Privacy Policy

I.What we collect

Museum ticket sales are enabled on this site. Admission is confirmed by the ticket provider after successful payment; selecting a time here does not hold a place.

Contact, event-enquiry and newsletter forms are enabled. Cloudflare stores submissions and delivery jobs; Resend delivers enquiry and newsletter emails. Newsletter sign-up remains pending until you follow the confirmation link.

FUNDATIA "KALNOKY" is the controller for Foundation museum orders, event enquiries and newsletter subscriptions. An enquiry does not subscribe you to a newsletter. If you email us directly, we use the details you send to answer and manage your request.

Museum orders use the contact details supplied at checkout, selected castle/date/time, quantity, order and payment status, confirmation email and check-in record. Paid order processing is necessary to perform the ticket contract; payment and fiscal records are processed to meet applicable legal duties. Enquiries use your name, email, optional telephone number, message, event or visit preferences and page language for requested precontract steps or our legitimate interest in answering. A separate optional newsletter subscription uses consent and email confirmation, withdrawable by unsubscribing. Payment providers handle card numbers; this website does not receive them.

If you choose optional sponsorship in a live checkout, the Foundation will use your name, email and postal address, order and payment reference, amount, and recorded acceptance of the displayed terms to administer the sponsorship, correct errors, and meet applicable accounting obligations. A private transaction record and a copy of the accepted terms may be stored in the Foundation's access-controlled Cloudflare database; this record does not claim that you signed a sponsorship contract. The provider handles card details.

II.Cookies and tracking

The choice cookies kalnoky_consent, kalnoky_c_analytics and kalnoky_c_marketing record your choices for 180 days. Necessary security, form-result and booking operation data support the requested service. Google Analytics 4 and Meta Pixel load only after the relevant choice and only when tracking is enabled on the production host. You may change your choice below or in the footer.

Cloudflare serves and protects the site and stores private operational records. Museum booking connects to pretix.eu; Pretix processes order and technical data, and Stripe handles card details in the payment flow. Authorized Foundation staff can inspect orders, confirmations and check-in records. SmartBill is used for Foundation fiscal administration. Google Maps is an outbound link and opens when selected.

Google Fonts supplies fonts when a page loads; Google receives the network request, including the IP address and browser request details. The interactive estate map requests tiles from the OpenStreetMap Foundation when loaded, exposing the IP address and tile request details. These requests are separate from optional analytics and marketing. Provider privacy notices below describe processing and international locations; contact events@kalnoky.ro for information about safeguards applicable to Foundation records.

III.Your rights

You may ask for access, correction, erasure or restriction of your data, and object or request portability where the GDPR applies. We respond without undue delay, normally within one month; an extension is possible under the GDPR. You may withdraw consent at any time without affecting earlier lawful processing. You may complain to the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or seek a judicial remedy.

We determine retention separately by purpose: enquiry records while the request and any follow-up remain open; booking and check-in records while needed to fulfil and support the visit or resolve a dispute; payment, invoice and sponsorship records for the applicable statutory accounting and tax period; newsletter contact details until withdrawal, with only evidence needed to honour suppression or establish consent retained afterwards. TEST data is retained only while needed to validate or investigate the test. A legal obligation or a specific unresolved claim may require longer retention of the relevant record, with access limited to that purpose. Ask events@kalnoky.ro about the retention criterion and deletion of your particular record.

IV.Who to contact

For privacy requests, write to events@kalnoky.ro. The Foundation’s published address is Micloșoara, str. Micloșoara nr. 186, jud. Covasna, 525104, Romania (Foundation notice, 2023). This notice concerns Foundation activity; accommodation and other services operated by AKY SRL have their own operator and terms.