This Privacy Policy explains how Bora Bora Club collects, uses, shares and protects personal data when you visit www.boraboraclub.ro, contact us, request a reservation, join an invitation list, enquire about a private event, attend one of our events or choose to receive marketing communications from us.
1. Who we are
The data controller is:
Company: Bora Bora Club
Address: Strada Șelari 26, 030167 Bucharest, Romania
Telephone: +40 758 057 775
Email: office@boraboraclub.ro
In this Privacy Policy, “Bora Bora Club”, “we”, “us” and “our” refer to the operator responsible for the processing described below.
2. Personal data we collect
Depending on how you interact with us, we may collect:
– your name;
– telephone number and WhatsApp number;
– email address;
– age or confirmation that you are at least 18 years old;
– reservation details, including the requested date, number of guests and related preferences;
– information submitted when requesting access to a private party or invitation list;
– information about a proposed private event, including the date, event type, expected number of guests and requirements;
– messages, feedback and correspondence sent to us;
– marketing preferences and records of your consent;
– information about how you interact with our emails or WhatsApp messages, where the service used provides this information;
– technical and usage information, such as IP address, browser, device, approximate location, pages visited, referral source, cookie identifiers and interactions with our website or advertisements;
– photographs or video recordings captured at our events, where event photography or filming takes place.
Please do not submit sensitive personal data unless we specifically request it and explain why it is needed.
3. How we collect personal data
We collect personal data:
– directly from you through forms, email, telephone, WhatsApp, reservations and event enquiries;
– when you join an event, invitation or marketing list;
– when you interact with our website, emails, advertisements or social media pages;
– through cookies, pixels and similar technologies, after obtaining consent where required;
– from booking, ticketing, payment, CRM or communications providers that you use to interact with us;
– from another person making a reservation or event enquiry on behalf of a group.
If you give us another person’s details, you must have permission to do so and should direct that person to this Privacy Policy.
4. Why we use personal data and our legal bases
We process personal data only when we have a lawful basis.
Enquiries, feedback and customer support
We use your contact details and message to respond, provide information and manage our relationship with you. The legal basis is taking steps at your request before entering into a contract, performing a contract, or our legitimate interest in responding to enquiries and operating our business.
Reservations and private-event enquiries
We use your details to assess availability, prepare an offer, confirm and manage a reservation or organise an event. The legal basis is taking pre-contractual steps at your request and performing our agreement with you. We may also process relevant records to comply with legal, accounting and tax obligations and to establish or defend legal claims.
Private-party access and invitations
We use the information supplied in a Request Access or invitation form to review the request, administer guest lists, send an invitation or RSVP request and operate the event safely. The legal basis is taking steps at your request and our legitimate interest in managing access, capacity, security and the character of private events.
Submitting a request does not guarantee selection, an invitation, a reservation or entry. We do not use solely automated decision-making that produces legal or similarly significant effects. Access decisions must not be based on unlawful discriminatory criteria.
Age and venue safety
We use age information or an 18+ confirmation to apply our entry rules, manage age-restricted services and protect guests and the venue. We recommend that the online form request only an **18 or older confirmation**, rather than a full date of birth, unless the exact age is genuinely necessary. A valid identity document may still be requested at the entrance.
Email and WhatsApp marketing
If you actively opt in, we use your name, email address and/or WhatsApp number to send information about events, parties, invitations, reservations and related Bora Bora Club news.
The legal basis is your consent. Email and WhatsApp are separate channels, and you should be able to choose either one or both. Refusing marketing consent does not affect your ability to contact us or request a reservation.
You may withdraw consent at any time:
– for email, use the unsubscribe link in the message or contact us;
– for WhatsApp, reply **STOP**, ask us to stop, or block the business account;
– for either channel, email office@boraboraclub.ro
Service messages needed to answer an enquiry or manage an active reservation are not marketing and may still be sent when necessary.
Website security and administration
We process technical logs to operate the website, prevent abuse, diagnose errors and protect our systems. The legal basis is our legitimate interest in maintaining a secure and functional website and, where applicable, compliance with legal obligations.
Analytics and advertising
With your cookie consent, we may use analytics and advertising technologies to measure website traffic, understand campaign performance, create audiences and show more relevant advertising. The legal basis for activating non-essential technologies and the related processing is consent.
5. Cookies, pixels and advertising partners
Our website may use:
– strictly necessary cookies required for security, consent preferences and essential website functions;
– Google services, which may include Google Analytics, Google Ads, YouTube or Google Maps;
– Meta technologies, which may include the Meta Pixel and advertising measurement for Facebook and Instagram;
– TikTok technologies, which may include the TikTok Pixel and advertising measurement;
– other functionality, analytics or advertising technologies listed in our Cookie Policy and cookie settings panel.
Non-essential analytics, advertising and embedded-content technologies should not be activated until you provide consent through the cookie banner. You can refuse them or change your choice at any time through the permanent **Cookie Settings** link on the website.
These services may receive information such as your IP address, device and browser information, page URL, cookie or advertising identifiers and actions performed on the website. If advanced matching or customer-list audience features are enabled, contact details may also be transmitted in hashed form, but only where a valid legal basis and the required disclosures and safeguards are in place.
