Your information.
Handled with care.

Optional traffic analytics

Only if you allow analytics do we load Google Tag Manager container GTM-MHQB8WND. Analytics tags configured in it may process visited pages, referral source, browser, device, IP address and measurement identifiers. The legal basis is consent under GDPR Article 6(1)(a). Refusal does not affect website or contact-form access. We do not put contact names, emails, phone numbers or message contents into the dataLayer.

Google is an additional recipient when analytics is enabled; international transfers use the legal mechanisms described below. Withdraw consent using Cookie preferences in the footer. Withdrawal reloads the page without the container and removes Google analytics cookies accessible to this site; it does not undo earlier processing or automatically delete information already received by Google. Measurement retention depends on the configured tags and service settings; Tag Manager itself is not an Analytics property.

Information and purposes

The form and email enquiries provide your name, email address, subject and message; a phone number is optional. We use them to reply, discuss reservations and organise events. Required fields identify the enquiry and allow a reply; without them the form cannot be used, but you can call us. Please do not send medical details, identity documents or banking information.

Hosting and security providers may process your IP address, requested page, access time, browser/device information and technical abuse-prevention signals. Cloudflare Turnstile checks form use; the server validates its token before sending email. These details support delivery and security, not advertising.

Legal bases

Reservation and event enquiries rely on GDPR Article 6(1)(b): steps at your request before a contract. General correspondence and security rely on Article 6(1)(f): legitimate interests in answering customers and preventing abuse. Applicable legal obligations rely on Article 6(1)(c). Acknowledging this notice is not marketing consent. This form does not subscribe you to newsletters.

Recipients and transfers

Authorised staff and necessary providers may receive information: Vercel for hosting; Cloudflare for R2 images and Turnstile; Brevo for transactional email; and the restaurant's mailbox provider for receiving and replying. Authorities and professional advisers may receive details where legally required or necessary to defend rights. We do not sell information or use enquiries for advertising.

Some providers or subprocessors may process information outside the European Economic Area. Transfers must use mechanisms under GDPR Chapter V, such as an applicable adequacy decision or standard contractual clauses and any necessary supplementary measures. Contact receptie@rodizio.ro for details and a copy of applicable safeguards.

Retention

Our policy for ordinary correspondence is to retain it while resolving the enquiry and for no more than 12 months after the discussion closes, then delete or anonymise it. Contractual, complaint-related or legally required correspondence is retained for the period needed to fulfil obligations, applicable legal time limits and any dispute.

The application does not store messages in a database or include their contents in logs. Mailbox copies and delivery records follow operator and provider retention/deletion rules. Technical security details are kept as needed to prevent, investigate and resolve incidents, according to provider settings and retention terms. Backups follow replacement cycles and legal obligations.

Rights and complaints

Subject to GDPR conditions, you may request access, correction, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We do not make solely automated decisions producing legal or similarly significant effects on you.

Send requests to receptie@rodizio.ro or by post to the registered office. We normally respond within one month; any permitted extension is explained within that period. We may ask only for details needed to verify identity. You may complain to Romania's supervisory authority, ANSPDCP, at www.dataprotection.ro and seek a judicial remedy.

Security and updates

We use HTTPS, restricted server configuration access, validation, spam checks and Turnstile. Internet transmissions cannot be completely risk-free. Updates are published here with a revision date. See the cookies page for browser technologies and external services.