This Privacy Policy explains how JUMEIRAH ROYAL SRL collects, uses, and protects your personal data when you use this website to book a stay at our properties, JMR Splendor and JMR Royal, in Constanța, Romania. Please read it carefully before creating an account or making a booking.
Last updated:
1. General information
The data controller is JUMEIRAH ROYAL SRL, a company registered in Romania, fiscal code (CUI) 40680810, Trade Registry no. J2019000886132, operating the JMR Splendor and JMR Royal properties in Constanța, Romania. You can reach us at concierge@jmrhotels.com.
We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and applicable Romanian data protection legislation. We collect only the data we actually need to provide our booking services, and we do not sell personal data to anyone.
Our services are intended for adults. You must be at least 18 years old to create an account or make a booking on this website.
2. Categories of data we collect
In short: we hold your account details, the details of your bookings, your messages with the property, any review you write, and basic technical records. We collect visit statistics only with your consent. We never hold your card number. The detail is below.
Account data
When you create an account, we collect:
first name and last name;
country of residence, which is required when you register;
email address;
phone number, which you add at the verification step;
password, stored exclusively as a cryptographic hash, never in plain text;
a profile picture, if you choose to upload one: we keep only a small square copy of it and discard the file you uploaded;
your newsletter consent choice and the moment you gave it (optional);
the date and time you accepted our terms and conditions;
the moments at which your email address and your phone number were verified;
if you turn on two-factor authentication, the secret shared with your authenticator app and your recovery codes, both stored encrypted;
if you pay online, the customer identifier that our payment processor creates for you.
We verify both of your contact details: an email code, valid for ten minutes and limited to five attempts, and a separate code sent by SMS to your phone number. If our SMS provider is unavailable, the phone step is waived so your booking can go through. The account is then flagged for us to verify by hand.
Booking data
When you make or hold a booking, we process:
the guest first name and last name you type at checkout, which may be someone other than the account holder;
the email address, the phone number in both national and international format, and the country recorded for the stay;
stay details: arrival and departure dates, the rooms booked, and the number of adults and children in each room;
the language you were using on the site when you booked;
special requests you choose to add, as free text;
the price of the stay, its currency, the payment method and the payment status;
booking identifiers: the booking number of each room, issued by our channel manager, and an internal reference in the form JMR-YYYY-XXXXXX used in booking links and emails;
your booking history linked to your account, including earlier bookings made through third-party platforms, which are automatically associated with your account based on your verified phone number.
Payment data
We never collect, process, or store payment card data on this website. Where online payment is offered, card details are entered into a form hosted by our payment processor and travel directly to it. Payment in cash at the property on arrival remains possible where it is offered, and involves no card data at all.
What we keep about a payment is:
the payment method chosen and the payment status;
the amount and the currency;
the payment processor's references for the payment and for any refund;
the moment the payment was made, the moment a refund was issued, and the moment the payment hold expires.
Messages exchanged with the property
Each stay has a message thread in your account. For every message we store the subject and the full text, whether it was sent by you or by the property, which account sent it, its delivery status and delivery time, and the moment each side last read the thread.
Online check-in and access codes
The online check-in, required before arrival, is completed on a separate page provided by our booking management system. That page has its own terms and its own privacy policy, which apply to the details you enter there. This website neither collects nor stores any identity document.
The link to the online check-in is sent to you right after booking, by WhatsApp, SMS or email, one for each room. Your access codes are sent on the day of arrival, by WhatsApp or SMS, once the online check-in is complete. For these messages we use the phone number and email address on the booking. WhatsApp messages travel through the WhatsApp service, which has its own privacy policy.
Reviews
If you write a review of a stay, we store the score, the title, the positive and negative texts, the language of the review, the date it was submitted, and the stay it relates to: the room, the arrival and departure dates and the number of nights. We also store your first name, your country, and a traveller type derived from the number of adults and children on the booking.
Once a review is approved, what appears publicly beside it is your first name, your country, the traveller type, the score, the date you submitted it, the title and the texts, the room name, the number of nights and the month of the stay. Your last name, your email address and your phone number are never published.
Data received from third-party sources (OTAs)
If you book one of our properties through an online travel platform (such as Booking.com or Expedia), that platform transmits your booking data to us through our channel manager. This typically includes your name, contact details, and stay details, as provided by you to that platform.
We also import reviews of our properties written on Booking.com and republish them on this site, together with the reviewer's first name, country and profile picture. Profile pictures are downloaded and stored as copies on our own server.
Technical data
To operate the website securely we use strictly necessary technical data. For every session we store a session identifier, the IP address the request came from, and the browser user agent. Your language preference is kept on our server inside the session, not in a cookie. Verification codes are held only for the few minutes they are valid.
