Privacy policy

1. Introduction

This Privacy Policy explains how personal data is collected and used in connection with the ERA Pipera 150 website and related sales communications for the boutique apartment development at Pipera Blvd. no. 150, Voluntari, Ilfov, Romania (the “Project”). The Project is developed and promoted under the La Reserva brand.

It applies when you browse the website, review apartment inventory, submit a lead form, contact us by email, telephone or WhatsApp, request or attend a viewing, ask for an offer, or otherwise interact with the ERA Pipera 150 sales team. It also applies where a business partner or another person gives us your details in connection with a genuine enquiry.

For the purposes of this Policy, “personal data” means information relating to an identified or identifiable natural person, and “processing” includes collecting, recording, organising, using, disclosing, retaining and deleting that information. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), Romanian data-protection law and other applicable rules.

This Policy concerns pre-contractual, website and marketing processing. A property reservation or sale may require additional information and notices, which will be provided in the relevant contractual or compliance documentation. Please also read our Terms and Conditions and Cookie Policy.

Last updated: 3 September 2026.

2. Controller and contact

The controller is TWO PROPERTIES S.R.L., a limited liability company with its registered office at Str. Măcesului, No. 7, Building II, Floor 2, Apt. 6, Cluj-Napoca, Cluj County, Romania, Trade Registry no. J12/681/2020, Tax ID (CIF) RO42298060. The Project is developed and promoted under the La Reserva brand.

Depending on your interaction, a Project development or sales entity may process data as an independent or joint controller where it determines why and how the data is used. We will identify the relevant contracting controller in transaction documents. Suppliers that process data only on documented instructions act as processors.

For privacy questions, to exercise a right, or to contact the person responsible for data-protection matters, use:

• Privacy and DPO contact: contact@era-pipera150.ro
• Telephone: +40 735 200 100
• Registered office: Str. Măcesului, No. 7, Building II, Floor 2, Apt. 6, Cluj-Napoca, Cluj County, Romania
• Project address: Pipera Blvd. no. 150, Voluntari, Ilfov, Romania

Address your request to “ERA Pipera 150 – Data Protection” so it can be routed promptly. References below to “we”, “us” or “our” mean the applicable controller (TWO PROPERTIES S.R.L., unless otherwise stated in a transaction document).

3. Personal data we collect

3.1 Contact and identification information

When you make an enquiry, we may collect your name, email address, telephone number, preferred communication channel, language and any details included in your message. If you represent a company or another person, we may also collect your role, organisation and authority to act. During a transaction, separate legal requirements may require identity, address, civil-status, representation, tax, banking, source-of-funds or similar documentation.

3.2 Property preferences and sales interaction

We may record the apartment or unit you are interested in, desired number of rooms, floor, area, orientation, budget range, parking or storage needs, intended use, expected purchase timing, financing status and other preferences you choose to provide. We also retain relevant correspondence, call notes, quotation history, appointment status, viewing attendance, feedback, follow-up requests and sales-stage information.

If you visit the Project or a sales location, we may record appointment and access details needed to organise the visit and maintain site safety. Where a location uses video surveillance, separate signage and information will identify the relevant controller and specific retention conditions; this Website Policy does not replace that notice.

3.3 Device, usage and cookie data

When you access the website, servers and necessary technologies may process IP address, date and time, requested page, referral information, response status, device and browser type, language, approximate region, cookie or consent identifiers, and security or diagnostic events. Where you consent to analytics or marketing technologies, we and authorised providers may also process page views, navigation, interactions, campaign attribution, approximate location, device identifiers and conversion events, according to the cookie settings then active.

3.4 Communications and documents

We process content that you send by form, email or WhatsApp and may log the fact, time and business outcome of telephone communications. Calls are not recorded unless you are told in advance and a lawful basis exists. Attachments may contain additional data; please avoid sending data not needed for your request.

3.5 No routine collection of sensitive data

We do not seek health, biometric, political, religious, sexual-orientation or other special-category data through the Website. Do not include it in a general enquiry. If particular information becomes legally necessary in a transaction or to accommodate an accessibility request, it will be handled under an appropriate GDPR condition with additional safeguards where required.

