Privacy Policy

The privacy of your data is a priority for us. This policy explains what data we collect through rivorestaurant.ro, for what purpose, on what legal basis, and what your rights are, in accordance with Regulation (EU) 2016/679 ("GDPR") and Romanian Law no. 190/2018.

1. Data controller

VIKING SRL, VAT ID 22759290, Trade Register J05/2891/2007, registered office Aleea Ștrandului 3, 410541 Oradea, Bihor, Romania. Email: privacy@rivorestaurant.ro.

We have not appointed a Data Protection Officer (DPO), as our processing activities do not meet the conditions of Art. 37 GDPR. For any data-related request, contact us at the email above.

2. Categories of data collected, purposes and legal bases

2.1 Reservation form

Data collected: name, phone number, date, time, number of guests, area (interior / pontoon / garden), notes.

Purpose: processing and confirming your reservation request by phone.

Legal basis: Art. 6(1)(b) GDPR - pre-contractual measures at your request.

Storage: data is NOT stored in a database on the site. It is forwarded in real time to RIVO staff via email to process the reservation. Confirmation is made exclusively by phone, at the number you provide. Messages and emails are kept for a maximum of 30 days after the reservation date, then deleted.

Obligation to provide data: providing the fields marked as mandatory in the form (name, phone, date, time) is necessary to process your request. Without this data we cannot confirm your reservation. Optional fields (area, notes) do not affect confirmation.

Further communications: the phone number may be used for the occasional communications described in section 2.6. You can unsubscribe at any time.

2.2 Communication via email or phone

Data collected: email address, phone number, message content.

Purpose: responding to enquiries, operational communication.

Legal basis: Art. 6(1)(b) GDPR - pre-contractual measures where the enquiry aims at entering a service agreement; or Art. 6(1)(f) GDPR - our legitimate interest in responding to business correspondence and maintaining operational relations with persons who contact us.

Storage: maximum 12 months, unless legal retention obligations apply.

Obligation to provide data: providing contact details is voluntary; without them we cannot respond to your enquiry.

Further communications: the phone number may be used for the occasional communications described in section 2.6. You can unsubscribe at any time.

2.3 Server log data

Data collected: IP address, user agent, date and time, requested page, response code.

Purpose: security and proper operation of the site, abuse prevention.

Legal basis: Art. 6(1)(f) GDPR - our legitimate interest in ensuring the security and proper functioning of the site, and in detecting and preventing cyberattacks and abuse of our infrastructure.

Storage: maximum 30 days.

2.4 Cookies and similar technologies

For details see the Cookie Policy.

2.5 Analytics (Google Analytics 4)

Data collected: pseudonymous device identifier, truncated IP, navigation events, device type, traffic source.

Purpose: statistical analysis of site usage.

Legal basis: Art. 6(1)(a) GDPR - consent. This data is collected only if you accept analytics cookies via the consent banner.

Storage: maximum 2 months at Google Analytics level.

2.6 Occasional WhatsApp communications (own events and offers)

Data used: name, phone number - collected via the reservation form or the contact form.

Purpose: occasional information about events, special menus, offers and operational announcements from the RIVO brand - including RIVO Restaurant & Lounge and RIVO Loco.

Legal basis: Art. 6(1)(f) GDPR - our legitimate interest in maintaining the relationship with our customers and informing them about our own similar services; Art. 12(2) Romanian Law no. 506/2004 - commercial communications regarding similar products and services of the same operator, with a free right to object both at collection and in every message.

Content: exclusively communications from the RIVO brand - RIVO Restaurant & Lounge and RIVO Loco. We do NOT sell, rent or share your data (name, phone number, email) with third parties for marketing, advertising or profiling. The only recipients are our technical providers listed in section 3, strictly for service operation.

Storage: until you object.

Free unsubscribe, anytime:

• reply DEZABONARE to any WhatsApp message;
• or email privacy@rivorestaurant.ro.

Right to object: Art. 21 GDPR - at any time, without justification, without retroactive effect on previous processing.

3. Recipients and processors

Your data may be transmitted to the following processors, exclusively for the purposes described above and under data processing agreements:

Provider	Capacity	Role	Location
Cloudflare, Inc.	Processor	CDN, security, anti-bot (Turnstile), DNS	USA / global
GTS Telecom SRL	Processor	SMTP provider (email transmission)	Romania (EU)
WhatsApp Ireland Ltd. / Meta Platforms, Inc.	Independent controller	Internal staff notifications and occasional customer communications (events, RIVO own offers)	Ireland / USA
Google Ireland Ltd. / Google LLC	Processor	Analytics (Google Analytics 4)	Ireland / USA
Cookieframe	Processor	Consent management platform (CMP)	EU

Independent controllers (direct connections from your browser): when the interactive map on the Contact page loads, your browser connects directly to the servers of CARTO, Inc. (USA) and OpenStreetMap Foundation (UK), which receive your IP address as independent controllers. Please consult their respective privacy policies for information about their own processing.

Data may be disclosed to public authorities only on the basis of a legal obligation.

4. International transfers

Some of our processors (Cloudflare, Google, Meta) also process data outside the European Economic Area (USA). Such transfers are covered by:

• the EU-US Data Privacy Framework, for certified companies;
• Standard Contractual Clauses (SCC) approved by the European Commission.

Transfers to the United Kingdom are covered by the adequacy decision adopted by the European Commission under Art. 45 GDPR.

5. Retention period

Data is kept only for as long as necessary for the purposes for which it was collected, in accordance with the periods stated for each category. Upon expiry, data is deleted or anonymised.

6. Your rights

Under the GDPR you have the following rights:

• right of access - to obtain confirmation of processing and a copy of the data;
• right to rectification of inaccurate data;
• right to erasure ("right to be forgotten");
• right to restriction of processing;
• right to data portability;
• right to object to processing based on legitimate interest;
• right to withdraw consent at any time, without affecting the lawfulness of prior processing;
• right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP): Bd. G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest; tel. +40 318 059 211; email anspdcp@dataprotection.ro; www.dataprotection.ro.

To exercise any right, write to privacy@rivorestaurant.ro. We will respond within 30 days.

7. Data security

We implement reasonable technical and organisational measures to protect data against unauthorised access, loss or disclosure: HTTPS connections, restricted access to internal systems, secure passwords, access logging, security updates.

8. Automated decisions and profiling

We do not make automated decisions with legal effect on you and we do not perform profiling within the meaning of Art. 22 GDPR.

9. Changes to the policy

We reserve the right to update this policy. The applicable version is the one published on the Site at the time of access. Significant changes will be notified on the site.

10. Contact

For any question regarding data processing: privacy@rivorestaurant.ro.