Privacy Policy & Data Protection

1. Introduction & Data Controller Identity

Choicessparkparcl Heritage Expeditions Ltd. ("Choicessparkparcl", "we", "us", or "our"), incorporated and registered under Romanian corporate law with Company Registration Number RO49182049, Fiscal Code J40/1209/2024, having its registered seat at Calea Victoriei 142, Sector 1, Bucharest 010099, Romania, acts as the primary Data Controller for the personal data collected through the digital domain choicessparkparcl.com and associated sub-domains.

We are deeply committed to respecting the dignity, confidentiality, and statutory rights of all visitors, researchers, and prospective travelers. This Privacy Policy details the categories of personal information we process, the lawful bases under which such collection occurs, the security protocols implemented, our retention periods, and the statutory remedies available to you under the General Data Protection Regulation (GDPR) and related international privacy legislation.

2. Categories of Personal Data Collected

Depending upon your voluntary interactions with our web portal, we may process several distinct classifications of personal data:

• Direct Contact & Expedition Inquiries: When you complete our dispatch form or communicate via electronic mail, we collect your full legal name, email address, telephone contact number, desired regional itineraries, party size, and any specific health or cultural preferences disclosed voluntarily in your narrative comments.
• Technical & Telemetric Metadata: Upon visiting choicessparkparcl.com, our web hosting servers automatically record the Internet Protocol (IP) address utilized by your device, browser application version, operating system architecture, referring URL, time zone offset, and date/time timestamps of page requests.
• Usage & Navigation Analytics: We process aggregated and anonymized engagement data, including dwell time on specific castle monographs, scroll depths across our Living Castle hero presentation, and navigation clickstreams, to optimize server throughput and user experience.

3. Lawful Bases for Processing Under Article 6 GDPR

We do not process personal data arbitrarily. In accordance with Article 6(1) of the GDPR, every processing operation relies on one of the following validated lawful bases:

• Article 6(1)(a) — Explicit Consent: Applied when you grant informed, affirmative consent for non-essential analytical cookies or choose to subscribe to our seasonal cultural journals. You hold the unconditional right to withdraw this consent at any time without retroactive penalty.
• Article 6(1)(b) — Performance of a Contract / Pre-Contractual Steps: Required when you request custom route curation, private architectural briefings, or concierge travel logistics, enabling our team to draft formal expedition itineraries.
• Article 6(1)(c) — Compliance with Statutory Legal Obligations: Applicable to our corporate record-keeping obligations under Romanian commercial law, accounting standards, and tax reporting requirements.
• Article 6(1)(f) — Legitimate Interests: Utilized strictly for ensuring the network resilience, threat mitigation, DDoS prevention, and intellectual property enforcement of our heritage depository, provided such interests do not override your fundamental freedoms.

4. Cookies and Automated Tracking Technologies

Our web application utilizes persistent and session cookies to guarantee core user-interface functions and preserve cookie preference selections across page transitions. Technical cookies required for foundational routing and cybersecurity cannot be deactivated without severing application integrity. Analytical cookies tracking aggregated audience interactions are deployed exclusively upon receiving your affirmative choice via our Cookie Consent interface. For an exhaustive, itemized schedule of individual cookies, expiry intervals, and third-party endpoints, refer to our standalone Cookie Policy.

5. Third-Party Data Processors & Cross-Border Transfers

Choicessparkparcl does not sell, rent, monetize, or trade your personal information to marketing conglomerates, data brokers, or advertising networks. We transfer data solely to verified Data Processors bound by stringent Data Processing Agreements (DPAs) compliant with Article 28 GDPR:

• Cloud hosting, content delivery networks (CDNs), and encrypted database infrastructure situated inside the European Economic Area (EEA).
• Enterprise email gateways and customer communication platforms maintaining ISO 27001 certifications.
• Professional legal and accounting advisors registered with Romanian bar associations.

Should any technical processing necessitate the transmission of data outside the European Economic Area, such transfers are strictly executed pursuant to European Commission Standard Contractual Clauses (SCCs) or within territories formally recognized as possessing adequate data protection safeguards.

6. Retention Schedules & Archival Erasure

We maintain a disciplined data minimization protocol. Personal information collected via contact and dispatch forms is retained solely for the duration required to address your inquiries or finalize expedition arrangements, after which it is systematically purged within twenty-four (24) months unless ongoing commercial agreements or statutory Romanian tax mandates (which require financial records to be retained for up to ten years) apply. Technical access logs captured for server perimeter security are retained for a maximum of ninety (90) rolling calendar days before irreversible cryptographic deletion.

7. Statutory Rights of the Data Subject

Under Chapter III of the GDPR, you possess an extensive suite of enforceable statutory rights regarding your personal records held by Choicessparkparcl:

• Right of Access (Article 15): You may request definitive confirmation of whether your data is processed, alongside a complete digital duplicate of all stored records.
• Right to Rectification (Article 16): You may demand the prompt correction of inaccurate, obsolete, or incomplete personal data.
• Right to Erasure ("Right to be Forgotten", Article 17): You may request the irrevocable deletion of your personal records where no overriding legal basis for continued retention exists.
• Right to Restriction of Processing (Article 18): You may restrict processing operations while disputes over data accuracy or legitimacy are formally adjudicated.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) for transfer to another controller.
• Right to Object (Article 21): You may object at any time to processing predicated on legitimate interests, compelling us to cease processing absent verifiable, compelling legitimate grounds.

8. Data Protection Officer & Regulatory Supervisory Authority

To exercise any of the aforementioned statutory rights, or to submit formal inquiries regarding our data protection posture, you may contact our designated Data Protection Officer (DPO) directly via:

If you believe our processing of your personal information infringes statutory privacy regulations, you possess the unalienable right to lodge a formal complaint with the competent supervisory authority:

The National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania
Website: www.dataprotection.ro | Telephone: +40.318.059.211

9. Amendments & Policy Iterations

Choicessparkparcl reserves the formal right to revise this Privacy Policy periodically to reflect technological adjustments, evolving editorial scope, or updates to European Union regulations. Any substantial alterations will be announced via a prominent notice on our website header thirty (30) days prior to entering statutory force.