Privacy Policy

The controller of personal data is TRIO DIO S.R.L., with its registered office at Str. Soveja 111-113, Et. P, Ap. BIR. 1, Sector 1, București, CUI 54682160, Trade Register no. J2026031504007, operator of the LUMI Rooftop restaurant, at Soveja Street 111-113, Sector 1, Bucharest. For any request concerning your personal data, you can contact us at welcome@campeador-expo.ro or by telephone at +40 740 040 273.

We process data only if you provide it to us directly through the forms on the Website, plus minimal technical data needed for the Website to work:

• Table reservation (Contact page): name, telephone number, email address (if you fill it in), preferred date and time, number of guests and any notes you add (e.g. allergies or special occasions — if you mention allergies, this may indirectly reveal health information; please share only what is necessary)
• Event enquiry: name, telephone number, email address, type of event, estimated date, number of guests and any details you choose to share
• Technical data: your IP address and browser and device data are visible to the servers that deliver the Website (hosting, delivery network, embedded map), in standard technical logs. We do not use traffic analytics tools and we do not use marketing pixels. Cookies and local storage are detailed in the Cookie Policy

The forms on the Website are not intended for persons under 16.

When you submit a form, the data is (a) saved in our internal request-management system, accessible only to authorised staff, (b) communicated to the LUMI team through an internal Telegram notification and (c) prepared in a WhatsApp message addressed to LUMI's number, which you send yourself through the WhatsApp application if you choose to press “Send”. If you prefer not to use WhatsApp, you can call or email us.

• Handling reservations and event enquiries — legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR)
• Communication about your reservation or enquiry (confirmation, changes, reminders) — legal basis: performance of the steps you requested (Art. 6(1)(b)) and, for communications strictly related to the service, our legitimate interest in its smooth delivery (Art. 6(1)(f) GDPR)
• Website security and abuse prevention (e.g. limiting the number of submissions, anti-spam filter) — legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• Sensitive information (allergies), if you include it in your notes — used only to serve you safely; legal basis: consent given by voluntarily providing it (Art. 9(2)(a) GDPR)
• Compliance with legal obligations (e.g. accounting and tax obligations, for invoiced events) — legal basis: legal obligation (Art. 6(1)(c) GDPR)

Providing your identification and contact details is necessary for us to answer your request; without them we cannot handle it. We do not make automated decisions and do not profile you on the basis of your data.

• Reservation and event requests: for the time needed to handle them and, afterwards, for at most 24 months from the date of the request, for internal records and in case you get back in touch; then they are deleted or anonymised
• Notes about allergies: only for as long as necessary for the reservation concerned
• Invoicing data and accounting documents (for invoiced events): in accordance with the statutory archiving periods (generally 5 or 10 years, depending on the document)
• Cookie and language preferences: as set out in the Cookie Policy

We do not sell or rent your data. To run the Website and the service we use providers that act as processors or, where applicable, as independent controllers:

• Vercel Inc. (USA) — hosting of the Website and of its server functions
• Neon, Inc. — the database storing the Website content and the requests received through the forms
• Cloudinary Ltd. — storage and delivery of the Website's images (it does not receive form data)
• Telegram — internal notifications to the LUMI team about requests received (they contain the name, telephone, email and details of the request)
• Meta Platforms Ireland Ltd. (WhatsApp) — only if you yourself send the prepared message via WhatsApp; you initiate this transmission and it is subject to WhatsApp's policy
• Google Ireland Ltd. — the embedded map (Google Maps), see the Cookie Policy
• Public authorities, where required by law; accounting and legal advisers, under a duty of confidentiality

Some of the providers above (in particular Vercel, Telegram and, where applicable, Google and Neon) may process data outside the EU/EEA, including in the USA. Transfers rely on the safeguards provided by the GDPR: the adequacy decision on the EU–US Data Privacy Framework, for certified providers, or the European Commission's standard contractual clauses. You can request a copy of the safeguards at welcome@campeador-expo.ro.

Under the GDPR, you have the right to request:

• Access to the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure of data (the “right to be forgotten”), under certain conditions
• Restriction of processing, under certain conditions
• Data portability, in a structured format
• Objection to processing based on legitimate interest
• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal

To exercise these rights, write to us at welcome@campeador-expo.ro. We will reply within one month of receiving your request (extendable by up to two further months in complex cases, with notice to you). You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral Gheorghe Magheru Blvd., Sector 1, Bucharest — dataprotection.ro.

We apply reasonable technical and organisational measures: encrypted connection (HTTPS), access to requests only for authorised staff, authentication in the administration panel, and limits on abusive submissions. No method of transmission over the internet is completely secure, however. In the event of a personal data breach posing a risk to you, we will act in accordance with Articles 33–34 GDPR.

This policy may be updated from time to time, including when we add new tools (for example traffic analytics). The date of the latest update is shown at the top of the page.