Privacy Policy - Aerodrom Vama Veche

Last updated: 30 September 2026

This page says which personal data we use, why, for how long and to whom we pass it on, under Regulation (EU) 2016/679 (GDPR).

1. Who is responsible for your data

The data controller is GRAVOLAB CNC SRL, tax ID RO16415020, Trade Register no. J2004000839033, with its registered office at Str. Valea Bărbușii 1A, Câmpulung, Argeș, Romania, which runs the Vama Veche Aerodrome website.

For any question about your data: zbor@aerodrom-vama-veche.ro · +40 746 264 022.

2. Which data we use

When you order: name, e-mail address, phone, town and, if you fill them in, address, company name and tax ID.
For the flight: the period in which you would like to fly, the name of the person who flies (if it is a gift) and the remarks you write.
For visiting aircraft: aircraft registration, arrival and departure dates.
Proof that you accepted the conditions: the date, time and IP address from which you placed the order.
When you write to us: what you send through the contact form, by e-mail or through the contract withdrawal form.
Technical data: IP address and the cookies the website needs in order to work (see section 6).

Your card details never reach us. You type them on the payment processor’s secure page; we only receive confirmation that the payment succeeded.

Health and weight. For flight safety we may ask your weight when scheduling, and we ask you to tell us about conditions that may matter in flight. We use them only for the decision about the flight, on the basis of your consent, and we do not enter them in the website’s records.

3. Why we use it, and on what legal basis

To provide the service you bought — order confirmation, scheduling the flight, staying in touch: performance of the contract, Article 6(1)(b) GDPR.
To issue the invoice and keep accounts, including reporting in the Romanian RO e-Factura system: legal obligation, Article 6(1)(c).
To be able to prove acceptance of the conditions, protect the website from abuse and answer complaints: legitimate interest, Article 6(1)(f).
To answer your messages: steps taken at your request, Article 6(1)(b).

We do not send advertising, build profiles or sell data.

4. Who receives it

The payment processor (NETOPIA Payments), which processes the card payment as a controller in its own right.
The hosting provider of the website and e-mail.
The company’s accountants and the Romanian tax authority (ANAF), for invoices.
Public authorities, only when the law requires it.

The website loads fonts from Google’s servers; when a page opens, your browser sends your IP address to Google. The map on the contact page opens in Google Maps only if you click it.

5. How long we keep it

Orders and invoices: for the period required by tax and accounting law.
Messages and withdrawal statements: as long as needed to deal with them and, as evidence, for 3 years at most afterwards.
Cookies: at most for the time shown in section 6.

6. Cookies

We use only necessary cookies: for the shopping cart and the order, for the chosen language. They are deleted when you close the browser or, for preferences, within one year at most.

We use no advertising cookies and no traffic analysis services. On the checkout page we use Google reCAPTCHA to stop automated orders (a requirement of our payment processor); Google may set a cookie for this purpose, on that page only. You can delete or block cookies at any time in your browser settings; without the necessary ones, online ordering will not work.

7. Your rights

You have the right to ask for access to your data, its rectification or erasure, restriction of processing, data portability, to object to processing based on legitimate interest and to withdraw consent where processing relies on it.

Write to zbor@aerodrom-vama-veche.ro. We reply within one month at most. Invoices already issued cannot be erased before the legal retention period ends.

If you believe your rights have been infringed, you can lodge a complaint with the Romanian supervisory authority, ANSPDCP — www.dataprotection.ro.

8. Data security

The website works only over an encrypted connection (https). Orders are accessible only to the people who handle them. Invoices are not kept in the public area of the website.

9. Changes

When we change this policy, we publish the new version and its date here.