Privacy Policy

Last updated: 01.10.2026

This policy explains what personal data we collect through the BonTrip platform, why we collect it, who we share it with, how long we keep it and what rights you have over it.

1. Who we are

The BonTrip platform is operated by MBF NETWORK, registered office at Str. Voinicenilor nr. 163, Târgu Mureș, România, registered with the Trade Register under no. J26/109/2011, VAT ID 28011700.

For any question about your personal data, write to us at office@bontrip.ro.

2. What BonTrip is and is not

BonTrip connects people interested in outdoor activities with the organizers who provide them. We do not run the activities and do not process online payments.

There is no instant booking: you send a quote or booking request, and the organizer replies to you directly. The contract for the activity is concluded between you and the organizer.

3. What data we collect and on what basis

3.1. If you send a request without an account

name, email address and, optionally, phone number;
number of participants, group type and preferred date, if you fill them in;
the message you write;
IP address and the language you sent the request in.

This data is passed to the activity organizer so they can reply. Legal basis: steps taken at your request before entering into a contract.

3.2. If you create a member account

name, email address, password (stored only in encrypted form);
optionally: phone, profile picture, preferred language;
registration date and email confirmation date;
date and IP address of your last sign-in.

If you previously sent requests anonymously using the same email address and later create an account and confirm that address, those requests are linked to your account so you can track them in one place. The link is made only after the address is confirmed, precisely so that nobody can claim someone else's requests. Legal basis: performance of our contract with you.

3.3. If you are an organizer (partner)

identification details of the company and contact person;
address, county and locality of operation;
profile information you publish: description, logo, images, competences, years of experience;
the content of published activities.

Some of this information is public by its nature — it appears on your organizer page and on activity pages. Legal basis: performance of the partnership contract.

3.4. Reviews

Reviews can only be written by signed-in members. We collect the text, the scores given, the language and the IP address. A review becomes public only after an administrator has verified it, together with the name shown on your account.

3.5. Saved activities

If you save activities to favourites, we store the link between your account and those activities. The list is visible only to you.

3.6. Browsing data, analytics and recommendations

If you consent to the "statistics and recommendations" category, we collect:

which pages and activities you viewed and when;
aggregated traffic data through Google Analytics: pages visited, visit duration, the source you arrived from, device type, approximate country and city, IP address (truncated by Google).

We use this data to understand how the site is used and to recommend experiences similar to the ones you have viewed. If you have an account, the history may be linked to it. Legal basis: your consent. Without it, nothing in this section is collected.

3.7. Advertising

If you consent to the "marketing" category, adverts supplied by external partners may be displayed on the site. These partners may place their own cookies and collect:

IP address and device identifiers;
pages visited on our site;
interaction with the adverts shown (impressions, clicks).

This data is used to show you relevant adverts, including on other sites. Legal basis: your consent. Each acts as an independent controller for data collected through its own technologies.

3.8. Technical logs

We keep logs of sign-in operations and important account actions (sign-ins, password changes, profile updates), including the IP address. Legal basis: our legitimate interest in protecting accounts against unauthorised access.

3.9. What we do not collect

card details or other payment information — we do not process payments;
special categories of data (health, political or religious beliefs, biometric data).

4. Cookies

We use strictly necessary cookies for the site to work, plus optional categories that you enable yourself from the cookie banner: preferences, statistics and recommendations, marketing.

Analytics and advertising cookies load only after your consent. The full list and the lifetime of each cookie are in our Cookie Policy.

5. Who we share data with

Organizers — the data from requests sent to them and the messages in the conversation. The organizer becomes an independent controller for this data.
Our hosting provider — which stores the platform's database and files.
Our email service — for confirmation and notification messages.
Google Ireland Limited — for Google Analytics, if you accepted the "statistics and recommendations" category.
Advertising partners — if you accepted the "marketing" category.

We do not sell your data.

5.1. External services loaded in the page

Some visual components are loaded from external servers. When you access the site, these services may receive your IP address:

Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — the typefaces;
Cloudflare cdnjs — the icon library;
unpkg — the maps library;
OpenStreetMap / Nominatim — the maps shown on activity pages and address lookup.

6. Transfers outside the European Economic Area

Google Analytics and advertising partners may transfer data to servers outside the EEA, including in the United States. These transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the EU-US Data Privacy Framework.

If you would rather avoid these transfers, you can refuse the "statistics and recommendations" and "marketing" categories in the cookie banner. The site remains fully functional.

7. How long we keep data

Member account, requests and conversations, technical logs, browsing history for recommendations — for as long as the account exists. When the account is deleted, the data is removed within 30 days.
Published reviews — for as long as the activity is published on the platform.
Google Analytics data — as configured By Google.
Cookie consent — 12 months, after which you are asked again.

8. Your rights

Under Regulation (EU) 2016/679 (GDPR) you have the right:

to access the data we hold about you;
to rectify inaccurate data;
to erasure (the "right to be forgotten");
to restrict processing;
to data portability;
to object to processing based on legitimate interest;
not to be subject to a decision based solely on automated processing;
to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

You can withdraw your cookie consent at any time from the cookie settings button shown permanently in the corner of the page.

To exercise these rights, write to us at office@bontrip.ro. We reply within 30 days at most.

If you are not satisfied with our answer, you may contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro, or the supervisory authority in your country of residence.

9. Automated recommendations

The activities suggested in the recommendation sections are selected automatically, based on similarity to the activity you are viewing and, if you have consented, on your browsing history.

These suggestions have no legal effect on you and do not restrict your access to content — you can always see every activity through search and the category pages.

10. Security

Passwords are stored encrypted using modern hashing functions. Access to the administration panels is protected by authentication, and important operations are logged. Data is transmitted over a secure connection (HTTPS).

11. Minors

The platform is not aimed at people under 16 and we do not create accounts for minors. Some activities may have age limits set by the organizer, shown on each experience page.

12. Changes

We may update this policy. The version in force is always the one published on this page, with the last update date shown at the top. If we change the purposes for which we use your data, we will ask for your consent again.