AZ Tours — Privacy Notice

Last updated: 24 October 2026

Your data, plainly

Thank you for visiting AZ Tours. This notice explains, in plain language, what personal data is involved when you use our website and our WhatsApp service and when you book a trip with us, why we use it, who else sees it, and what you can do about it.

The controller — the company that decides how your personal data is used — is MatDan Eco Tours S.R.L., Bd. Republicii nr. 46, Camera 1, Pitești, Argeș County, Romania.

The AZ Tours name and platform belong to Realty Investments SRL, which licenses them to MatDan Eco Tours S.R.L. Realty Investments SRL does not receive or decide on travellers' personal data.

The short version:

• Browsing the site needs no account, sets no cookies and runs no analytics or advertising trackers.
• What you type into your profile stays in your own browser. It does not reach us.
• We only receive your details when you choose to message us on WhatsApp or book a trip.
• We never sell your data.

Part A — Information required by Articles 13 and 14 GDPR

A1. Who we are and how to reach us

A2. Data Protection Officer

We have not appointed a Data Protection Officer. Our activity does not involve large-scale monitoring of people or large-scale processing of sensitive data, so Article 37 GDPR does not require one. Data-protection questions are handled by the company's administrator at contact@aztours.app.

A3. Purposes and legal bases at a glance

Each purpose is explained in Part B.

Where we rely on legitimate interests, our interest is to run a fast, secure and working website and to handle your request efficiently. You can object at any time (A7).

A4. Who receives your data

• Netlify, Inc. (USA) — hosts the website (B1), as our processor under its data-processing agreement.
• Open-Meteo (Switzerland) — weather data for the ticker (B3).
• WhatsApp Ireland Ltd / Meta Platforms — when you choose to message us (B5).
• Google Ireland Ltd (Google Workspace) — hosts our email at contact@aztours.app, as our processor under its Cloud Data Processing Addendum.
• Travel suppliers delivering your trip — transport, accommodation, guides, venues and activity providers (B6).
• Stripe Payments Europe, Ltd. (Ireland) and the banks involved — when you pay or we refund you (B9).
• Our accountant and public authorities, where the law requires it (for example the tax authority).

Our hosting and service providers act on our instructions under data-processing agreements. Travel suppliers receive only what they need to serve you. We do not sell personal data.

A5. Transfers outside the EU/EEA

• Netlify (USA): Netlify, Inc. is certified under the EU–US Data Privacy Framework, which the European Commission recognises as providing adequate protection (adequacy decision of 10 July 2023). For any onward transfer to a country without an adequacy decision, Netlify uses the EU Standard Contractual Clauses (Decision 2021/914).
• Open-Meteo (Switzerland): Switzerland has an EU adequacy decision.
• Meta / WhatsApp: your messages are processed by WhatsApp Ireland Ltd, which may transfer data to Meta Platforms, Inc. (USA) under the EU–US Data Privacy Framework.
• Google (email): Google Ireland Ltd may transfer email data to Google LLC (USA), which is certified under the EU–US Data Privacy Framework and also uses the EU Standard Contractual Clauses.
• Stripe: Stripe Payments Europe, Ltd. may transfer payment data to Stripe, Inc. (USA), which is certified under the EU–US Data Privacy Framework and also uses the EU Standard Contractual Clauses.
• Suppliers at your destination outside the EU: the transfer is necessary to perform the contract you asked for (Art. 49(1)(b)).

A6. How long we keep data

A7. Your rights

You have the right to:

• access your data and receive a copy;
• correct inaccurate data;
• erase your data, except records the law requires us to keep;
• restrict how we use it;
• receive the data you gave us in a portable format;
• object to processing based on legitimate interests — and to marketing at any time, without giving a reason;
• withdraw consent at any time, without affecting anything done before.

Email contact@aztours.app or message us on WhatsApp. We reply within one month, free of charge. We may ask you to confirm your identity first.

A8. Right to complain

You can complain to the Romanian data-protection authority: ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București · anspdcp@dataprotection.ro · www.dataprotection.ro — or to the authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.

A9. Do you have to give us your data?

Browsing the site requires nothing from you. To answer a request or book a trip, we need your name, a way to contact you and the details of the trip. Without them, we cannot quote or book. Health or dietary details are always optional. Some suppliers may need them to serve you safely.

A10. Automated decisions

We do not make decisions about you based solely on automated processing, and we do not profile you.

