Privacy & GDPR Policy

1. Who controls your data

The data controller is MONKEY MIND SRL, registered in Bucharest, Romania, CUI 35921997, Trade Register number J40/5073/2016, operating The Symbol Room. Privacy requests may be sent to thesymbolroom@gmail.com.

2. Data we may collect

• contact details you provide, such as your name, email and country;
• your reading preference and city-edition interests;
• messages and correspondence sent to us;
• booking, billing and transaction information when reservations open;
• limited technical and security information generated by the website host.

Please do not send health information, financial details or other sensitive personal information through general contact channels.

3. Why we use personal data

• Private-list news: with your consent, to send dates, availability and city-edition announcements.
• Requests and reservations: to respond to you and take steps requested before entering into a contract.
• Confirmed services: to administer appointments, payments, invitations and necessary guest communication.
• Legal obligations: to keep records required by tax, accounting or consumer law.
• Security and administration: where necessary for our legitimate interests in protecting and operating the website.

4. Marketing choices

Joining the private list is voluntary. You may withdraw consent at any time by using the unsubscribe option in a message or emailing us. Withdrawal does not affect processing that was lawful before it.

5. Who receives data

Personal data may be processed by carefully selected service providers for website hosting, email delivery, booking, payments, accounting and technical support. Stripe is the intended payment processor and will receive the information required to complete and protect a transaction once payments are enabled. Full payment-card data will be handled directly by Stripe and will not be stored by The Symbol Room. This notice will identify the other providers when they are connected.

6. International transfers

If a provider processes data outside the European Economic Area, we will use an approved transfer mechanism where required, such as an adequacy decision or standard contractual clauses, together with appropriate safeguards.

7. How long data is kept

Private-list information will be kept while the list remains active or until you withdraw consent. Correspondence is retained only as long as reasonably needed to manage the enquiry and establish relevant records. Booking and transaction records will be retained for the period required by applicable accounting, tax and legal obligations. Provider security logs follow the provider's documented retention schedule.

8. Your GDPR rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it at any time. You also have the right to lodge a complaint with the Romanian data-protection authority, ANSPDCP, or the competent authority in your country.

To exercise a right, contact thesymbolroom@gmail.com. We may need enough information to verify your identity before acting on a request.

9. Security

We use reasonable organisational and technical measures appropriate to the nature of the data and the risks involved. No internet service can promise absolute security, but access will be limited to people and providers who need it for the stated purposes.

10. Updates

We will update this notice when the private list, booking system, payments or new providers are activated. Material changes will be identified by a revised date on this page.