This policy explains what personal data we collect through the paradabaloanelor.ro website, why we collect it, who we share it with, how long we retain it, and what rights you have over it, in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018.

1. Who we are (the data controller)

MANGO RENTAL & SERVICES S.R.L. Tax ID (CUI): 36484041 | Trade Registry No.: J26/1210/2016 Registered office: Livezeni Village, Livezeni Commune, Str. Lungă no. 30F, postal code 547365, Mureș County, Romania E-mail for any request regarding personal data: contact@paradabaloanelor.ro

2. What data we collect

2.1. Data you provide directly

  • When purchasing tickets: first and last name, e-mail address, phone number.
  • For balloon flight tickets: number of people in the basket and the total declared weight (kg) for each slot. This data is requested solely for aeronautical safety reasons — the balloon’s maximum load is a mandatory technical limit.
  • When creating an account: e-mail address, password (stored encrypted, irreversibly), order history.
  • When contacting us: the data you include in your message (e-mail, phone, content of the request).

2.2. Automatically generated data

  • Order data: order number, products, amounts, payment status, issued ticket codes.
  • Technical data: IP address, device and browser type, pages visited, date and time of access, server security logs.
  • Cookies and similar technologies — see Section 7.

2.3. Data we do NOT collect

We do not collect or store bank card data. Payment is processed entirely on NETOPIA Payments’ infrastructure; we only receive payment confirmation (successful/failed) and a transaction identifier.

We do not request or wish to receive special category data (health data, beliefs, biometric data). Please do not include such information in messages sent to us.

3. Why we process the data and on what legal basis

Purpose of processing Data used Legal basis (GDPR)
Processing the order, issuing and delivering tickets by e-mail Name, e-mail, phone, order details Art. 6(1)(b) – performance of a contract
Verifying flight safety conditions (compliance with maximum load, preparation of the flight manifest) Name, number of people, total weight, flight time Art. 6(1)(b) – performance of a contract and Art. 6(1)(f) – legitimate interest: passenger safety
Validating the ticket at entry / boarding Ticket code, holder’s name Art. 6(1)(b) – performance of a contract
Operational communications: confirmations, schedule changes, cancellations, rescheduling E-mail, phone Art. 6(1)(b) – performance of a contract
User account administration E-mail, encrypted password, order history Art. 6(1)(b) – performance of a contract
Accounting and tax obligations, archiving Billing data, transaction amount and date Art. 6(1)(c) – legal obligation
Fraud prevention, website security, technical logs IP, technical data, order data Art. 6(1)(f) – legitimate interest: protecting systems and transactions
Handling complaints and defending a legal right Order data and correspondence Art. 6(1)(f) – legitimate interest
Newsletter and marketing communications (where applicable) E-mail, first name Art. 6(1)(a) – consent, revocable at any time
Analytics and marketing cookies Browsing data Art. 6(1)(a) – consent
General photographs and video recordings during the event Image, in a public context Art. 6(1)(f) – legitimate interest: documenting and promoting the event

Providing the data marked as mandatory in the order form is necessary to conclude the contract. Without it we cannot issue the ticket, and for flights, we cannot ensure safety conditions. The remaining processing activities (newsletter, non-essential cookies) are optional.

4. Who we disclose data to

We do not sell or rent your data. We disclose it only to the following categories of recipients, strictly to the extent necessary:

  • The payment processor – NETOPIA Payments (NETOPIA S.R.L.), acting as an independent controller for payment data;
  • The website hosting provider and technical maintenance services;
  • The transactional e-mail (SMTP) service provider, through which confirmations and tickets are sent;
  • The aeronautical crews and partners operating the flights — they receive the flight manifest (passenger names, number of people, total weight, flight time);
  • Event access staff — verify the validity of the ticket code;
  • The accounting services provider and, where applicable, legal consultants;
  • Public authorities (ANAF, ANPC, aeronautical authorities, judicial bodies), when required by law.

We have data processing agreements in place with all providers who process data on our behalf, in accordance with Art. 28 GDPR.

5. Transfers outside the European Economic Area

As a rule, data is hosted and processed within the European Union. If a provider (for example, an e-mail or web analytics service) processes data outside the EEA, the transfer is made only based on a European Commission adequacy decision or standard contractual clauses, together with supplementary protective measures.

6. How long we retain the data

  • Order and ticket data: for the duration of the event and afterward, as proof of transaction and for potential complaints — 3 years from the completion of the order.
  • Accounting documents (invoices, records): 10 years, in accordance with tax legislation.
  • Flight manifests (name, weight, time): kept for as long as necessary to demonstrate compliance with safety rules, then deleted or anonymized.
  • User account: until the account is deleted at your request.
  • Correspondence and complaints: 3 years from resolution.
  • Technical/security logs: maximum 12 months.
  • Consent-based marketing data: until consent is withdrawn.

Upon expiry of these periods, data is irreversibly deleted or anonymized.

7. Cookies

The website uses cookies:

  • strictly necessary – shopping cart, checkout session, authentication, security, language preference. These cannot be disabled, as the website does not function without them;
  • analytics – help us understand how the website is used (set only with your consent);
  • marketing – if used, set exclusively with your consent.

You can change your cookie banner preferences at any time or delete/block cookies in your browser settings. Blocking essential cookies prevents placing an order.

8. Your rights

As a data subject, you have the following rights:

  • right of access – to find out what data we hold about you and to receive a copy;
  • right to rectification – correction of inaccurate data or completion of incomplete data;
  • right to erasure (“right to be forgotten”), to the extent we do not have a legal obligation to retain the data;
  • right to restriction of processing;
  • right to data portability – receiving your data in a structured, commonly used format;
  • right to object – to processing based on legitimate interest, including direct marketing;
  • right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
  • right not to be subject to a decision based solely on automated processing with significant effects — we note that we do not use automated decision-making processes or profiling;
  • right to lodge a complaint with the supervisory authority.

You can exercise your rights by writing to contact@paradabaloanelor.ro. We respond within 30 days of receiving the request at the latest; in complex cases, this period may be extended by up to 2 months, with notice to you. To prevent disclosure of data to unauthorized persons, we may request additional information to verify your identity.

9. Supervisory authority

National Supervisory Authority for Personal Data Processing (ANSPDCP) B-dul G-ral. Gheorghe Magheru no. 28-30, Sector 1, postal code 010336, Bucharest, Romania Phone: +40.318.059.211 | E-mail: anspdcp@dataprotection.ro Web: www.dataprotection.ro

10. Data security

We apply appropriate technical and organizational measures to protect data: encrypted HTTPS/TLS connection, role-based restricted access, passwords stored as hashes, regular security updates, backups. Full details in the GDPR Policy — Personal Data Security.

11. Minors’ data

The website is not addressed to persons under 16 years of age, and orders may only be placed by persons with full legal capacity. Data of minors participating in the event is provided by the parent or legal representative, who assumes responsibility for its accuracy.

12. Changes to this policy

We may update this policy whenever the way we process data or the applicable legislation changes. The version in force is always the one published on this page, with the update date shown below. Significant changes will be announced on the website.

Contact: contact@paradabaloanelor.ro

Last updated: August 20, 2026