4. Sources of personal data

Most personal data comes directly from you when you browse, set cookie choices, complete a form, communicate with our team or attend a viewing. We may also receive data from:

• a family member, representative, employer or co-buyer who makes an enquiry involving you;
• an authorised estate agent, broker, referral partner, advertising platform or lead-generation channel;
• WhatsApp, social-media, map or communications services when you choose to interact through them;
• technical providers that supply hosting, security, analytics, consent-management or delivery information;
• public authorities, notaries, lawyers, banks and public registers where relevant and legally permitted for a proposed transaction; and
• information already lawfully held in connection with an earlier La Reserva enquiry, where its use for the Project is compatible with the original purpose or separately authorised.

If someone provides us with your details, we expect them to have authority or another lawful basis to do so and to direct you to this Policy. You may contact us to clarify the source of your data, subject to lawful limitations protecting other persons’ rights.

5. Purposes and legal bases

5.1 Responding to requests and taking pre-contractual steps

We use contact details, preferences and correspondence to answer questions, provide requested brochures or unit information, prepare an indicative quotation, organise a viewing and take steps you request before a possible reservation or sale. The legal basis is Article 6(1)(b) GDPR where processing is necessary for steps at your request before entering a contract. Where your enquiry is general or made on behalf of another person, our legitimate interest in responding and operating an effective sales function under Article 6(1)(f) may apply.

5.2 Managing sales relationships and the Project

We maintain enquiry history, appointment records, availability discussions and internal sales administration to coordinate responses, prevent conflicting reservations, improve service and understand demand. We rely on legitimate interests in administering and promoting the Project, maintaining accurate business records and following up on genuine enquiries. We balance those interests against your rights and reasonable expectations and limit data to what is relevant.

5.3 Concluding and performing contracts

If you proceed, data will be used to prepare, conclude and administer reservation and sale documents, collect payments, coordinate handover, communicate about construction and perform contractual obligations. Article 6(1)(b) GDPR generally applies. Processing concerning representatives, co-buyers or other participants may rely on legal obligations or legitimate interests in managing the transaction.

5.4 Compliance and legal claims

We process data where necessary to comply with accounting, tax, notarial, consumer-protection, anti-money-laundering, sanctions, record-keeping and authority-request obligations under Article 6(1)(c). We may also preserve and use relevant records under Article 6(1)(f) to establish, exercise or defend legal claims, prevent fraud, enforce website terms and protect the rights, property and safety of visitors, staff and partners.

5.5 Website operation and security

Necessary logs and technologies support page delivery, load balancing, consent storage, form transmission, abuse prevention, troubleshooting, availability and security. Processing rests on our legitimate interest in providing a functional and secure service and, where applicable, on rules permitting technologies strictly necessary for a service requested by the user.

5.6 Analytics, preferences and marketing

Where required by law, we rely on your consent under Article 6(1)(a) for non-essential analytics or marketing cookies, personalised advertising technologies and optional preference storage. Consent is voluntary and can be withdrawn prospectively at any time through cookie settings. These technologies may be described by the website but remain inactive unless configured and consented to.

For direct electronic marketing, we rely on consent where legally required. In limited cases involving existing customers, applicable law may permit relevant communications subject to a clear opt-out; we will use that exception only when its conditions are met.

6. Enquiries, viewings and marketing

Submitting a lead form authorises us to contact you about that request through the details and channels you provide. A response to your enquiry, an appointment reminder, availability update concerning your requested unit or information needed for a requested quotation is a service communication, not necessarily marketing.

If you separately choose to receive news, offers or updates beyond the specific enquiry, we may send promotional communications by email, telephone or messaging service in line with that choice. Each marketing email will offer an unsubscribe method where technically applicable. You can also object or withdraw consent by emailing contact@era-pipera150.ro. Withdrawal does not affect processing already carried out lawfully and does not stop transactional or legally required messages.

