Privacy & Cookies

This policy explains how personal data is collected, used, and protected when you use this website, and which cookies the site uses. It is written to comply with the EU General Data Protection Regulation (GDPR) and Romanian Law no. 190/2018.

1. Who we are

This website and the experiences offered through it are operated by Chameleon Skills S.R.L. ("we", "us"), a company registered in Romania, which is the data controller for the personal data described below. The company is registered with the Trade Register (Registrul Comerțului) under no. J2021001772400, fiscal code (CUI/CIF) 43662494, special VAT code RO43773204, with registered office (sediu social) in Calea Griviței 403, Bucharest, Romania. Guided experiences are delivered by Irina Timotin, a licensed tour guide holding tour guide accreditation (atestat de ghid de turism) no. 11839. For any question about this policy or your personal data, contact us at hello@chameleonexperiences.com.

2. What data we collect, and why

When you use the contact form, we collect the name, email address, and message you provide. We use this to reply to your inquiry and to plan the experience or partnership you asked about. The legal basis is the steps taken at your request prior to entering into a contract, together with our legitimate interest in responding to enquiries (GDPR Art. 6(1)(b) and (f)). We keep this data for as long as needed to handle your inquiry and any resulting booking, and for up to 24 months afterwards, unless the law requires us to keep it longer (for example, accounting records). We also store your cookie choice so the consent banner does not reappear on every page; the legal basis for this is your consent, together with our legitimate interest in the site functioning correctly. If you consent to analytics, we collect usage data about how you interact with the site; this is described in section 5. In addition, like most websites, our server automatically records technical information for each request, which may include your IP address, the page requested, and a timestamp. We use this for security, error diagnosis, and keeping the site running, on the basis of our legitimate interest in the security and integrity of the website (GDPR Art. 6(1)(f)). These logs are kept for a limited period and then deleted or overwritten within 30 days.

3. Who your data is shared with

We do not sell your personal data. We share it only with service providers who help us run the website and communicate with you, acting as our processors. Our website and mailbox are hosted by xneelo (Hetzner (Pty) Ltd), whose servers are located in South Africa; this means some data (including contact-form details and server logs) is stored outside the European Economic Area. If you consent to analytics, usage data is processed by PostHog on infrastructure in the European Union. Where a booking involves partners you have asked us to arrange, only the details necessary for that arrangement are shared. Transfers of data outside the EEA (such as hosting in South Africa) are carried out under appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

4. Your rights

Under the GDPR you have the right to access your data; to have it corrected or erased; to restrict or object to its processing; to data portability; and to withdraw consent at any time, without affecting processing already carried out. To exercise any of these, email hello@chameleonexperiences.com. You also have the right to lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal — ANSPDCP), B-dul General Gheorghe Magheru 28–30, Sector 1, 010336 București, Romania; email anspdcp@dataprotection.ro; web www.dataprotection.ro.

5. Cookies

Cookies are small text files stored on your device. We group them as follows. Strictly necessary. cookie_consent remembers whether you accepted or rejected non-essential cookies. It is functional, stored for one year, and set only after you interact with the consent banner. It requires no consent. Analytics (set only with your consent). If you accept, we use PostHog to understand how visitors use the site — for example, which pages are viewed and how people navigate — so we can improve it. This may set cookies or use similar identifiers, and processes technical and usage data such as pages visited, approximate location (derived from IP), device and browser type, and interactions. We do not use analytics to collect your name or email. These are loaded only after you accept, and are not set if you reject; the legal basis is your consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time (see below). We also use Google Search Console to see which search queries bring visitors to the site. This works from anonymised, aggregated search data provided by Google and does not set cookies on your device or identify you individually. You can withdraw or change your choice at any time by clearing this site's cookies in your browser, after which the banner will reappear, and you can block or delete cookies through your browser settings.

6. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of the page shows when it last changed, and material changes will be reflected here before they take effect.