Draupnir Adventures

Privacy Policy

Last updated: 2026-09-14

Quadventures SRL (tax code 52147692, registered office: [to be completed: registered office]) is the controller of the personal data collected through this website. This notice is made under Regulation (EU) 2016/679 (GDPR) and sets out what we process, why, and for how long.

Data-protection questions go to: [to be completed: data-protection e-mail address].

What we process, and on what basis

  • Booking and performance of the contract — name, e-mail, phone, tour date, number and age of participants, billing details. Basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Account — e-mail, password hash, booking history. Basis: performance of a contract.
  • Payment — the transaction identifier and its status. We never see or store card details: payment happens on Stripe's own pages. Basis: performance of a contract.
  • Invoicing and accounting — the details on the invoice. Basis: legal obligation (Art. 6(1)(c)).
  • Contact form — name, e-mail, message. Basis: our legitimate interest in answering you (Art. 6(1)(f)).
  • Newsletter — e-mail address. Basis: consent (Art. 6(1)(a)), withdrawable at any time.
  • Declaration of fitness — fitness to take part. This may be a special category of data; we process it only on explicit consent and for the safety of the tour (Art. 9(2)(a)).
  • Statistics — see the cookie policy. Basis: consent.

Who we share it with

Our processors have access only as far as providing the service requires:

  • Stripe — card payment processing.
  • Oblio — invoicing.
  • Cloudflare R2 — storage of uploaded images.
  • Railway — hosting of the site and the database.
  • [to be completed: e-mail provider] — sending system messages and the newsletter.
  • Google Analytics — only where you have consented.

We disclose data to authorities only where the law requires it. We do not sell data.

Transfers outside the EEA

Some of our providers (Stripe and Google among them) may process data outside the European Economic Area. Where they do, the transfer rests on the European Commission's standard contractual clauses or on an adequacy decision.

How long we keep it

  • Invoices and accounting records: 10 years, under Romanian Accounting Law 82/1991.
  • Booking data: [to be completed: how long account data is kept].
  • Account: until you ask us to delete it, then only as far as the accounting obligation above requires.
  • Newsletter: until you unsubscribe.
  • Contact messages: a reasonable period after the enquiry is closed.
  • Statistics: for the period given in the cookie policy.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to object to processing based on legitimate interest, and to data portability. Consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Requests go to [to be completed: data-protection e-mail address]. If you believe we are processing your data unlawfully, you may complain to the Romanian data-protection authority (ANSPDCP, dataprotection.ro).