Part B — Feature by feature

B1. Visiting the website

When you open aztours.app, your browser sends standard technical data to our hosting provider Netlify: your IP address, browser type, the page requested, and the date and time. Netlify needs this to deliver the page and to protect the site against attacks and misuse. The connection is always encrypted (HTTPS). We do not use this data to identify you.

B2. Typeface

The site's typeface (Archivo) is served from our own host together with the page. Your browser does not contact Google Fonts or any other font provider.

B3. Live weather in the ticker

The ticker at the top of the site shows current temperatures for a fixed list of cities. Your browser fetches them from Open-Meteo, which receives your IP address in the process. We send only the cities' fixed coordinates, never your location. Open-Meteo does not set cookies.

B4. Your profile, saved places and lists — stored on your device

The Me section lets you create a profile (username, age, phone, email, website and social-media links; for companies and institutions also VAT or fiscal code, address, legal representative and bank account), save favourite places, plan journeys and keep a list of friends.

• All of this is saved only in your browser's local storage on this device. It is not sent to us or anyone else.
• When you register, the date and time you accepted this notice and our Terms are saved with your profile, on your device.
• Friends: you choose whom to add — by typing a name, sharing a link, email, or (on supported Android browsers) picking contacts from your phone. Only the contacts you select are added, and they also stay on your device.
• Marking a journey Private or Public does not publish it anywhere today.
• To delete: Me → Options → Delete account, or clear this site's data in your browser settings. Because we never receive this data, we cannot restore it.

No cookies, no tracking. The site sets no cookies and uses no analytics, advertising pixels or social-media plug-ins. Local storage is used only to keep what you yourself chose to save, so no consent banner is needed. If this ever changes, we will ask for your consent before any such technology is used.

B5. Messaging us on WhatsApp

The Send on WhatsApp, Contact, Get listed and Work with us buttons open WhatsApp with a prepared message (for example the trip, date, number of guests, pickup point and a reference code). Nothing is sent until you press send in WhatsApp.

Once you send it, we receive your WhatsApp name, phone number and the message, and use them to answer you and prepare a quote. WhatsApp is run by WhatsApp Ireland Ltd (Meta), which processes your messages under its own privacy policy.

B6. Booking a trip

To organise your trip we use the lead traveller's name and contact details, the names of the other travellers, dates, pickup point and the services booked. Where a supplier or a border requires it, we also use dates of birth, nationality and passport or ID details.

• We pass each supplier only what it needs to deliver its part of the trip.
• If you book for others, please make sure they know you are sharing their details with us.
• Sensitive data: we ask for health, accessibility or dietary information only when it matters for your trip, and use it only with your explicit consent and only for that purpose.
• We keep booking, invoicing and package-travel records because Romanian tax, accounting and tourism law requires it (A6).

B7. Offers and news

We do not currently send marketing. If we start, we will do so only with your separate, explicit opt-in. You can stop at any time by replying STOP on WhatsApp or by emailing us. Messages about a trip you have booked are service messages, not marketing.

B8. Links to other websites

Our pages link to other sites — for example consumer-protection authorities, WhatsApp and destination resources. Those sites are run by others under their own privacy policies. We only link to them. We do not embed them or share your data with them.

B9. Paying for a trip

You pay the full price when you book (see our Terms), in one of two ways:

• Card, through a Stripe payment link that we send you on WhatsApp or by email. The payment page is run by Stripe Payments Europe, Ltd. (Ireland). Stripe collects your card details, name, email and billing country. We never see or store your full card number. We receive the payment status, amount, the name and email you entered and the last four digits of the card. Stripe also uses payment and device data to detect fraud, under its own privacy policy (stripe.com/privacy).
• Bank transfer to the account of MatDan Eco Tours S.R.L. We see what our bank shows us: the payer's name, IBAN, bank, amount and payment reference. We use it to match your payment to your booking and to send any refund back to the same account.

Payment records are kept with the booking and invoice records (A6). Basis: performance of the contract (Art. 6(1)(b)), our legal accounting obligations (Art. 6(1)(c)), and fraud prevention (Art. 6(1)(f)).

Part C — Security and your choices

C1. How we protect your data

• Encrypted connections only (HTTPS with HSTS).
• Strict browser security headers that block the site from loading content from unauthorised sources. The only outside service the page contacts is Open-Meteo (B3).
• No server-side database of website visitors.
• Booking data is accessible only to the people who handle your trip.
• Data-processing agreements with our service providers.

No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authority as the law requires.

C2. Your choices at a glance

C3. Changes to this notice

When we add a feature that uses personal data, we update this notice before the feature goes live and change the "Last updated" date. Significant changes affecting booked travellers will also be sent directly.