Last updated: 31.07.2026
1. Who we are
The operator of this website is Asociația Castel Teleki – Teleki Kastély, with its registered office in Gornești village, Gornești commune, No. 479, Mureș County, Romania.
Website address: https://telekicastle.com
Contact e-mail for data protection matters: telekicastle@gmail.com
This policy explains what personal data we collect, for what purpose, on what legal basis, with whom we share it, and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR).
2. What data we collect and why
2.1. Contact form
When you write to us via the contact form (Contact Form 7), we collect the data you enter: your name, e-mail address and the content of your message. This data is sent to us by e-mail so that we can respond to your request.
Legal basis: our legitimate interest in responding to messages received (Art. 6(1)(f) GDPR), or, where the message concerns a possible collaboration or booking, pre-contractual steps (Art. 6(1)(b) GDPR).
Retention period: we retain correspondence for as long as necessary to handle your request and, subsequently, for a reasonable period for record-keeping purposes.
2.2. Newsletter subscription
If you subscribe to our newsletter, we collect your e-mail address and, optionally, your name. This data is processed through the Brevo platform (Brevo SAS), which acts as our processor.
Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the box in the form.
Retention period: until you withdraw your consent. You may unsubscribe at any time via the link in every e-mail or by writing to the address above.
Brevo’s privacy policy: https://www.brevo.com/legal/privacypolicy/
2.3. Automatically collected data
When you access the website, the server automatically records technical information: IP address, browser type and version, operating system, date and time of access, and pages visited.
Legal basis: our legitimate interest in ensuring the operation, security and stability of the website (Art. 6(1)(f) GDPR).
2.4. Media files
If you upload images to the website (where this is possible), we recommend avoiding images that contain embedded location data (EXIF GPS), as this can be extracted by visitors.
3. Cookies
A cookie is a small text file stored in your browser.
Strictly necessary cookies – ensure the basic functioning of the website (session, security, language preferences). These do not require consent.
Analytics and marketing cookies – are placed only with your prior consent, given via the cookie banner. You may withdraw your consent at any time through the banner settings.
4. Third-party services
The website uses the following third-party services. These may collect personal data (including your IP address) and place cookies.
4.1. Google Analytics
We use Google Analytics (Google Ireland Limited) to understand how the website is used and to improve it. The service collects data on pages visited, visit duration and technical information about your device.
Legal basis: your consent (Art. 6(1)(a) GDPR).
Google’s policy: https://policies.google.com/privacy
4.2. Meta (Facebook) Ads / Meta Pixel
We use advertising tools provided by Meta Platforms Ireland Limited to measure the effectiveness of our campaigns and to display relevant advertisements. This may involve the transfer of data to Meta and the creation of advertising audiences.
Legal basis: your consent (Art. 6(1)(a) GDPR).
Meta’s policy: https://www.facebook.com/privacy/policy
4.3. Google Search Console
We use Google Search Console to monitor the website’s performance in search results. The service provides aggregated data and does not identify individual visitors.
4.4. Google Fonts
The website may load web fonts provided by Google. When a page is displayed, your browser establishes a connection to Google’s servers, which therefore receive your IP address.
Legal basis: our legitimate interest in ensuring a consistent presentation of the website (Art. 6(1)(f) GDPR).
Further information: https://developers.google.com/fonts/faq
4.5. Google Maps
Certain pages may include maps provided by Google Maps. When a map loads, Google receives your IP address and, if you are logged in to a Google account, may associate the visit with that account.
4.6. YouTube
Certain pages may include video content hosted on YouTube (Google Ireland Limited). When a video is loaded or played, a connection is established with YouTube’s servers, which are informed about the pages you have visited. If you are logged in to your YouTube account, your browsing behaviour may be associated with your profile.
Google/YouTube policy: https://policies.google.com/privacy
4.7. Instagram / Meta
The website displays content from our Instagram account (Meta Platforms Ireland Limited). When this content loads, a connection is established with Meta’s servers.
4.8. Embedded content from other websites
Pages on this website may include embedded content (videos, images, articles). Embedded content from other websites behaves in exactly the same way as if the visitor had visited the other website. These websites may collect data about you, use cookies, and monitor your interaction with the embedded content.
5. Tickets
Ticket sales are handled through an external platform (bilete.visitmures.com). We do not process or store any payment or ticket data. The privacy policy of that platform applies to any processing carried out there.
6. Who we share your data with
We do not sell or rent your data. We may share it only with:
- the service providers listed above (Brevo, Google, Meta), acting as processors or independent controllers;
- our web hosting provider;
- public authorities, where we are under a legal obligation to do so.
Some of these providers may transfer data outside the European Economic Area. In such cases, the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission or an adequacy decision (for example, the EU–US Data Privacy Framework).
7. How long we retain your data
We retain data only for as long as necessary for the purpose for which it was collected, or for as long as the law requires. Newsletter data is retained until consent is withdrawn.
8. Your rights
Under the GDPR, you have the right:
- to access your data;
- to rectify inaccurate data;
- to erasure (the “right to be forgotten”);
- to restriction of processing;
- to data portability;
- to object to processing based on legitimate interest;
- to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand;
- to lodge a complaint with the supervisory authority.
To exercise these rights, please write to us at telekicastle@gmail.com. We will respond within one month.
The supervisory authority in Romania:
The National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest
www.dataprotection.ro
9. Security
We apply reasonable technical and organisational measures to protect data against unauthorised access, loss or disclosure. The website uses a secure connection (HTTPS).
10. Minors
The website is not specifically directed at children, and we do not knowingly collect data from persons under the age of 16 without the consent of the holder of parental responsibility.
11. Changes
We reserve the right to update this policy. The current version is always available on this page, with the date of the last update indicated at the top.