For more information, see:
– [Meta Privacy Policy](https://www.facebook.com/privacy/policy/);
– [How Google uses information from partner websites](https://policies.google.com/technologies/partner-sites);
– [Google Privacy Policy](https://policies.google.com/privacy);
– [TikTok Privacy Policy for the EEA](https://www.tiktok.com/legal/page/eea/privacy-policy/en);
– [WhatsApp privacy information](https://www.whatsapp.com/legal/privacy-policy-eea).
The exact cookies, providers, purposes and lifetimes must be listed in a separate Cookie Policy based on a scan of the live website.
6. Event photography and video
Events may be photographed or filmed for security, documentary, social-media and promotional purposes. Where filming takes place, we will use reasonable notices at the venue and consider the nature of the recording and its intended use.
Wide crowd and atmosphere footage may be processed on the basis of our legitimate interests, subject to your rights. Focused portraits, interviews or content used prominently in advertising may require a separate consent or image release. You may speak to our team at the event or contact us if you have concerns about an image in which you are identifiable.
7. Who receives personal data
We may share personal data only when necessary with:
– authorised Bora Bora Club personnel;
– website hosting, maintenance, security and consent-management providers;
– email, CRM, reservation, ticketing and customer-support providers;
– WhatsApp Ireland Limited, Meta Platforms Ireland Limited and relevant Meta service providers, where WhatsApp or Meta services are used;
– Google Ireland Limited and relevant Google service providers, where Google services are used;
– TikTok Technology Limited and relevant TikTok service providers, where TikTok services are used;
– payment, accounting and professional advisers, if these services are used;
– public authorities, regulators, courts or law-enforcement bodies when disclosure is legally required;
– a buyer, investor or successor in connection with a genuine business reorganisation, subject to appropriate safeguards.
Depending on the service and processing activity, these recipients may act as our processors, independent controllers or joint controllers. We require processors to use personal data only on documented instructions and to maintain appropriate security and confidentiality.
We do not sell your personal data.
8. International transfers
Some technology providers may process personal data outside Romania or the European Economic Area. When personal data is transferred outside the EEA, we use a lawful transfer mechanism, such as an adequacy decision, the EU–US Data Privacy Framework for participating organisations, or European Commission Standard Contractual Clauses together with additional safeguards where necessary.
You may contact us for more information about the safeguards relevant to your data.
9. How long we keep personal data
We retain personal data only for as long as necessary for the relevant purpose:
– contact enquiries and feedback: normally up to 24 months after the last meaningful interaction;
– unconfirmed reservation or event requests: normally up to 12 months after the requested event date or last interaction;
– confirmed reservations, contracts and transaction records: for the duration required by applicable accounting, tax and limitation rules;
– marketing contact data: until you withdraw consent or after 24 months without meaningful interaction, whichever occurs first;
– consent and opt-out records: for as long as necessary to demonstrate compliance and normally up to three years after withdrawal or the final marketing communication;
– website security logs: normally up to 12 months, unless a longer period is necessary to investigate an incident;
– photographs and videos: according to their purpose, relevance and continued lawful use, with periodic review.
Data may be kept longer where required by law or necessary to establish, exercise or defend legal claims. When no longer required, it is deleted, anonymised or securely restricted.
10. Your rights
Subject to the conditions in applicable law, you have the right to:
– obtain confirmation that we process your data and request access to it;
– correct inaccurate or incomplete data;
– request deletion of your data;
– request restriction of processing;
– receive data you provided in a structured, commonly used and machine-readable format and request portability where applicable;
– object to processing based on legitimate interests;
– object at any time to direct marketing, including related profiling;
– withdraw consent at any time, without affecting processing carried out before withdrawal;
– request human intervention where a qualifying solely automated decision is used;
– lodge a complaint with a supervisory authority.
To exercise your rights, email [office@boraboraclub.ro](mailto:office@boraboraclub.ro). Please describe your request clearly. We may ask for information reasonably necessary to verify your identity and will respond within the period required by law.
You may also complain to the Romanian supervisory authority:
National Supervisory Authority for Personal Data Processing — ANSPDCP
[www.dataprotection.ro](https://www.dataprotection.ro/)
[Online complaint forms](https://www.dataprotection.ro/formulare/)
11. Security
We use technical and organisational measures appropriate to the risks involved, including access controls, account security, software updates, backups, confidentiality obligations and incident-management procedures.
No online service is completely secure. Please do not send unnecessary sensitive information through general website forms or WhatsApp.
12. Children
Our club events, reservations and invitation services are intended for people aged 18 or over. We do not knowingly collect personal data from children for these purposes. If you believe a child has submitted personal data, please contact us so that we can review and, where appropriate, delete it.
13. Third-party websites and social media
Our website may link to third-party websites, ticketing services, maps or social-media platforms. Those parties process personal data under their own terms and privacy policies. We are not responsible for their independent processing activities.
14. Changes to this Privacy Policy
We may update this Privacy Policy when our services, technologies or legal obligations change. The current version and its effective date will be published on this page. If a change materially affects how we use data based on consent, we will request new consent where required.
14. Contact us
For questions, requests or complaints concerning personal data, contact:
**Bora Bora Club**
Strada Șelari 26, 030167 Bucharest, Romania
Telephone: +40 758 057 775
Email: office@boraboraclub.ro
Last update: 01 September 2026