Privacy Policy
1. Who we are
The data controller is Sun Travel SRL (VAT RO 17842208), registered office Str. Gyárfás Jenő nr. 3, Sfântu Gheorghe, Covasna County, Romania — a travel agency operating as a Christian Tour franchise, with offices in Sfântu Gheorghe, Miercurea Ciuc and Brașov. Privacy contact: manager@suntravel.ro, phone +40 743 972 868.
This policy covers the data we process when you write to us on WhatsApp, Facebook Messenger, in the comments on our Facebook pages and on our TikTok account @suntravel2005, including when you are answered by Sofia, our AI-based travel consultant.
2. Data we process
2.1 WhatsApp and Facebook Messenger conversations
- your account identifier (WhatsApp number or Messenger ID) and profile display name;
- the messages, photos, documents and voice messages you send us;
- the travel details you give us: destination, dates, number of travellers and children's ages, departure city, budget, preferences;
- your name and email address, if you give them to us so we can send an offer.
2.2 Comments on Facebook and TikTok
For comments posted publicly under our Facebook posts or under videos of our TikTok account @suntravel2005 we process: the comment text, the comment and post/video identifiers, the time of posting, and the public username and technical identifier of the commenting account, as provided by the platform. We process only comments on our own accounts; we do not read comments, messages or profiles of other accounts.
2.3 What we do NOT process
We do not request or process card data, national ID numbers, passwords or health data through these channels. Payments are made separately, through official channels, after a firm booking.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your requests and preparing travel offers | Steps prior to a contract, at your request (Art. 6(1)(b)) |
| Replying publicly to comments on Facebook and TikTok and passing requests to our office staff | Legitimate interest: responding to people who contact us publicly (Art. 6(1)(f)) |
| Handing the conversation over to a human consultant | Art. 6(1)(b) and (f) |
| Service security and quality (abuse prevention, error analysis) | Legitimate interest (Art. 6(1)(f)) |
| Contracts, invoices and complaints, if you book | Contract and legal obligations (Art. 6(1)(b) and (c)) |
We do not sell data, do not use it for advertising without consent and make no solely automated decisions with legal effects. Sofia only informs and prepares offers; bookings, contracts and payments are handled by a human consultant.
4. How TikTok comments are handled
When someone comments under a video of @suntravel2005, TikTok sends us the comment through its official business interface (TikTok API for Business — Accounts API), which we have authorised for our own account only. The comment is:
- classified automatically (offer request, appreciation, other, spam) — for this purpose the comment text is sent to Anthropic, the provider of the AI model;
- where appropriate, answered publicly with a short reply chosen from a fixed set of phrases (for example a thank-you, or an invitation to write to us on WhatsApp at the numbers in our profile) — replies contain no prices and no personal names;
- forwarded to our office staff in our internal Telegram group, so they can step in.
We do not send private messages on TikTok, do not track or analyse commenters' profiles and do not use TikTok data for any other purpose. We keep only a daily technical counter per account (to limit the number of replies), deleted after 30 days. You can delete your comment at any time directly in TikTok.
5. Recipients
| Recipient | Purpose |
|---|---|
| Christian Tour (package organiser) | checking offers, booking, travel documents — only if you request an offer or book |
| Anthropic, PBC (USA) — processor | generating Sofia's replies and classifying comments |
| Meta Platforms (WhatsApp, Facebook) | delivering messages and comments on their platforms |
| TikTok (TikTok Technology Ltd. for the EEA) | delivering comments and publishing our replies on TikTok |
| Telegram | internal communication with our office staff, who take over conversations |
| Deepgram (USA) — processor | transcribing voice messages to text |
| Railway (cloud infrastructure) | hosting our servers and database |
| Google (Gmail, Drive) | emails to our offices and backups |
| Public authorities | only where required by law |
6. Transfers outside the EEA
Some providers (Anthropic, Deepgram, Meta, Google, Railway) also process data in the USA. Transfers rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) or, where applicable, the EU–US Data Privacy Framework.
7. Retention
| Data | Period |
|---|---|
| WhatsApp and Messenger conversations | 180 days after the last message, then deleted automatically |
| Technical counter for TikTok comments | 30 days |
| Requests passed to our staff (escalations) | as long as needed for the offer, the booking and any complaint; we delete them at any time on request (see Data deletion) |
| Contracts and invoices, if you booked | 10 years (legal obligation) |
| Backups | our hosting providers may keep technical backups; deleted data disappears from them when older backups are replaced, under each provider’s own rules |
Public comments remain on Facebook or TikTok until you or we delete them.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP. Write to manager@suntravel.ro; we reply within 30 days. The erasure procedure is described on the Data Deletion page.
9. Security
We use encrypted connections (HTTPS/TLS), verify the signature of notifications received from Meta and TikTok, keep access keys only in the server's protected configuration, restrict database access to authorised staff and delete data automatically when the periods above expire.
10. Children
Our services are intended for adults planning a holiday. Children's ages in offer requests are used only to calculate prices.
11. Cookies
The suntravel.ro website does not use tracking or advertising cookies.
12. Changes
Any change is published on this page with its effective date.