Privacy Policy for the protection of individuals regarding the processing of personal data


In order to access the SNTFC CFR Călători S.A. web page, you don’t need to provide us any personal data. To the extent that you want to purchase the services provided by the website, we may ask you some identification or personal information.

Data provided by customers is strictly confidential. SNTFC CFR Călători SA undertakes to its users / customers not to provide this data to unauthorized third parties and to use it strictly for the conduct of the business relationship between the customers and SNTFC CFR Călători SA.

According to the requirements of the Law no. 129/2018 for the protection of individuals regarding the processing of personal data and the free movement of such data, amended and completed, SNTFC CFR Călători SA undertakes to manage safely and only for the specified purposes, the personal data that you provide about yourself.

Personal data is processed by automated and manual means, in compliance with the legal requirements and under conditions that ensure the security, confidentiality and respect of the rights of the data subjects.

Legislative framework

  • Law no. 122 of 24.05. 2018 on the protection of individuals regarding the processing of personal data and the free movement of such data
  • Regulation (EU) no.679/2016 on the protection of individuals regarding the processing of personal data and on the free movement of such data (entered into force on 25 May 2016 and will be applicable as of 25 May 2018).

Terms within the meaning of the Law 129/2018:

Personal data – any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, particularly by reference to an identification number or to one or more factors specific to his or her physical, physiological, psychological, economic, cultural or social identity;

Processing of personal data – any operation or set of operations that is performed on personal data, by automatic or non-automatic means, such as the collection, recording, organization, storage, adaptation or alteration, extraction, consultation, use, disclosure to third parties by transmission, dissemination or in any way, joining, combining, blocking, deleting or destroying.

Data controller – any natural or legal person, whether of private or public law, including public authorities, their institutions and their territorial structures, which determines the purpose and means of processing the personal data; if the purpose and means of processing the personal data are determined by a law or under an enactment, the data controller is the natural or legal person, of public or private law, which is designated as a data controller by that law; or under that enactment.

The types of information collected vary depending on the purpose of their collection and the performance of specific activities:

  • e-commerce by registering as a user of the service „Buy CFR Online Ticket”, informing users / customers about the status of their account on www.cfrcălă, confirmation, evolution and status of online transactions and all correspondence related to them, respectively by e-mail (travel / ticket details) and SMS (ticket ID and amount),
  • issuing the electronic invoice for CFR tickets purchased online, from the user’s account who purchased the ticket, based on his / her responsibility to insert mandatory billing data,
  • market research, statistics, by monitoring and assessing the quality of the services provided, professional skills and the behavior of sales staff onboard and ticket offices, etc.
  • providing assistance services for people with disabilities
  • providing transport services – Charter charter offer
  • solving complaints under the Law 233/2002
  • sending some information under the Law 544/2001
  • sending advertisements by subscribing to the newsletter, etc.

By providing this information, you give your freely expressed and unequivocally consent that all your personal data is stored in our database, used and processed unlimitedly territorially and / or temporarily by SNTFC CFR Călători SA, its affiliates and their collaborators, to conduct and / or carry out activities such as, but not limited to, commercial activities, promotion of products and services, marketing, advertising, media, administrative, development, market research, statistics, tracking and monitoring sales and consumer behavior (this site uses cookies), strictly following the legal provisions on the protection of individuals regarding the processing of personal data and the free movement of such data.

The information you provide us will be used for the purpose for which you have provided it, to manage, support and assess our services and to prevent breaches of our security, the law and our contractual terms.

Your personal data collected by SNTFC CFR Călători will never be disclosed to a third-party company that intends to use it for direct marketing purposes, unless you have expressly given your consent to that effect.

SNTFC CFR Călători SA may provide your personal data to other companies with which it is affiliated, but only under a confidentiality commitment on their part, ensuring that such data are kept secure and that the provision of such personal information is made according to the applicable law, as follows: providers of courier services, marketing services, banking/electronic payment services (SNTFC CFR Călători SA does not store bank card data or bank accounts), IT service providers dealing with online ticket sales applications, the site operating platform and the mobile application, etc

Your personal information may also be provided to authorized public authorities and institutions (Prosecutor’s Office, Police, Courts, etc.), based on and within the limits of the legal provisions and as a result of some expressly formulated requests.

