Privacy policy

Who is responsible

The controller is HAMBASAN VLAD-CASIAN PFA (CUI 53218600), Strada Livezii 1E, 555300 Cisnădie, Sibiu, Romania. You reach us at powerriders.tours@yahoo.com or +40 747 496 223 / +40 745 696 110. We have no data protection officer; the law does not require one for a business of our size, and every question about your data goes to the same address.

The booking request

When you send a request through the form or the race support form, we receive what you typed: your name, email address, phone number, language and message; for a tour, the plan, the riding days, the number of riders and the start date, the race week or that you are not sure yet; for race support, your country, preferred contact channel and the package. With your marketing consent, the request also says which ad or link brought you to the site. We use it for one thing: to answer you and, if you go ahead, to prepare the offer and the contract. The legal basis is the steps taken at your request before a contract (GDPR art. 6(1)(b)).

The request is sent to our inbox by email, a copy goes to your address, and our server keeps the request as a file, with the time it was received and the time you ticked the consent box, and deletes that file 24 months after it arrived. We keep requests for 24 months after our last exchange, then delete them; requests that turn into a booking are kept with the booking records for as long as accounting law requires.

If you choose to continue on WhatsApp, you open a conversation with us in the WhatsApp app under Meta's own terms; the message text is prepared in your browser and nothing is sent until you press send in WhatsApp.

Measurement, only with your consent

Google Analytics 4 tells us which pages are read and how visitors move through the site. Google Ads conversion measurement counts a sent request or a phone call so we can judge our ads. Neither runs until you accept it in the consent dialog, and both stop when you withdraw consent under Cookie settings, in the footer or beside the booking form. The legal basis is your consent (GDPR art. 6(1)(a); Legea 506/2004 art. 4). Google Analytics 4 does not log or store IP addresses. What is stored on your device is listed in the cookie policy.

Google Ireland Limited processes this data for us and transfers part of it to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognises as adequate protection (decision of 10 July 2023).

Instagram videos, only with your consent

The reels on the home and tours pages are embedded from Instagram (Meta Platforms Ireland Limited). A reel loads only after you press play on it and only with your marketing consent; until then nothing is loaded from Instagram. From then on, Instagram receives your IP address and may set its own cookies. The legal basis is your consent (GDPR art. 6(1)(a); Legea 506/2004 art. 4), which you can withdraw at any time under Cookie settings, in the footer or beside the booking form.

YouTube videos, only when you press play

The home page shows two videos by Enduro KeX that are hosted on YouTube (Google Ireland Limited). Until you press play, nothing is loaded from YouTube: the picture you see is a copy on our own server. When you press play on one of them, it loads from youtube-nocookie.com, YouTube's privacy enhanced mode; from then on Google receives your IP address and the technical data of your browser, and YouTube's player stores some data in your browser (listed in the cookie policy). The legal basis is your consent, given by pressing play on a video (GDPR art. 6(1)(a); Legea 506/2004 art. 4); it covers that one video, and you withdraw it by not pressing play again and by clearing the site data of youtube-nocookie.com. Google decides what it does with the data under its own privacy policy, policies.google.com/privacy, and may transfer it to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework.

Technical data

Our hosting provider records the IP address, the page requested, the time and the browser type in server logs for security and to keep the site running (GDPR art. 6(1)(f), legitimate interest). Logs are kept for a short, fixed period by the provider and are not used to identify visitors. When you send a request, our server counts the requests from your IP address over ten minutes to block abuse; the counter is named by a one-way hash of the address, not by the address itself.

Who else sees your data

• Host Gate SRL, Romania, hosts the site, receives the technical data above, sends the two emails of a booking request through its mail server and keeps each request on its server.
• Yahoo EMEA Limited, Ireland, provides the inboxes in which our team receives your request by email, and stores those emails.
• Google Ireland Limited, only with your consent, for analytics and ad measurement.
• Meta Platforms Ireland, only if you choose to continue on WhatsApp.
• Meta Platforms Ireland Limited, only with your consent and only after you press play on an Instagram video.
• Google Ireland Limited (YouTube), only after you press play on a YouTube video.
• Nobody buys, rents or otherwise receives your data. We never send marketing emails unless you asked for them.

Your rights

You can ask what we hold about you, have it corrected or deleted, restrict or object to its use, receive a copy in a common format, and withdraw any consent at any time without affecting what was done before. Write to powerriders.tours@yahoo.com; we answer within one month.

You can also complain to the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, anspdcp@dataprotection.ro, +40 318 059 211.

Two more things

• We make no automated decisions about you.
• The tours are for adults; the site is not aimed at children and we do not knowingly collect data from anyone under 18.