Aria Hotel Chișinău
Last updated: 12.10.2026
1. General provisions
This Privacy Policy explains how FIRMA “VEGA-L” S.R.L. (“we”, “us”, the “Hotel” or the “Controller”) collects, uses, stores and protects the personal data of guests, visitors to the ariahotel.md website and other people who contact us.
This Policy has been prepared in accordance with Law of the Republic of Moldova No. 195/2024 on Personal Data Protection and other applicable regulations. Where processing falls within the scope of Regulation (EU) 2016/679 (GDPR), it is also carried out in accordance with the GDPR.
This Policy applies to the processing of data when you:
- use the ariahotel.md website;
- book rooms, tables or function rooms, including through partner platforms;
- contact us by phone, email, through website forms or social media;
- stay at the Hotel and use our services: accommodation, restaurant and bar, events, parking and additional services;
- visit the Hotel premises, including areas covered by video surveillance.
2. Data controller
| Controller | FIRMA “VEGA-L” S.R.L. |
| IDNO | 1003600028325 |
| Address | str. Alba Iulia, 7, Chișinău, MD-2051, Republic of Moldova |
| info@ariahotel.md | |
| Phone | +373 (68) 477-778, +373 (22) 999-171 |
For any questions about the processing of personal data, including exercising your rights, please write to info@ariahotel.md or to the Hotel’s postal address.
3. What data we process
We collect only the data needed for a specific purpose.
3.1. Website visitors
- IP address, device type, browser, language and operating system;
- pages viewed, date and time of visit, referral source;
- cookies and other online identifiers (according to your cookie banner settings);
- data you enter in website forms: name, phone, email, message text.
3.2. Booking and accommodation
- first name, last name, contact details;
- identity document details, to the extent required for guest registration by law;
- dates of stay, room type, number and composition of guests;
- booking history, changes, cancellations, requests and complaints;
- special requests: bed type, late arrival, staying with a pet, babysitting services, etc.;
- vehicle details, if you use the parking;
- billing and payment details.
3.3. Oxygen restaurant and bar
- name and contact details of the person booking a table or placing an order;
- date, time, number of guests, order details;
- information about allergies and special diets that you provide voluntarily.
3.4. Events and function rooms
- details of the client, organiser and their representatives;
- contractual, financial and contact details;
- information about the event, number of participants, catering, accommodation and technical requirements;
- lists of participants, if provided by the organiser.
3.5. Partners and representatives of organisations
- first name, last name, position, organisation, business contact details;
- business correspondence, contracts, powers of attorney, invoices.
3.6. Video surveillance
- image, date, time and location within the monitored area;
- materials related to security incidents.
3.7. Payments
Depending on the payment method, we may process the payer’s name, amount, date and purpose of payment, bank details, transaction ID and status. Full bank card details are processed by the bank or payment provider; we receive only the information needed to confirm the payment.
Please do not send through website forms or email any data that is not needed for your request, in particular bank card details and health information.
4. Purposes and legal bases for processing
We process personal data only where there is a lawful basis. Consent is not the only basis: it is not required where processing is necessary to perform a contract or comply with a legal obligation.
| Purpose | Main data | Legal basis |
|---|---|---|
| Responding to enquiries, preparing offers, bookings | Contact details, content of the request, selected services | Steps taken at your request before entering into a contract |
| Accommodation, restaurant, events, parking and other services | Identification and contact details, booking and service data | Entering into and performing a contract |
| Guest registration, accounting and tax records | Identification, contractual and financial data | Compliance with a legal obligation |
| Taking into account allergies, special diets and accessibility needs | Information you provide voluntarily | Performance of a contract; for health data — your explicit consent |
| Payments, refunds, fraud prevention | Payment and transaction data | Performance of a contract; legal obligation; our legitimate interest |
| Safety of guests, staff and property | Video recordings, incident information | Our legitimate interest and that of third parties |
| Handling feedback, complaints and legal claims | Contact details, correspondence, contract data | Performance of a contract; legal obligation; legitimate interest |
| Newsletters and special offers | Contact details, marketing preferences | Your consent |
| Analytics and marketing cookies | Online identifiers, website usage data | Your prior consent |
| Photo and video shooting for advertising and social media | Image, voice | Separate consent |
When we rely on legitimate interest, we assess the necessity and proportionality of the processing and take into account your rights and reasonable expectations. You have the right to object to such processing in the cases provided by law.
5. Booking via Booking.com and other platforms
The “Booking” and “Book now” buttons on our website lead to the Booking.com platform. The data you enter on Booking.com, including payment details, is collected and processed by Booking.com in accordance with its own privacy policy. After you book, the platform sends us the information needed for your stay: name, contact details, dates, room type, requests and payment terms.
If you book through a tour operator, travel agency or employer, we receive your data from them. Anyone booking on behalf of other guests must have a lawful basis to share their data and must inform them accordingly.
We do not collect bank card details through forms on ariahotel.md.
6. Special categories of data
You may voluntarily share information about your health, allergies, disability, pregnancy, dietary or religious restrictions so that we can serve you safely and comfortably, for example in the restaurant or during your stay. In this case, we:
- do not request such information “just in case” and collect only what is needed for a specific service;
- give access to it only to staff who serve you directly;
- do not use it for advertising or other incompatible purposes;
- delete it once it is no longer needed.
You may withdraw your consent at any time. This does not affect the lawfulness of processing before withdrawal; however, if a service cannot be provided safely without certain information, we may offer a safe alternative.