To keep accounts secure we keep a log of security events: a change of password or email address, two-factor authentication being turned on or off, and actions our team takes on an account. For each event we store its type, the account, the email address at that moment, the date, and the IP address the change was made from.
For your cookie choice we keep an anonymous identifier, the choice, its version and the date. We do not keep your IP address, and we do not link the choice to your account.
See section 9 for details on cookies and on the external resources some pages load.
Visit statistics (only with your consent)
If you accept statistics, we use Google Analytics to see how the website is used. It then collects:
a pseudonymous identifier, kept in a Google Analytics cookie in your browser;
the pages you visit and the website or campaign that brought you to us;
the booking steps: the search, the rooms viewed, starting a booking, the payment page and the paid booking, with its internal reference, the rooms and the value;
creating an account and signing in, without any account details;
clicks on our phone, WhatsApp and email links;
the type of device and browser, and your approximate location.
We never send your name, email address or phone number to Google Analytics. Google Analytics does not keep your IP address. Without your consent, nothing is loaded from Google Analytics.
3. Purposes of processing
We use your personal data to:
create and manage your account, including verifying your email address and phone number;
process, manage, and honour your bookings, including synchronising them with our booking management system and, where applicable, with the platform you booked through;
send you the link to the online check-in and your access codes;
link your booking history to your account, based on your verified phone number, so you can see all your stays in one place;
take payment for your stay, settle it, issue refunds, and prevent payment fraud;
operate the message thread between you and the property, including forwarding your messages to our channel manager and letting you know by email when the property replies;
publish and moderate guest reviews on this website, and display reviews imported from travel platforms;
send you transactional communications about your account, your bookings and the security of your account;
send you our newsletter, only if you have explicitly consented;
measure, only with your consent, how the website is used and at which step visitors leave a booking;
comply with our legal obligations, in particular financial-accounting record-keeping requirements;
keep the website and the accounts secure, prevent fraud and abuse, and keep the security event log.
The transactional messages we currently send are:
about bookings: the booking confirmation, the request to pay when you choose to pay online, the notice that a payment hold has expired or that a payment has been refunded, the notice that a booking number has been assigned to your room, and the notice that the property has replied in your message thread;
about your account: the email verification code and the password reset message.
For the security of your account, we email you when:
your password was changed;
your email address was changed (the message goes to the previous address);
two-factor authentication was turned on;
two-factor authentication was turned off;
our team turned off two-factor authentication at your request (the message carries the link to set a new password);
our team changed the email address of your account at your request (the message goes to the previous address);
our team set a new password for your account at your request;
new recovery codes were generated (the codes are never in the email).
4. Legal bases
Each purpose above rests on one of the legal bases in Article 6 GDPR:
Performance of a contract (art. 6(1)(b)): creating and managing your account, verifying your contact details, processing and managing your bookings, sending the link to the online check-in and your access codes, taking payment and issuing refunds, operating the message thread with the property, and sending the transactional communications related to all of these.
Legal obligation (art. 6(1)(c)): retaining booking-related supporting documents as required by Romanian financial-accounting legislation.
Legitimate interest (art. 6(1)(f)): keeping the website and the accounts secure, including the security event log and the security emails, preventing fraud, automatically associating your earlier bookings with your account based on your verified phone number so we can offer you a complete booking history, and republishing reviews of our properties written on Booking.com, together with the reviewer's first name, country and profile picture, so that visitors see the full picture of what guests say about us. You may object to processing based on legitimate interest at any time (see section 7).
Consent (art. 6(1)(a)): sending the newsletter, where consent is given by an explicit checkbox; publishing your own review beside your first name and country, where consent is given by submitting the review; and visit statistics through Google Analytics, where consent is given in the cookie banner, as required by art. 4(5) of Romanian Law no. 506/2004. You can withdraw any of them at any time. For a published review, ask us by email and we will take it down, since the website has no self-service delete once a review is online.
5. How long we keep your data
Some records are deleted automatically, after the periods listed below. We keep the others for as long as we need them for the purposes in section 3 and for as long as the law requires, then remove them by hand. If you want something removed sooner, write to us and we will do it, except where the law says we must keep it.
Account data: for as long as your account exists. Deleting your account removes the account record permanently, including your password and your two-factor settings. Your profile picture, your sessions, the notifications in your account and any password reset links are deleted with it. Your profile picture is also deleted when you remove it in your account settings.
Bookings: a booking keeps the guest name, email address, phone number and country captured when it was made, so that we can honour it and account for it. This also applies to bookings received from travel platforms, including those that were never linked to any account.
Reviews and messages: they are kept with the stay they relate to. A published review keeps the first name and country shown beside it. The message history keeps the text of every message.
