General Information Notice Regarding the Processing of Personal Data
Version 1.2 | Last modified on 06.10.2026
In this document we explain how the company Transavia S.A. processes your personal data and ensures their protection, in accordance with applicable legislation in the field, including Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (GDPR).
This notice applies in relation to the data processing carried out by Transavia S.A. This document is relevant to you regardless of your capacity: customer, partner – natural person, representative of a partner – legal entity, applicant for an offer or person contacting us for other purposes (e.g., regarding requests or complaints), visitor to one of our headquarters or work points, intern, visitor to our website or social media pages, participant in contests organized by us, etc.
This notice addresses, in the order below, the following aspects:
- Who we are and how to contact us (identification data of the Controller)
- Data categories. Purpose. Legal basis
- To whom we will disclose your personal data
- How long we will retain your data
- What can happen if you do not provide us with your data
- Your rights and how to exercise them
- When does this information apply
1. Who we are and how we can be contacted
Full name of the Operator: Transavia S.A.
Registered office address (mailing address): Sântimbru, Blajului Street, no. 244 D, Alba County, registered with the Trade Register under no. J1994000089015, fiscal code RO5182310.
Phone number: +4 0258 81 44 66 (available Monday through Friday between 08:00 and 16:00)
Email address: contact.gdpr@transavia.ro
2. Data categories. Purpose. Legal basis
| Personal data processed | Scope/Activity | Data types | Legal basis for processing | Retention period |
|---|---|---|---|---|
| Customer data (or, in the case of a legal entity, the data of the customer's representative) as part of the Operator's commercial activities | Customer / prospective customer relationship management Sending offers upon the request of customers / prospective customers | Identification data of clients/potential clients (last name, first name, e-mail, phone number, job title) Financial data (bank account, payments, billing data) | Following the steps to initiate/conclude a contract with the Operator for the supply of the requested products and services | Retention will be required for the duration of: • the contractual/commercial relationship; • any legal retention period (e.g. for tax, archiving purposes) |
| Contact person's details within the client (other than the legal representative) in relation to a business relationship | Customer / prospective customer relationship management | Identification data of customers / potential customers (last name, first name, e-mail, phone number, job title, employer) Data included in the request sent by the customer | The Controller's legitimate interest in ensuring the management of the contract/commercial relationship and in responding to any requests/complaints related to the commercial relationship, as well as for defending the Controller's interests | Retention will be required for the duration of (whichever is longer): • the contractual/commercial relationship; • any legal procedure before any authority/court for the defense of the Controller's rights; • any legal retention period (e.g., for tax, archiving purposes) |
| The information you send us to answer a survey, complete a questionnaire or any contact form, or to send a notification or feedback | Management of surveys, customer satisfaction programs, improvement of products and services | Name, e-mail address, phone number, other personal details from the submitted information | Consent for registration and the fulfillment of a legal obligation if you express your wish to no longer receive commercial prospecting messages. | The data will not be kept longer than 3 years since the last contact |
| Subscribing to marketing communications | Sending and managing commercial communications Performing audience analysis and statistics. | Name, email address | Consent for enrollment and the fulfillment of a legal obligation if you express your wish to no longer receive commercial prospecting messages. The Operator's legitimate interest in the case of sending commercial offers to existing clients with whom the Operator has concluded a contract for the provision of similar goods and services in accordance with art 12 (2) of law 506/2004. | We will not keep marketing data for longer than 3 years from the last contact or until you withdraw your consent |
| Data that you provide to us when you participate in a commercial campaign or contest | To allow us to register you or send you additional information about the contest or a prize if you are the contest winner. Unless we state otherwise when collecting your information, we will use this information solely for the purpose of managing and administering competitions or contests. | Data collected through a contest, including those held via social media, may include, for example, the name, email address, and/or phone number or other related data necessary for participation in the contest (e.g., the social media comment). If you are the winner of a prize, we may also request your full address in order to send you the prize. | Your consent to participate in the campaign Performance of an agreement between you and us regarding the delivery of the prize to the winner Fulfillment of a legal obligation in the tax field (data related to winners) The Controller's legitimate interest to defend its rights in connection with any complaint or claim (data related to participants) | The data will be kept until the completion of the competition/contest and thereafter for a period of: • 3 years from the finalization of the competition/contest regarding the participants in order to defend against a claim; • retention periods imposed by tax laws (winner data), archiving, and other applicable laws. |
| Job applicants within the Operator | Managing recruitment and choosing the most suitable candidate for a specific position within the Operator | Name, email, phone number The data you provide in your CV/cover letter (e.g., address, photograph, professional experience, educational background, description of various skills or certifications, preferences, hobbies, etc.) The data recorded in the diplomas/certifications required for the position you are applying for (if applicable) | The Controller's legitimate interest in identifying the most suitable candidates to fill a vacant position within the Controller The Controller's legitimate interest in defending its rights against any complaints/claims raised by candidates Entering into a contract (in the case of candidates to whom the Controller has made an offer) Compliance with a legal obligation (e.g., creating the personnel file in accordance with labor legislation) | The data will be kept for the entire duration of the recruitment process and for a period: • of 3 years from the rejection of a candidate in order to defend against a claim; • during the performance of the employment contract (for candidates who received and accepted a job offer); • related to retention periods required by labor, tax, archiving, and other applicable laws (e.g., 75 years for the personnel file). |