SNTFC CFR Călători SA does not promote unrequested transmission of electronic messages (SPAM).

SNTFC CFR Călători SA undertakes to apply, in relation to the personal data of its users / customers, appropriate technical and organizational measures for the protection of personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorized access, especially if the respective processing performs data transmissions within a network, as well as against any other form of illegal processing.

SNTFC CFR Călători SA attempts, by all means, to monitor and limit the access of its employees directly to the database, but it is not responsible for their bad intent or misuse of their database during the program, which is considered abusive and for which they are subject to criminal penalties and termination of the employment contract.

By reading these terms and conditions, you have acknowledged that you are guaranteed the rights provided by law, namely the right to information, the right of access to data, the right to intervene, the right to object, the right not to be the subject of an individual decision, the right to appeal to the courts in case of violation of its rights guaranteed by the Law 129/2018 on the Protection of Individuals regarding the Processing of Personal Data and the Free Movement of such Data.

By reading these terms and conditions, you have acknowledged that the rights provided by law are guaranteed, namely:

  • the right to information,
  • the right of access to data
  • the right to interfere with data,
  • the right of opposition,
  • the right of not being subject to an individual decision
  • the right to complain to ANSPDCP or to appeal to the courts.

Thus, you can exercise the following rights, upon request and free of charge:

  • to confirm to you that personal data is processed or not, the type of data, for what purpose, to whom it is revealed, which automatic processing mechanisms are used, etc .;
  • to interfere with the data transmitted, by rectification, updating, or requesting deletion of the data, except as required by law;
  • to oppose the processing of your data for grounded and legitimate reasons related to your particular situation, unless there are legal provisions to the contrary;
  • to oppose at any time, without any justification, that your data is processed for direct marketing purposes or disclosed to third parties for such purpose;
  • to request the withdrawal or annulment of any decision having legal effects in respect of it, adopted solely based on the processing of personal data by automated means, intended to assess certain aspects of its personality, such as professional competence, credibility, conduct or other such aspects;
  • to file a complaint to the supervisory authority ANSPDCP to claim non-compliance with the rights guaranteed by the law no. 129/2018;
  • to refer to the court if you have suffered damage as a result of processing your personal data;

If you have any questions about the use of your data, if you wish to exercise any of the above rights or if some of your data is incorrect/incomplete, you may submit a written, dated and signed request to SNTFC CFR Călători SA, at 38 Dinicu Golescu Bvd., 4th floor, 1st District, Bucharest, Romania, Code 010873 or by fax +4021319.03.39 or by e-mail at The request will specify whether the information is to be communicated to a specific address (even e-mail) or a mailing service to ensure only personal delivery.

SNTFC CFR Călători SA will communicate the adopted measures/information requested within 15 days from the receipt date of the request, according to the provisions of art. 3 (3) of the Law no.129/2018.

For further details and information, please contact the National Supervisory Authority for Personal Data Processing.

  • 28-30 G-ral. Gheorghe Magheru Bvd., 1st District, postal code 010336 Bucharest, Romania
  • Phone: +40.318.059.211, +40.318.059.212
  • Fax: +40.318.059.602
  • Web:

Moreover, we would like to mention that any attempt to access, use, modify another user’s personal data is strictly forbidden, being punished by law, contravention or penal sanctions, as the case may be.

SNTFC CFR Călători SA is not liable for damage or malfunctions of computer systems, managed by a third-party hosting company, that may endanger the security of the database containing personal data.

If we consider it is necessary to change the privacy policy, we will publish those changes on this webpage, to inform you on the types of information we collect and how we use it.

Data Protection Officer of SNTFC CFR Calatori S.A.
Email address:
Corresponding Address: SNTFC CFR Calatori S.A., 38 Dinicu Golescu Bd., Sector 1, postal code 010873, Ministry of Transport