Payment records: the amount, the status and the payment processor's references are kept with the booking they belong to.
Financial-accounting documents: supporting documents are kept for up to 10 years, in accordance with Romanian financial-accounting legislation. This period is applied as a manual procedure; nothing in the software enforces it.
Verification codes: the email code expires after ten minutes. The SMS code is held by our SMS provider, not by us.
Password reset link: it expires after 60 minutes.
Sessions: a session record, with its IP address and browser user agent, expires 120 minutes after your last activity. Expired records are cleared automatically.
Security event log: 24 months, then deleted automatically.
Cookie choice log: 24 months, then deleted automatically. The cookie that holds your choice expires after 6 months.
Visit statistics: Google Analytics keeps the data for 14 months. The Google Analytics cookies expire after 13 months.
Application logs: 14 days, then deleted automatically.
Newsletter consent: until you withdraw it. Withdrawing it also erases the record of when it was given.
If you want data removed beyond what deleting your account does, write to us at concierge@jmrhotels.com and we will handle it manually, subject to what we must keep by law.
6. Recipients and processors
We share personal data only with service providers who help us run the service, under data processing agreements, and only to the extent necessary:
Our booking management system and channel manager, a provider based in Germany (European Union): it receives the guest name, email address, phone number and country, the arrival and departure dates, the room, the number of adults and children, the language, the price and its payment status, your free-text special request, our internal reference, and the full text of every message exchanged in your thread. It also provides the online check-in page, which has its own terms and its own privacy policy. It sends the check-in link and the access codes by WhatsApp, SMS or email. It returns the booking number of each room and the property's replies.
Twilio Inc. (United States): sends the SMS verification codes and receives your phone number for that purpose. This involves an international data transfer, safeguarded by Standard Contractual Clauses and Twilio's participation in the EU-US Data Privacy Framework.
Stripe, our payment processor, where online payment is offered: it receives your card details directly from your browser, together with the name, email address, phone number and language of the account holder, the room names, the stay dates and the number of nights, the booking reference and the booking numbers, and the amount and currency. Depending on which Stripe company handles the payment, your data may be transferred outside the European Union, protected by the safeguards in Stripe's data processing terms.
Google Ireland Limited (Ireland), only if you accept statistics: provides Google Analytics and receives the visit data described in section 2. The data may be transferred to Google LLC in the United States, protected by the EU-US Data Privacy Framework and by Standard Contractual Clauses.
Booking.com: the source of the reviews we import. In the same process we download reviewers' profile pictures from Booking.com, Google and Facebook image servers, and store our own copies of them on our server.
A public breached-password service: when you choose or change a password, we check whether it appears in known data breaches. Only a short, irreversible fragment of the password's hash is sent; your password itself never leaves our server.
Our web hosting provider: hosts the website and its database, on a server in the European Union.
Our transactional email provider: delivers account and booking emails, including email verification codes.
Some providers are described here by category. Write to us if you want to know their names.
If your booking was made through a third-party platform (e.g. Booking.com, Expedia), booking status information is exchanged with that platform via the channel manager as part of managing the reservation. We may also disclose data to public authorities where the law requires it. We never sell your personal data.
7. Your rights
Some of these rights you can exercise yourself, right now, in your account settings or in Cookie settings. Access, a portable copy of your data, restriction of processing and objection have no self-service button on the site yet: write to concierge@jmrhotels.com and we handle each of them by hand, free of charge, within one month.
Right to rectification: you can correct your first name, last name, country and email address in your account settings, and change your password there. Changing your phone number is done in the same place and starts a fresh SMS verification.
Right to erasure ("right to be forgotten"): if your account has no bookings, reviews or messages, you can delete it yourself in the settings, after confirming your current password. Deletion is immediate and permanent. An account with bookings, reviews or messages cannot be deleted in the settings: write to us and we will handle the request by hand. Your bookings, your reviews and your message history stay in our records with the guest details they contain. If you want those removed too, ask us by email and we will do it, except where the law requires us to keep them.
Right of access: we confirm whether we process your data and send you a copy of it.
Right to data portability: we prepare the data you provided to us in a structured, commonly used, machine-readable format.
Right to restriction of processing: we limit how we use your data in the situations provided by law.
Right to object: you can object to processing based on our legitimate interest, including us linking your past bookings to your account by phone number. Tell us and we will unlink them. The matching runs again each time a booking arrives with your number, so if they reappear, let us know and we will remove them again.
Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal. Newsletter consent is withdrawn in your account settings. Consent to statistics is withdrawn in Cookie settings, at the bottom of every page, as easily as it was given.
