Your rights

The assistant has no accounts and asks for no identifying data, and IP addresses are not stored — so we cannot look your conversations up by name. The link between you and your data exists in two ways, and only these:

• The session on your device — the chatbot_session cookie in the browser you used for the conversation. It is the “key” to your conversations: from the same device and browser, for as long as the cookie exists (it expires after 7 days), the conversations tied to it can be found and deleted.
• An e-mail address you left voluntarily — if you chose to leave an e-mail address in a conversation, it is stored next to that conversation and we can use it to find it at your request.

This also means an honest limit, provided for by the GDPR itself (Art. 11): if you write to us with neither of these two anchors, we have no way of telling which conversations are yours — and we will not collect additional data about you just to identify you. We will tell you so in our reply, and your rights remain exercisable whenever you can give us one of the two anchors.

When you use the chat, the following is kept: your messages and the assistant's answers, the technical metadata of the conversation, the itineraries built in it and — only if you left it yourself — your e-mail address. All of it is tied to the anonymous session on your device, described above. The full list, with purposes and legal bases, is in the Privacy Policy.

Deleting the current session's conversations is an operation the platform performs for the session on your device: it permanently deletes, from the database, all conversations tied to the chatbot_session cookie in this browser — messages, metadata and any e-mail address left in them. The operation is irreversible and does not affect the conversations of other devices or sessions, because your session has no link to them.

If you no longer have access to the device or browser you used for the conversation, deletion is done by request to the controller: write to us at contact@taradornelor.online with the anchor you have (usually the e-mail address left in the conversation), and we will delete the conversations found by it.

You have the right to find out whether we process data relating to you and to receive a copy of it. Here, in practice: we can send you the conversations found by the anchor you give us — the session on your device or the e-mail address you left voluntarily — together with the information about the processing, which you can also find in the Privacy Policy. The history of your current session is in any case visible directly in the chat window on this device, for as long as the session is active.

You have the right to correct inaccurate data concerning you. In an anonymous conversation, the only data “about you” that you truly hold is the e-mail address left voluntarily: on request we correct it or remove it from the conversation. The messages themselves are a historical record of the dialogue — they are not retroactively “corrected”, but they can be deleted in full (see the right to erasure below). And if the assistant answered something wrong about the destination, we are glad to hear it: we correct the information in the knowledge base.

You have the right to ask for your data to be deleted — and this is the right with the most direct application here. The platform currently applies no automatic deletion period for conversation history (we say this openly in the Privacy Policy too), so deletion at your request is the real mechanism by which history disappears:

• the conversations of the session on this device — through the operation described in the Your conversation data section, which deletes them permanently;
• conversations you can no longer access — by request to contact@taradornelor.online, with the anchor that can find them.

Deletion is permanent. The aggregate statistics about unanswered requests have no link to your session, so they contain nothing about you to delete.

You have the right to ask that your data only be stored, with no other processing — for instance while we verify a challenge you raised about its accuracy, or if you prefer restriction over deletion. On request, we mark the conversations found and they are no longer used in any way (not even as conversation context) until the matter is resolved. Send the request to contact@taradornelor.online.

You have the right to object to processing based on the controller's legitimate interest — here, the technical anti-abuse protections and the aggregate statistics about unanswered requests, described in the Privacy Policy. You can write to us with your objection at any time, and we assess it against your specific situation. For processing based on consent — the conversation itself — you do not need to object: you simply withdraw your consent, on the privacy policy page, or stop using the chat; nothing on the public site depends on it. The data is not used for direct marketing, so there is no such processing to object to.

You have the right to receive the data you provided to us — here, the messages of your conversations and the e-mail address left voluntarily — in a structured, machine-readable format. On request, we send you the conversations found by the anchor you give (session or e-mail) as a structured file. The itineraries built in a conversation already have their own portable form: the personal export link, valid for 30 days, which you receive in the chat.

Any request goes to the controller — the Țara Dornelor Destination Management Organization — at contact@taradornelor.online. Say which right you want to exercise and the anchor by which we can find your data (the e-mail address left in the conversation, or the fact that you are asking for deletion from the device you are using). Exercising your rights is free of charge.

We answer within one month of receiving the request, the period set by the GDPR (Art. 12). If the request is particularly complex, the period may be extended by up to two further months — in which case we notify you within the first month, with the reason for the extension. If we cannot act on your request (for instance because we cannot establish which data is yours — see the first section), we explain why, within the same period.

If you consider that your rights have not been respected, you have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal) — www.dataprotection.ro, B-dul G-ral Gheorghe Magheru 28-30, Bucharest. We do encourage you to write to us first: most situations are resolved directly.