| Visitor data for the headquarters/workplaces | Guard and asset protection Compliance with health and safety at work procedures, and the recording and reporting of work-related accidents | The image captured by the video cameras installed within the perimeter of the visited headquarters/workplace Last name, first name, phone number, size of protective equipment (if applicable) | Fulfillment of a legal obligation of the Controller under the legislation on the security of objectives, goods, valuables, and the protection of persons Fulfillment of a legal obligation of the Controller under occupational health and safety legislation The legitimate interest of the Controller to defend its rights against any claim | Data will be retained for a period of: • 30 days regarding video recordings; • for the duration of any legal proceedings before any authority/court in which the Operator is involved; • related to retention periods imposed by labor, tax, archiving, and other applicable laws (e.g., 75 years for the personnel file). |
| Contact details of press agency representatives, journalists, and other media partners (bloggers, vloggers, etc.) | To communicate / engage in dialogue with media representatives on topics of interest to the audience and the Operator | Last name, first name, email address, phone number, job title, date of birth | Conclusion and execution of a contract The Operator's legitimate interest in promoting its campaigns and marketing strategy. | The possible duration of communication on topics of interest to the audience and the Operator |
| Technical data of the webpage visitors | The purpose of ensuring the proper functioning of the website and improving the presentation of information on the site. Ensuring the security of the webpage. | Technical data automatically sent by the visitor's browser, such as: IP address, type of browser used, screen resolution, or the page from which they accessed our website. We do not use this data to identify visitors. | The Operator's legitimate interest in ensuring the security of the website and using technical data in aggregate for the proper functioning of the website. | Maxim 14 months since the last visit to the site. |
| Transavia social media page visitor data | To interact/communicate/dialogue with social media visitors who interact with our pages | Username, comment (depending on the social network) | User consent through initiation of interaction | The duration established by the social media network (as a joint controller) in accordance with the Terms of Use or until the user requests deletion. |
3. To whom we will disclose personal data concerning you
As a general rule, we will not disclose your data to other individuals or legal entities, except in the cases listed below. We strive to limit access to your data to individuals outside of Transavia S.A. who process your personal data (i.e., the company to which you provided your personal data). However, in certain cases, we may need to disclose your data, as described below. Your data will be processed by Transavia S.A. We may disclose your data to other companies or individuals, such as: individuals or legal entities acting as agents for the Controller in various areas (such as document archiving, document destruction, or data storage, payment services, recruitment services), other individuals, courts, and authorities. In these cases, we will disclose the data for legitimate reasons related to our business, such as ensuring our ability to safeguard documents, streamlining our operations, or establishing, defending, and exercising our rights or interests or those of another person. We use the hosting services provided by Astimp IT Solution S.R.L., which hosts the website www.transavia.ro; website maintenance is provided by Iviteb Solutions S.R.L. With regard to advertising campaigns, we use the services of MTH Strategic Marketing S.R.L. to manage the execution of campaigns. Regarding subscriptions to marketing communications, we use the SaaS services of SC Dazoot Software S.R.L. to send email marketing campaigns to our own contact database and the services of MTH Strategic Marketing S.R.L. to manage marketing campaigns. Regarding technical data related to visits to this website, we also use Google Analytics services in our capacity as a processor. With regard to data processed on social media platforms, we act as a joint controller (pursuant to Article 26 of the GDPR) together with the social media platform provider. The Controller has limited control over the data to which it has access, depending on the specific social media platform. The social media platform provider has its own data processing policy, over which the Controller has no influence. Furthermore, as noted above, in certain cases we may have a legal obligation to disclose data to public authorities or other individuals or legal entities. In all such cases, we will ensure that the recipients of your personal data process it securely and confidentially, in accordance with the purpose for which we transferred it and with respect for your rights. All of the above-mentioned parties or other recipients are located in the European Union or in any other jurisdiction that provides an adequate level of protection for personal data in accordance with European Union standards (Article 45 of the GDPR) or other appropriate safeguards, including standard data protection clauses (Article 46(2) of the GDPR).4. How long we will retain your data
We will store your data in accordance with our personal data retention policy, which assigns a retention period based on the purpose of the processing and the category of data processed. The respective periods are based on legal provisions (in particular in the field of personal data protection), also taking into account the obligations to store certain data, applicable limitation periods, recommended practices in the field, and the purposes of our activity. Additional details are available for each category of data listed above in the table in Article 2.5. What can happen if you do not provide your data
In most cases, you are under no obligation to provide us with your personal data. However, if you do not provide the requested data, we will not be able, for example, to conclude or negotiate a contract with you, sell you our products or provide you with our services, allow you access to all options on our website, respond to your complaints or requests, or send you communications regarding our products, services, and promotions that might interest you. The absence of automated decision-making We do not make decisions based solely on the automated processing of your data (including profiling) that would produce legal effects concerning you or similarly affect you to a significant extent.6. Your rights and how to exercise them
Your rights You have the following rights:- Right of access to data. You have the right to obtain access to, or copies of, your personal data that we process or control; you also have the right to obtain information from us regarding the nature, processing, and disclosure of such data.