One limit is worth stating plainly: you can edit or delete your review only while it is waiting to be approved. Once it is published, only we can amend or remove it, so ask us by email if you want it taken down.
We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you. For transparency: past bookings are matched to your account automatically using your verified phone number; this is a convenience feature for displaying your booking history and does not constitute profiling with legal effects.
We respond to requests within one month, as required by the GDPR. If you believe your rights have been infringed, you can lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Bucharest, Romania, anspdcp.ro.
8. Data security
We apply technical and organisational measures appropriate to the risk, including:
verification of the email address and phone number of new accounts, by an email code and an SMS code. The SMS step is waived while our SMS provider is unavailable. The account is then flagged for manual follow-up;
optional two-factor authentication for your account, using an authenticator app, with recovery codes stored encrypted;
passwords stored only as cryptographic hashes: we never store or see your password in plain text. A new password is checked against known data breaches;
card details never reach our servers: they are entered into the payment processor's own form and travel directly to it;
encrypted connections (HTTPS/TLS) for all traffic between your browser and the website;
a browser security policy sent with every page, which blocks any external script, font, media file or frame other than the payment form and, only with your consent, Google Analytics;
rate limiting on signing in, registration, password reset, sending verification codes, searching availability, submitting a booking and sending messages;
a code from our team's authenticator app to confirm sensitive actions on accounts, recorded in the security event log;
access to personal data restricted to authorised personnel who need it to perform their duties.
9. Cookies and external resources
We use cookies and browser storage to run the website and, only with your consent, for visit statistics. Strictly necessary cookies do not require your consent, under art. 4(6)(b) of Romanian Law no. 506/2004. Statistics cookies are set only after you accept them, under art. 4(5) of the same law. You make your choice in the banner shown on your first visit.
Strictly necessary cookies
Name
What it does
How long it lasts
jmr-hotels-session
Your session, which carries your sign-in and your chosen language. Scripts on the page cannot read it.
120 minutes from your last activity
XSRF-TOKEN
Protects forms against forged requests.
120 minutes
remember_web_…
Keeps you signed in between visits. It is set only if you tick "Remember me", and it disappears when you sign out.
14 days
jmr_consent
Your cookie choice, so we do not ask again on every page.
6 months
Statistics cookies (Google Analytics, only with your consent)
Name
What it does
How long it lasts
_ga
Tells visitors apart, through a pseudonymous identifier.
13 months
_ga_<ID>
Keeps the state of the current visit.
13 months
These cookies are set only after you accept statistics. If you withdraw your consent, we delete them from your browser. Google Analytics receives nothing after that.
Payment page
The payment page loads the script of our payment processor, Stripe, and displays its form in a frame. Stripe sets two strictly necessary cookies on our domain, used to prevent payment fraud: __stripe_mid, valid for one year, and __stripe_sid, valid for 30 minutes. Inside the form, your browser connects to Stripe directly. There Stripe may use its own cookies, which we neither control nor read.
Browser storage
The website may write two entries in your browser's temporary storage (sessionStorage), which disappear when you close the tab:
jmr.session-guard.reloaded-at: the moment the page was reloaded after the session expired, so the reload does not repeat in a loop. It can appear on any page.
jmr-stripe-retry:<payment session>: on the payment page, it allows a single reload when the payment session has expired, also to avoid a loop.
How to change your choice
You can change your choice at any time in Cookie settings, at the bottom of every page. You can also delete cookies in your browser settings.
All fonts used on this website are served from our own server. Apart from the payment form and, with your consent, Google Analytics, nothing is loaded from a third party.
10. Newsletter and commercial communications
We may send you a newsletter from time to time, by email. It can contain booking promotions and discount voucher codes for stays at our properties. You only receive it if you have ticked the consent box, which is never pre-ticked and is never a condition for creating an account or making a booking.
You can withdraw your consent at any time from your account settings or by contacting us at concierge@jmrhotels.com. Withdrawing consent does not stop the messages we must send about your account and your bookings; they are listed at the end of section 3.
11. Changes to this policy
We may update this Privacy Policy when our services, our providers, or the applicable legislation change. The current version, with its "last updated" date, is always published on this page. For significant changes we will inform you by appropriate means, such as a notice on the website. If the cookies we use or their purpose change, the banner asks for your choice again.
12. Contact
For any question about this policy or about how we process your personal data, contact us:
JUMEIRAH ROYAL SRL, CUI 40680810, Trade Registry no. J2019000886132;
Properties: JMR Splendor and JMR Royal, Constanța, Romania;
The same address is our contact point for data protection questions, for exercising the rights in section 7, and for withdrawing newsletter consent. You can change your cookie choice at any time in Cookie settings, at the bottom of every page.
