Privacy Policy
Document AVX-06 · Version 3.2 · In force from 1 September 2026
1. Who we are
Prime Gold Living SRL, trading as AVEXA Stays, is the data controller for the personal data described in this policy.
| Controller | Prime Gold Living SRL |
|---|---|
| Registered office | Str. Fibrei 28, Sector 2, 020342 București, Romania |
| CUI / Trade Register | RO52265361 / J2025057993006 |
| Privacy contact | office@avexastays.com |
| Data Protection Officer | Not appointed — not required under Art. 37 GDPR for our scale of processing. Privacy questions go to the address above. |
2. What we collect and why
We collect only what we need to host you legally and well. Each purpose has a legal basis under Article 6 GDPR:
| Data | Purpose | Legal basis |
|---|---|---|
| Name, contact details, billing address | Managing your booking and your stay | Art. 6(1)(b) — performance of a contract |
| Identity-document details of every guest (passport or national ID card — text details only, never photographs or scans) | Mandatory registration of tourists at arrival under Government Decision 237/2001; reporting non-EU nationals to the immigration authority | Art. 6(1)(c) — legal obligation |
| Payment and transaction data | Taking payment, refunds, evidenced damage claims | Art. 6(1)(b) and Art. 6(1)(c) for accounting |
| Booking, stay and service preferences | Delivering the stay and the extras you request | Art. 6(1)(b) |
| Messages with our online reception (WhatsApp, e-mail) | Guest support and record of what was agreed | Art. 6(1)(b) and Art. 6(1)(f) — our legitimate interest in resolving disputes |
| Damage evidence (photographs, reports) | Establishing, exercising or defending a claim | Art. 6(1)(f) — legitimate interest |
| Marketing emails, if you opt in | Offers and news about AVEXA apartments | Art. 6(1)(a) — consent, withdrawable at any time |
| Website cookies and analytics | See our Cookie Policy | Consent, except strictly necessary cookies |
WHAT WE DO NOT DO
We do not sell your data. We do not profile you. We do not use automated decision-making that produces legal effects for you. We do not install cameras or any recording device inside our apartments — not in any room, not on any balcony.
3. Who we share it with
Stripe Payments Europe Ltd. — payment processing. Full card numbers are never stored on our systems.
IT, hosting and booking-system providers — to run the website, the Guest Portal and the smart locks, under written data-processing agreements.
Booking platforms — where you booked through them, and only as needed to manage that reservation.
Public authorities — tourism, police and immigration authorities, and ANAF, strictly where Romanian law requires it.
Our accountant and, if needed, our lawyer — under professional confidentiality.
4. International transfers
Our data stays in the European Economic Area wherever possible. Where a provider processes data outside the EEA, we rely on an adequacy decision of the European Commission or on the Standard Contractual Clauses, and we can send you a copy of the safeguards on request.
5. How long we keep it
| Data | Retention |
|---|---|
| Booking and stay records | 3 years from the end of the stay (limitation period for contractual claims) |
| Financial and billing records | 10 years, as required by Romanian accounting and tax law |
| Guest registration records (arrival/departure forms) | 5 years, as required by Government Decision 237/2001, then deleted |
| Damage evidence | Until the claim is resolved, then 3 years |
| Guest messages | 2 years |
| Marketing consent | Until you withdraw it, then a suppression record only |
6. How we protect it
Access is limited to the two owners and the specific staff who need it for a task.
Identity documents are stored encrypted and are never sent over WhatsApp or ordinary email.
Access PINs are unique per booking and expire at check-out.
We keep a record of processing activities and review it annually.
7. Your rights
Under the GDPR you have the right to access your data, to have it corrected, to have it erased where no legal obligation requires us to keep it, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out.
Write to office@avexastays.com. We answer within one month, and will tell you if we need to extend that period.
YOUR RIGHT TO COMPLAIN
If you are not satisfied with how we handle your data, you may lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, București — dataprotection.ro. You may also complain to the authority in your own country of residence.
8. Children
Our service is not directed at children. Bookings can only be made by adults. Where children stay as part of a booking, we collect only the identity data required by law and only from the accompanying adult.
9. Changes
We may update this policy to reflect changes in law or in how we work. The current version is always published at avexastays.com, with the date it took effect.
AVEXA Stays is a trading name of Prime Gold Living SRL, Str. Fibrei 28, Sector 2, 020342 București, Romania. CUI RO52265361, Trade Register J2025057993006. Contact: office@avexastays.com, +40 721 347 642.