WhatsApp is operated by a third party. If you initiate contact through WhatsApp, the service processes account, device and communication metadata under its own terms and privacy notice. We use the message content received by the ERA account to respond and administer your enquiry. You may switch to email or telephone at any time, although messages already transmitted remain subject to applicable retention rules.

We do not sell personal data. We do not share lead details with unrelated organisations for their own direct marketing without an appropriate legal basis and transparency.

7. Cookies and similar technologies

The website may use browser cookies, local storage, pixels, tags and comparable technologies. Necessary technologies support core functions, security and the recording of privacy choices. Preference technologies remember optional settings. Analytics technologies help measure aggregate use and performance. Marketing technologies may measure campaigns, build audiences or support relevant advertising.

Analytics and marketing categories are activated only where the consent required by law has been recorded. A category or provider may appear in our disclosures even when it is not currently active, because configuration can vary by environment or campaign. Rejecting non-essential categories does not prevent ordinary access to the website, although optional media or personalisation may not function.

For category details, likely providers, purposes, duration, controls and browser options, see the Cookie Policy. You can revisit the cookie banner or settings panel to change optional choices. Withdrawal applies to future access; deleting existing cookies may require use of browser controls.

8. Recipients and processors

Access is limited according to role and need. Personal data may be disclosed to:

• authorised staff and representatives working on Project management, sales, customer care, finance, legal, compliance, IT and security;
• La Reserva Project or group entities involved in responding to the enquiry or carrying out the proposed transaction;
• hosting, website maintenance, CRM, email, telephony, messaging, cloud storage, cybersecurity, analytics, advertising and consent-management providers;
• architects, contractors or technical consultants where needed to answer a unit-specific request, generally with data minimised;
• lawyers, auditors, accountants, insurers, banks, financing intermediaries and notaries where relevant to advice, compliance or a transaction;
• public authorities, courts, tax bodies, law-enforcement agencies or regulators where disclosure is required or lawfully requested; and
• a buyer, investor or adviser in a contemplated corporate or Project reorganisation, financing or transfer, under suitable confidentiality and due-diligence safeguards.

Processors are selected with regard to reliability and are bound by contracts requiring confidentiality, appropriate security and processing only on documented instructions. Some recipients, such as a notary, bank, authority, Meta/WhatsApp or advertising platform, may act as independent controllers for their own purposes. Their notices govern those activities.

9. International transfers

We aim to use services located in the European Economic Area (EEA) where practical. However, global communications, cloud, analytics, messaging and advertising providers may process data in countries outside the EEA, including through remote support or their corporate networks.

Where we make or permit a restricted transfer, we use a mechanism recognised by applicable law, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, and supplementary technical or organisational safeguards where appropriate. Some providers may rely on another valid certification or legal mechanism. Information on the relevant safeguard or a copy of its principal terms can be requested from our privacy contact, subject to redaction of confidential or security information.

Using a third-party platform at your own initiative may result in a transfer governed directly by that platform’s privacy terms. We encourage you to review them before sending information.

10. Retention

We keep personal data only for as long as reasonably necessary for the purpose collected, including legal, accounting, reporting, security and claims requirements. Retention depends on the nature of the interaction:

• unconverted enquiries and sales notes are generally reviewed periodically and deleted or anonymised when no longer relevant, ordinarily within three years after the last meaningful interaction unless a shorter period is appropriate or you request earlier deletion;
• appointment and viewing information is retained with the related enquiry for sales administration and any necessary safety or incident follow-up;
• marketing data is kept until consent is withdrawn, you object, the channel becomes invalid or a periodic review shows there is no continuing justification; a minimal suppression record may be retained to respect an opt-out;
• server and security logs are normally retained for a shorter operational period unless needed to investigate an incident;
• consent records may be retained for the validity of the consent and an additional limitation period to demonstrate compliance; and
• transaction, accounting, tax, compliance, warranty and legal records are retained for statutory periods and for the time needed to establish, exercise or defend claims.

At the end of the period, data is deleted, securely destroyed or irreversibly anonymised. Backup copies may remain until routine rotation, protected from ordinary use. A legal hold, dispute, authority request or suspected fraud may justify longer restricted retention.