7. Video surveillance
Video surveillance is carried out in the Hotel’s common areas to ensure the safety of guests, visitors and staff, to protect property, and to prevent and investigate incidents. The legal basis is our legitimate interest and that of third parties.
- Cameras are not installed in guest rooms, toilets, changing rooms or other places where a higher level of privacy is expected.
- Areas under video surveillance are marked with information signs.
- Video surveillance is carried out without audio recording.
- Access to recordings is limited to a small number of authorised persons.
- Recordings are not used for advertising or to evaluate staff performance and are disclosed to public authorities only where there is a legal basis.
Requests for access to a recording are handled taking into account the rights of others; where necessary, images of third parties are masked.
8. Cookies
The website uses necessary, functional, analytics, performance and marketing cookies. Necessary cookies are always active; all others are used only after you give consent in the banner. You can change your choice at any time via the cookie settings icon.
A detailed list of cookies, their purposes and retention periods is available in our Cookie Policy.
9. Marketing communications
We send newsletters and special offers only with your consent. Consent to marketing is given separately from booking, is not a condition for receiving our services and can be withdrawn at any time. Every marketing email contains a free unsubscribe link. After you unsubscribe, your contact may be kept on a minimal suppression list so that we do not contact you again.
10. Photo and video shooting at events
Video surveillance and event photography are different things. If we organise photo or video shooting for our website or social media, participants are informed in advance and, where necessary, asked for separate consent. Attending an event does not in itself mean consent to the use of your image in advertising. If shooting is organised by the event client or their contractor, they are responsible for the processing of the data.
11. Data of minors
We process the data of underage guests only when necessary for booking, accommodation or providing a service (such as babysitting) and where permitted by law. As a rule, such data is provided by a parent or legal guardian. We collect only the minimum necessary information and do not use children’s data for marketing purposes.
12. Who we share data with
Where necessary and on a lawful basis, access to data may be given to:
- authorised Hotel staff;
- booking platforms (such as Booking.com) and travel partners;
- banks and payment service providers;
- providers of hotel software, hosting, email and technical support;
- security service providers;
- event contractors (catering, technical equipment, photo and video), where necessary;
- accountants, auditors, lawyers, insurers;
- public authorities, courts and law enforcement — where required by law.
Providers that process data on our behalf are bound by confidentiality and act only on our instructions. Some recipients, such as Booking.com, are independent controllers and process data under their own rules.
We do not sell personal data.
13. International data transfers
Some providers (booking platforms, cloud services, analytics, email) may process data outside the Republic of Moldova. In such cases, we use the transfer mechanisms and safeguards provided by Law No. 195/2024 and, where the GDPR applies, its requirements. More information about the specific mechanism is available on request at info@ariahotel.md.
14. Retention periods
We keep data no longer than necessary for the purpose of processing, taking into account statutory retention periods and limitation periods for legal claims.
| Category | Period |
|---|---|
| Enquiries via forms and email that did not result in a booking | Up to 12 months from the last contact |
| Bookings, contracts, service history | For the duration of the contract and applicable limitation periods |
| Registration, accounting and tax records | For the periods set by the legislation of the Republic of Moldova |
| Information about allergies, special diets and health | For the duration of the service, then deleted |
| Marketing data | Until consent is withdrawn |
| Video recordings | As a rule, no longer than 30 days, unless a recording is needed to investigate an incident or at the request of public authorities |
| Cookies | As set out in the Cookie Policy |
Once the period expires, data is deleted, destroyed or irreversibly anonymised.
15. Data security
We apply technical and organisational security measures proportionate to the risks: access control, protection of accounts and systems, backups, and confidentiality obligations for staff and contractors. No method of transmission or storage is completely secure, but in the event of an incident we will assess it and, where required by law, notify the supervisory authority and the persons concerned.
16. Your rights
Under applicable law, you have the right to:
- receive information about processing and access your data;
- have inaccurate data corrected or incomplete data completed;
- have your data erased where there is no lawful basis to keep it;
- restrict processing;
- receive your data in a structured, machine-readable format and transfer it to another controller (data portability);
- object to processing based on legitimate interest;
- opt out of marketing communications at any time without giving reasons;
- withdraw consent without affecting the lawfulness of processing before withdrawal;
- not be subject to decisions based solely on automated processing;
- lodge a complaint with the supervisory authority and seek judicial remedy.
These rights are not absolute: for example, we may continue to keep data where required by law or where it is needed to establish, exercise or defend legal claims.
17. How to exercise your rights
Send your request to info@ariahotel.md or to the Hotel’s postal address. Please state what you are requesting and provide details that help us find the relevant information. To avoid disclosing data to the wrong person, we may ask for reasonable proof of identity.
We will respond without undue delay and within the time limits set by law. Exercising your rights is generally free of charge.
18. Supervisory authority
If you believe your data is being processed unlawfully, you may contact the National Center for Personal Data Protection of the Republic of Moldova (CNPDCP):
- address: 48 Serghei Lazo St., Chișinău, MD-2004
- phone: +373 22 820 801
- email: centru@datepersonale.md
- website: datepersonale.md
19. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
20. Changes to this Policy
We may update this Policy when legislation, our services or the technologies we use change. The current version is always published on this page with the date of the latest update. We will also inform you of material changes by other reasonable means.
21. Contact
FIRMA “VEGA-L” S.R.L. / Aria Hotel Chișinău
str. Alba Iulia, 7, Chișinău, MD-2051, Republic of Moldova
Email: info@ariahotel.md
Phone: +373 (68) 477-778, +373 (22) 999-171