- The right to rectification of data. You have the right to obtain the rectification of inaccuracies in the data concerning you that we process or control.
- The right to data erasure (the „right to be forgotten”). You have the right to obtain from us the erasure of data concerning you that we process or control.
- The right to restriction of data processing. You have the right to restrict the processing of your data that we process or control.
- Right to object. You have the right to object to the processing of your data by us or on our behalf.
- The right to data portability. You have the right to obtain the transfer of your data that we process or control to another data controller, if applicable – for example, if you have provided us with the data in a structured format.
- Right to withdraw consent. In situations where we process your data based on your consent, you have the right to withdraw your consent; you can do this at any time, at least as easily as you initially granted us your consent; the withdrawal of consent will not affect the lawfulness of the processing of your data that we carried out before the withdrawal.
- The right to lodge a complaint with a supervisory authority. You have the right to lodge a complaint with the supervisory authority for the processing of personal data regarding the processing of your data by us or on our behalf. In Romania, this authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).
7. When this notice applies
This general notice applies to the processing of your data by Transavia S.A. This notice does not apply to services or products offered by other companies or individuals, including those posted on our websites or about which we inform you in other ways. Furthermore, this notice does not cover the activity of other companies or individuals who advertise our services or products. Changes to this privacy notice It is possible to modify this information notice. In such cases, we will inform you in advance by posting this new notice on the website 20 days before it comes into effect. We will also post this information notice on our website at the following link: We will also keep all previous versions but of this information note, in order to be consulted by interested persons. This version of this policy will enter into force on 10.06.2026. What do the terms I used in this note mean- Data Protection Supervisory Authority: an independent public authority which, according to the law, has powers regarding the monitoring of compliance with personal data protection legislation. In Romania, this supervisory authority for personal data processing is the National Supervisory Authority for Personal Data Processing (ANSPDCP).
- Special categories of personal data (sensitive personal data / sensitive data): personal data revealing racial or ethnic origin, political opinions, religious denomination or philosophical beliefs or trade union membership; genetic data; biometric data for the unique identification of a natural person; data concerning health, sex life or sexual orientation of a natural person.
- Personal data: any information regarding an identified or identifiable natural person (referred to as a „data subject”). A natural person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier, for example: name, identification number, location data, online identifier, one or more specific elements proper to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person. Thus, for example, the notion of personal data includes the following: first and last name; home or residence address; e-mail address; phone number; personal numerical code (CNP); accessed medical services (these are sensitive data); established diagnosis (these are sensitive data); genetic data (these are sensitive data); biometric data (these are sensitive data); geolocation data. The categories of personal data concerning you that we process are listed above.
- Operator natural or legal person who decides why (for what purpose) and how (by what means) personal data is processed. According to the law, the responsibility for complying with personal data legislation lies primarily with the controller. In our relationship with you, we are the controller and you are the data subject.
- Authorized person: any natural or legal person processing personal data on behalf of the controller, other than the employees of the controller.
- Data subject: the natural person to whom certain personal data refers („belongs”). In relation to us (the controller), you are the data subject.
- Processing of personal data: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of such personal data or sets of personal data. These are just examples. Basically, processing means any operation performed on personal data, whether by automated or manual means.
- Third country: a state outside the European Union and the European Economic Area.
