Privacy policy

1. Who is responsible

7HILLS S.R.L., Strada Regele Ferdinand 5, 550200 Sibiu, Romania, registered under CUI 54440434 and trade register number J2026022943004, operates this website and the two studios at Strada Tribunei 21, Ap. 7, 550176 Sibiu.

For any question about your data, write to stay@7hills.studio or call +40 000 000 000. We have not appointed a data protection officer; the company is too small to be required to.

2. What we collect, and why

When you browse. Our server records the usual request data: your IP address, the time, the page requested, the referring page and your browser's user agent. These logs are size-limited and rotate automatically, they are never linked to a booking, and we use them only to keep the site running and to spot abuse. Legal basis: our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR).

When you book. We ask for your first and last name, your email address and optionally your telephone number and a message. We store this together with your dates, the number of guests, the studio and the price. We need it to enter into and perform the accommodation contract with you (Art. 6(1)(b) GDPR).

When you pay. Payment is handled by Stripe. Your card number never reaches our servers — you enter it on Stripe's own payment page. We receive only whether the payment succeeded, a payment reference and the email you gave Stripe.

When you offer us your apartment. If you use the form on the owners page, we receive your name, email address and — if you give them — your telephone number, the town and what you tell us about the property. We use it only to answer you. It is not stored in a database: the enquiry becomes an email and stays in our mailbox. Basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

When you send us photographs or documents. The form on the owners page lets you attach images and PDF files. They are not stored on our server: they become attachments to the email that carries your enquiry, and after that they live only in our mailbox. Your browser shrinks images before sending, so the original file — with everything the camera wrote into it — never leaves your device.

What we do not do. We use no analytics, no advertising pixels, no tracking of any kind, and we do not profile you or make automated decisions about you. We do not buy or sell personal data.

3. Storage in your browser

This site stores two small values on your device: your chosen language and whether you prefer the light or dark appearance. Both are strictly necessary to deliver the site as you asked for it, they never leave your device, and they are not used to recognise you. For that reason we do not ask for consent and you will not see a cookie banner.

3a. Cameras at the entrance

Cameras (Reolink) are installed at the entrance to the building. What follows is the complete account of what they do and what they do not.

Purpose and basis. They exist for the security of the property and its guests, and to establish what happened in case of damage or unauthorised entry. The basis is our legitimate interest (Art. 6(1)(f) GDPR).

What is recorded. The immediate entrance area only. Not the inside of the studios, not the public pavement, not the neighbours' doors. No audio is recorded.

For how long. Recordings are overwritten or deleted automatically after 72 hours. Footage is kept by hand only where a specific incident has to be documented, and then only while it is being dealt with.

What does not happen. No facial recognition, no automated analysis, no profiling, no matching against other data. The recordings are not passed to anyone — not to platforms, not to service providers, not to third parties. The single exception is where the law obliges us, for instance on an order from the police or a court.

Your rights here. You may object to the recording on grounds relating to your particular situation (Art. 21 GDPR), and you may ask for access to footage concerning you. Write to stay@7hills.studio, giving the date and approximate time — without them we cannot find you in the recordings.

A sign at the entrance gives notice of the cameras before you enter the area.

4. Who else sees your data

Beds24 — our channel manager, and the single calendar behind this site, Airbnb and Booking.com. Your name, email address and stay dates are transmitted so the booking exists in one place and the dates close everywhere at once.

Stripe — payment processing. Stripe acts as an independent controller for payment data. See stripe.com/privacy.

Hetzner Online GmbH, Germany — hosts the server and the database. A data processing agreement is in place.

Migadu — delivers the booking confirmation to you. Your name, email address and the details of your stay pass through it.

Nobody else. We do not pass your data to advertisers, and we disclose it to authorities only where the law obliges us to.

Transfers outside the EU. Stripe is part of a group with US entities; transfers are covered by the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.

5. Legal obligations we cannot opt out of

Romanian law requires accommodation providers to keep a register of guests and, for foreign nationals, to report stays to the authorities. Romanian accounting and tax law requires invoices and supporting documents to be kept. Where we process your data for those reasons the legal basis is Art. 6(1)(c) GDPR, and we cannot delete that data on request until the retention period ends.

6. How long we keep things

Data	Kept for
Server logs	Rotated automatically, size-limited
Booking and guest data	Duration of the stay, then as accounting and guest-register law requires
Payment records	As required by Romanian accounting law
Email correspondence	2 years, unless it belongs to a booking
Owner enquiries and their attachments	2 years, or until you ask us to delete them
Entrance camera footage	72 hours, automatically
Door codes	Deleted automatically after checkout
Owner enquiries	2 years, or until you ask us to delete them

7. Your rights

You may ask us for a copy of your data, for corrections, for erasure, for restriction of processing, for portability, and you may object to processing based on legitimate interest. Write to stay@7hills.studio and we will answer within one month.

If you believe we are handling your data unlawfully you can complain to the Romanian supervisory authority:

Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, 010336 Bucharest — dataprotection.ro

You may also complain to the authority where you live.

8. Changes

If we change how we handle data we will update this page and change the date at the top. The version in force is the one published when you book.