11. Your data-protection rights

Subject to the GDPR’s conditions and exceptions, you may have the right to:

• access your personal data and receive information about its processing;
• rectify inaccurate information and complete incomplete information;
• erase data where there is no continuing lawful reason to keep it;
• restrict processing in specified circumstances;
• object to processing based on legitimate interests, including an absolute right to object to direct marketing;
• port data you provided where processing is automated and based on consent or contract;
• withdraw consent at any time, without affecting earlier lawful processing; and
• seek safeguards concerning a decision based solely on automated processing that produces legal or similarly significant effects.

Send a request to contact@era-pipera150.ro. State the right you wish to exercise and enough detail to locate the relevant interaction. We may ask for proportionate proof of identity, especially where the request comes from a new address or seeks copies of sensitive records. This protects data against unauthorised disclosure.

We normally respond within one month. The GDPR permits an extension by up to two additional months for complex or numerous requests, in which case we will explain the delay. Requests are generally free, but a reasonable fee or refusal may be permitted for manifestly unfounded or excessive requests. Rights are not absolute; for example, deletion may be unavailable where records must be retained by law or for legal claims. If an exception applies, we will explain it where legally allowed.

12. Security and data provision

We apply technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and access. Depending on the system and risk, measures may include access controls, role separation, authentication, encryption in transit, backups, logging, supplier due diligence, confidentiality commitments and incident procedures.

No internet transmission or storage system is completely secure. You should use care when sending documents, verify unusual payment or identity requests through a known telephone number and avoid sharing passwords or complete card data. If you suspect a fraudulent communication claiming to concern ERA Pipera 150, contact us promptly at +40 735 200 100.

Fields marked as required in a form are needed to transmit and answer the enquiry. Providing other preference information is voluntary but may help us recommend suitable units. Information required by law or contract during a transaction must be provided if you wish to proceed; without it, we may be unable to prepare documents, complete compliance checks or conclude the transaction.

13. Children and third-party data

The website and property sales services are not directed to children, and we do not knowingly solicit leads from persons under 18. A parent or legal guardian should contact us where a minor’s interests are relevant to a transaction. If you believe a child submitted personal data without appropriate involvement, notify us so we can assess and delete it where required.

If you provide another person’s data—for example, a spouse, co-buyer, representative or guest attending a viewing—you must have a lawful reason to do so, provide only relevant information and make this Policy available to that person. Do not submit identity documents for another person unless requested and properly authorised.

14. Automated decisions

We do not ordinarily make decisions about property eligibility or contract conclusion based solely on automated processing where the decision has legal or similarly significant effects. Sales staff may use filters, CRM reminders, availability matching or lead-prioritisation tools to organise enquiries, but a human can review material decisions.

Consent-based analytics or advertising providers may create audiences or infer interests for ad selection. This can affect which advertisements you see but does not itself decide whether you may buy an apartment. Details and controls are provided in the Cookie Policy and by the relevant platform.

15. Policy changes

We may revise this Policy to reflect legal developments, Project operations, new website functions, provider changes or improved explanations. The current version and update date will be published here. If a change materially affects processing based on consent, we will request a new choice where required. Earlier versions may be requested where reasonably available.

16. Questions and complaints

Please send questions, requests and concerns to the privacy and DPO contact at contact@era-pipera150.ro. You may also write to the controller TWO PROPERTIES S.R.L. at Str. Măcesului, No. 7, Building II, Floor 2, Apt. 6, Cluj-Napoca, Cluj County, Romania (Trade Registry J12/681/2020, CIF RO42298060), to the Project address at Pipera Blvd. no. 150, Voluntari, Ilfov, Romania, or call +40 735 200 100.

You also have the right to lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), using the contact channels published on its official website. If you live or work elsewhere in the EEA, you may also be entitled to approach the competent supervisory authority there. We encourage you to contact us first so we have an opportunity to understand and address the concern, but doing so is not a condition of filing a complaint.