Privacy policy

1. Who the data controller is

The controller of the personal data is:

Asociația Rotaract Club Oradea

• Registered office: Oradea, str. Ceyrat nr. 4, office 1.1, floor 1, Bihor County, Romania
• Tax identification number (CIF): 29984036
• Registration number in the Special Register of Associations and Foundations: 1/13.12.2019
• E-mail: oradea@rotaract.ro

For any question about how your personal data is processed, or to exercise the rights provided by the GDPR, you can contact us at the e-mail address above.

2. What data we may collect

Depending on how you interact with the website, we may process the following categories of data:

• first name and surname;
• e-mail address;
• telephone number;
• the information submitted through the website forms;
• CV and letter of intent, in the case of an application to join the club;
• data concerning donations and transactions;
• technical data about the device and the use of the website;
• IP address and technical information about the browser;
• cookie preferences;
• photographs and audiovisual material produced during our projects and events, under the conditions described below.

We do not request through the website the transmission of special categories of personal data, such as data concerning health, religious or political beliefs, racial or ethnic origin, except where this is necessary and permitted by law.

3. The contact, partnership and cause proposal forms

When you fill in the contact form or the form intended for prospective partners, we may collect your name, e-mail address, telephone number and the information entered in the message.

We use this data solely to review the request and to reply to you.

The legal basis for processing is, as the case may be, our legitimate interest in communicating with people interested in the activity of the Association, under Article 6(1)(f) GDPR, or taking steps at the request of the data subject prior to entering into a contract, under Article 6(1)(b) GDPR.

Correspondence is kept only for as long as it is necessary in order to resolve the request and, where it leads to a collaboration or produces legal effects, for the period necessary to fulfil legal obligations or to defend possible rights.

As a rule, requests that do not lead to a collaboration will be deleted or anonymised within a maximum of 24 months from the last communication, except where there is a legitimate reason or a legal obligation to keep them for a longer period.

Protection against automated messages

The website forms may use Cloudflare Turnstile for protection against spam and automated access.

For this purpose, Cloudflare may process certain technical information necessary for the verification, such as the IP address and information about the browser or the device used.

These checks are used for the security of the website and the prevention of abuse, on the basis of the Association’s legitimate interest in protecting its infrastructure and its online forms.

Cause proposals

When you send us a proposal through the „Propune o cauză” (Propose a cause) form, we use the information you provide in order to understand and review the situation you have flagged and, if needed, to contact you for further details.

Proposals may be reviewed by the members of Rotaract Oradea, solely for the purpose of assessing the ways in which we could get involved. Your data will not be used for marketing purposes and will not be shared with other organisations without your consent.

Please avoid including sensitive data or personal information that is not necessary in the description, especially when the proposal concerns other people.

4. Applications to join Rotaract Club Oradea

When you submit an application to join the club, we may collect the data entered in the form as well as the documents uploaded, including the CV and the letter of intent.

The data is used solely to review the application and to carry out the selection and admission process.

The legal basis for processing is the taking of steps requested by the person who wishes to join the Association, under Article 6(1)(b) GDPR, as well as the Association’s legitimate interest in organising the recruitment and admission of members, under Article 6(1)(f) GDPR.

Access to applications is limited to the people involved in the selection process and to the club’s board, to the extent that such access is necessary.

Where an application is not accepted, the related data and documents will be deleted, as a rule, within a maximum of 6 months from the end of the selection process, except where the person consents to them being kept for a longer period or where another legal basis applies.

For people accepted into the club, the data necessary for administering membership may be kept for the duration of that membership and thereafter in accordance with the legal obligations applicable to the Association.

5. Donations and online payments

The website may allow donations to be made through Stripe.

Full bank card details are entered directly into the payment service provider’s infrastructure and are not stored by Asociația Rotaract Club Oradea.

Following a transaction we may receive and keep information such as:

• the donor’s name;
• the e-mail address;
• the telephone number, if provided;
• the billing information;
• the amount donated;
• the date of the transaction;
• the currency;
• the transaction identifier;
• the payment status.

This information is used for processing and recording donations, sending confirmations, managing any recurring donations and fulfilling the Association’s financial and accounting obligations.

