CityBox – Privacy Policy

Operated by MEGA ENTERTAINMENT SRL

Effective date: 01 June 2025

1) Who we are (Data Controller)

MEGA ENTERTAINMENT SRL (“CityBox”, “we”, “us”) is the controller of your personal data.

Address: Str. Smârdan 16, Ap. 1, Sector 3, Bucharest, Romania

Email (privacy requests): data.protection@citybox.ro

2) What data we collect

We collect only what we need to operate the locker service, keep it secure, and meet legal duties.

  • Booking & usage data: locker ID/size, booking code/access credentials, start/end time, extensions, price, payment status, and activity logs (e.g., open/close events, timestamps).
  • Contact data: email address and any details you provide when contacting support (e.g., name, phone).
  • Payment data: payments are processed by our payment provider. We receive transaction confirmation and last four digits/transaction ID; we do not store full card details.
  • Device & technical data (online): IP address, browser/device info, and cookies/analytics (only with your consent—see Cookie Policy).
  • CCTV at the locker facility: video recordings covering entrances/locker corridors for safety and fraud prevention.

Access codes are generated for your session and stored securely with limited access; they become invalid after your rental ends or is canceled.

3) Why we process your data (legal bases)

  • To perform a contract (Art. 6(1)(b) GDPR): create and manage your booking, provide access to lockers, handle payments and extensions, communicate with you.
  • To comply with legal obligations (Art. 6(1)(c)): accounting/tax records, responding to lawful requests from authorities.
  • Our legitimate interests (Art. 6(1)(f)): ensure security and prevent misuse or fraud (including CCTV and system logs), improve and protect our services, defend our rights and respond to claims.
  • Your consent (Art. 6(1)(a)): marketing emails (if you opt in) and non-essential/analytics cookies. You can withdraw consent at any time.

4) How long we keep data

  • Booking & transaction records: kept for the period required by Romanian accounting law (typically up to 10 years).
  • Locker activity logs & access credentials: up to 12 months after the rental, unless needed longer for an incident or legal claim.
  • Customer support correspondence: up to 24 months after resolution.
  • CCTV recordings: normally 30 days, longer only if an incident is under investigation.
  • Marketing data (with consent): until you unsubscribe or withdraw consent.

5) Who receives your data

We share data only with:

  • Processors that help us deliver the service: hosting and IT providers, payment service provider, email/SMS provider, CCTV/security maintenance vendor, customer support tools.
  • Authorities or third parties when required by law or to establish/exercise/defend legal claims (e.g., police requests).
    All processors are bound by contracts under Art. 28 GDPR.

6) International transfers

If any supplier is located outside the EU/EEA, we protect transfers using EU Standard Contractual Clauses and additional safeguards where needed. Details are available on request.

7) Your rights

Subject to conditions under GDPR, you have the right to:

  • access your data;
  • rectify inaccurate data;
  • erase data (“right to be forgotten”);
  • restrict processing;
  • data portability;
  • object to processing based on legitimate interests;
  • withdraw consent at any time (for activities based on consent).

To exercise your rights, email data.protection@citybox.ro or write to the address above.

You also have the right to lodge a complaint with the Romanian Data Protection Authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP),

B-dul G-ral Gheorghe Magheru 28–30, 010336, Sector 1, Bucharest, www.dataprotection.ro.

8) Cookies

We use necessary cookies to run the site. Analytics/marketing cookies run only with your consent. For full details and to change preferences, see our Cookie Policy and Cookie Preferences links in the footer.

9) Security

We apply technical and organizational measures appropriate to the risk (encryption in transit, access controls, logging, regular updates, and staff confidentiality). No internet service can be 100% secure, but we work to protect your data and promptly address incidents.

10) Minors

CityBox is intended for users 18+. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us to remove it.

11) Automated decision-making

We do not use personal data for automated decisions that produce legal or similarly significant effects.

12) Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website and will show the “Effective date” at the top.