Privacy Policy

Controller

PetreCatalin, operated by Petre Cătălin Cîrstinoiu, is the controller of personal data processed through this website and in connection with enquiries and catering services.

Data processed

Depending on how you contact us and on the technical operation of the website, we may process your name and contact details; the content of your enquiry and your preferred contact method; event date, general location, guest number and service preferences; quotation, booking and customer-relationship information; email, telephone or WhatsApp communications; and limited technical security and delivery logs generated by the website infrastructure. Following an ordinary link to a third-party website is governed by that third party’s privacy information.

Optional AI chatbot

If you give the separate chatbot consent and select “Enable and open AI chat”, GoHighLevel/LeadConnector and OpenAI are loaded to provide the chat. Before that consent and selection, the website does not send a chatbot request to those providers and does not allow LeadConnector to store or access chatbot identifiers on your device. On activation, LeadConnector stores or accesses page-visit, browser/device-fingerprint, attribution and chat-session identifiers in local storage and contacts its attribution service to associate the page visit with the chat and to create and maintain the chat session. The chatbot may also process your messages and the information you include in them, the chatbot’s replies, date and time, conversation and contact identifiers, and limited device, browser, IP-address, security and delivery data generated when the chat is used. Please do not include health information, detailed allergy information or other sensitive personal data in the chatbot.

We use chat content to answer general questions and, at your request, to qualify and prepare an enquiry or quotation request; the legal basis for that processing is taking steps at your request before entering into a contract. We rely on your consent for the LeadConnector page-visit, browser/device-fingerprint, attribution and chat-session storage or access described above and, where those identifiers are personal data, for their processing for that disclosed purpose. You may withdraw that consent at any time by selecting “Withdraw chatbot consent and clear local identifiers”. Withdrawal does not affect processing carried out before withdrawal. The chatbot is optional, refusal does not affect the rest of the website, and this consent does not cover advertising, direct marketing or any other analytics or profiling.

Chatbot data may be disclosed to authorised PetreCatalin personnel and to our service providers GoHighLevel/LeadConnector and OpenAI, acting for the operation and support of the chatbot. Those providers may use infrastructure or subprocessors outside the European Economic Area. Where personal data is transferred to a country without an applicable adequacy decision, the transfer must be covered by an applicable safeguard, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. You may contact us for information about the applicable safeguard.

Authorised personnel may review chatbot answers and conversations and may manually refine the chatbot instructions to improve the correctness and quality of the service. This human review and prompt refinement is performed for PetreCatalin’s chatbot service; it is not a request to train OpenAI’s general or foundation models.

We delete an abandoned chatbot conversation 30 days after the last interaction. In our browser test, the LeadConnector identifiers carried expiry timestamps of about 30 minutes, although local-storage entries may remain longer until cleared. You can clear the known local identifiers at any time using the chatbot withdrawal control. If a conversation becomes part of an enquiry, we delete the raw chatbot transcript after 30 days and retain only the enquiry information that is necessary to handle the request. If no booking follows, we delete that necessary enquiry information 6 months after the last meaningful contact, unless a longer period is required by law or necessary for the establishment, exercise or defence of legal claims. If sensitive personal data is supplied accidentally, we remove it as soon as practicable after detection, normally within 72 hours. Residual copies in backups are isolated from ordinary use and disappear through the normal, time-limited backup-overwrite cycle.

Purposes and legal bases

We process data to:

• answer enquiries and prepare quotations — steps requested before a contract;
• arrange and perform confirmed services — performance of a contract;
• keep legally required business, tax and transaction records — legal obligation;
• secure the website and prevent abuse — legitimate interests in secure operation;
• establish, exercise or defend legal claims — legitimate interests and applicable law.

Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability, object to legitimate-interest processing or direct marketing, withdraw consent, and request information about transfer safeguards.

Send requests to [email protected]. We may request proportionate identity verification. We normally respond within one month; lawful extensions may apply to complex requests.

You may complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens.

Security, children and changes

We use proportionate access controls, role-based permissions, encrypted connections and organisational safeguards. No internet service is risk-free. The website is not directed at children submitting enquiries independently; a parent or legal representative should contact us where a service concerns a minor.

This Policy may be updated when processing, services or law change. The current version and date will remain published.