Privacy & GDPR
Last updated: 24 September 2026
This policy explains which personal data Sostega processes, why, for how long and what your rights are under the EU General Data Protection Regulation (GDPR).
Who we are
The controller of the personal data described here is Fun Timisoara SRL, registered office Str. Cozia nr. 36, ap. 1, Timișoara, Timiș County, Romania, Trade Register no. J35/1078/2020, VAT / Tax ID RO42507107.
For anything related to your personal data, write to gdpr@sostega.com.
Hosts, guests and our role
Hosts use Sostega to run their apartments. For the data of their guests (bookings, guest registration, identity documents, invoices) the host is the controller and Sostega processes that data on the host's behalf, under our Data Processing Agreement. Guests who want to exercise their rights should contact the host first; we help the host answer.
For our own website, the early access form and the accounts of hosts and their team, Fun Timisoara SRL is the controller.
What we collect and why
| Situation | Data | Purpose and legal basis |
|---|---|---|
| Early access form | Email, number of apartments, language, a one-way hash of your IP address | To answer your request (steps before a contract, Art. 6(1)(b)); the IP hash only to stop abuse (legitimate interest, Art. 6(1)(f)) |
| Host and team accounts | Name, email, role, sign-in codes, login history, settings | To provide the service you signed up for (contract, Art. 6(1)(b)) and keep accounts secure |
| Invoicing | Company or person billed, address, tax ID, amounts | Legal accounting obligations (Art. 6(1)(c)) |
| Guest data (on behalf of hosts) | Booking details, guest registration fiche, identity document data and photos, signatures, messages | Processed only on the host's instructions, for the host's legal guest record |
| Technical logs | IP address, browser, time of request, errors | Security and troubleshooting (legitimate interest, Art. 6(1)(f)) |
How long we keep it
- Early access requests: up to 24 months, or until you ask us to delete them.
- Accounts: for as long as the account is active, then deleted, except what the law requires us to keep.
- Invoices and accounting records: for the period required by Romanian accounting law.
- Identity document photos: up to 30 days after check-out by default (each host can set 1–90 days). Guest registration fiches and signatures: 5 years after check-out, as Romanian law requires (HG 237/2001). Both are deleted automatically when the period ends.
- Photos sent in guest conversations (by the host or the guest): the same period as identity document photos, then deleted automatically; the text of the messages stays.
- Sign-in logs (IP address, device): 30 days.
- Backups: deleted data can remain in our encrypted backups until they rotate out, at most 6 months later.
- Technical logs: for a short period, only as long as needed for security and troubleshooting.
Who else processes data
We do not sell personal data. We use a small number of providers who process data for us, in these categories:
- hosting and storage, on servers in the European Union;
- email delivery (sign-in codes, notifications);
- the connection to booking channels, for hosts who connect them;
- card payments, only when a host switches payments on.
The booking channels a host connects (for example Booking.com, Airbnb, Expedia or Vrbo) receive that host's booking data as independent controllers. The named list of our sub-processors is part of our Data Processing Agreement with hosts.
If a provider processes data outside the European Economic Area, it does so under an adequacy decision of the European Commission or the standard contractual clauses.
How we protect it
- Every sign-in needs a code sent by email; sessions are kept in secure, http-only cookies.
- Sensitive fields such as identity numbers and access codes are stored encrypted.
- Each host sees only their own data; team members see only what their role needs.
- Data is stored on servers in the European Union.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.
Write to gdpr@sostega.com. We answer within one month. You can also complain to the Romanian data protection authority (ANSPDCP), dataprotection.ro.
Cookies
We only use cookies that are strictly necessary for the service. No advertising or analytics cookies. See Cookies.
Changes
We will update this page when the way we process data changes. Significant changes are announced to account holders by email.