessary for this purpose. You will receive a reply to your data protection requests at the e-mail address from which you sent the request, in accordance with the GDPR Regulation and the applicable legal provisions. We will analyse and respond to these requests within the deadlines established by the applicable legal provisions.

If we change/amend our privacy policy, we will publish a new version of it on the website. Upon request, we can provide you with previous versions of our privacy policy.

Automated profiling processes and automated decisions

Our website uses automated profiling processes and automated decisions for the purposes of analysing and improving the user experience and our services. This includes using Google Analytics to collect data about the use of our website and analysing it to identify trends and patterns. This data is processed automatically and used to improve our website and provide a better experience for our users.

Automated decisions refer to situations where decisions are made exclusively through automated data processing, without human intervention. Although we do not directly use automated decisions with regard to your personal data, we may use automated decisions to improve the functioning of our website and to enhance the user experience.

We carry out automated assessments that may include an analysis of your characteristics and predictions about your behaviour, performed exclusively by computerised means, without human involvement.

To ensure transparency and the protection of personal data with regard to automated profiling processes and automated decisions, we will take all necessary measures to protect the rights and freedoms of our users, including ensuring transparency and mechanisms for contesting automated decisions that could have a significant effect on the data subject.

Automated decisions do not have an impact on your rights and do not have a real, significant impact on your circumstances, behaviour or choices.

The legal basis for our processing regarding automated decisions concerning you is processing for the purposes of our legitimate interests or those of a third party.