The legal bases are the performance of the operation requested by the donor, under Article 6(1)(b) GDPR, and compliance with legal financial and accounting obligations, under Article 6(1)(c) GDPR.

Documents and information forming part of the financial and accounting records will be kept for the periods required by the applicable legislation.

For payment processing, Stripe may process data in accordance with its own legal obligations and data protection policies.

6. Photographs and audiovisual material

Photographs and video material may be produced during the projects, activities and events organised by Rotaract Club Oradea.

These may be used to document and promote the Association’s activities, including on the website and on the club’s official communication channels.

Where a person is the main subject and is clearly identifiable, we will consider the legal basis appropriate to the situation and, where necessary, we will ask for that person’s consent.

In the case of minors and vulnerable beneficiaries, identifiable images will be published with heightened care and, where necessary, on the basis of the consent of the legal representative.

If a photograph or video in which you are identifiable is published by us and you wish it to be removed, you can send us a request at oradea@rotaract.ro, indicating the material in question where possible.

We will review the request and remove the material where there is a legal obligation to do so, or where, after assessing the situation, there is no longer a basis for continued publication.

7. Traffic analysis and online advertising

The website may use services such as Google Analytics, Google Ads, Meta and TikTok to measure traffic, assess the performance of the website and measure the effectiveness of communication campaigns.

To the extent that these technologies involve storing or accessing information on the user’s device for analytics or marketing purposes, they are activated only after consent has been given through the cookie preference management platform.

The analytics and marketing categories can be managed separately.

You may refuse optional cookies without this preventing you from using the essential functionality of the website.

You may also withdraw or change your consent at any time through the “Cookie settings” option available on the website.

For consent-based technologies, the legal basis for processing is Article 6(1)(a) GDPR.

Depending on the technical configuration used, analytics and advertising providers may receive certain technical signals or information about interaction with the website. Some modern measurement technologies may transmit limited or aggregated signals even where the user has not given consent, to the extent permitted by the configuration of the service and by applicable law.

If the user has given consent for marketing, certain relevant events, such as the completion of a donation, may be used to measure conversions. Where an e-mail address is used for this measurement, it may be transmitted to the provider in a cryptographic form (a “hash”).

8. International data transfers

Some of the technology providers used by the website are international companies and may process data outside the European Economic Area.

In such cases, transfers are carried out on the basis of the mechanisms provided by the GDPR, such as:

• adequacy decisions adopted by the European Commission;
• the EU-U.S. Data Privacy Framework, where the provider concerned is certified and the transfer is covered by that mechanism;
• Standard Contractual Clauses approved by the European Commission;
• other legal mechanisms applicable under the GDPR.

9. Cookies and similar technologies

The website uses cookies and similar technologies.

Some of these are strictly necessary for the website to function and do not require consent.

These may include, for example:

• remembering the selected language;
• remembering cookie preferences;
• elements necessary for the security and operation of the website.

The consent preference is kept for a period of 6 months, after which we may ask you to express your choices again.

Optional cookies and technologies for analytics and marketing are activated only in accordance with the preferences expressed by the user.

An up-to-date list of the cookies, their purpose, the provider and their lifetime is available in the “Cookie settings” section of the website.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

10. Services provided by third parties

For the operation of the website we may use external providers for services such as:

• hosting and website infrastructure;
• security and protection against spam;
• payment processing;
• sending messages and e-mails;
• traffic analysis;
• advertising and conversion measurement;
• displaying maps and other external elements.

These providers may be given access to certain data strictly to the extent necessary for the provision of those services and in accordance with the legal role they have under data protection legislation.

In the case of content provided by external services, such as embedded maps, certain technical information, including the IP address, may be transmitted to the provider when that content is loaded.

11. How long we keep data

We do not keep personal data for longer than is necessary for the purposes for which it was collected.

The specific period depends on the nature of the information and on the purpose of the processing.

In setting retention periods we take into account:

• the time needed to resolve a request;
• the duration of the relationship with the person concerned;
• the Association’s legal obligations;
• the applicable limitation periods;
• the need to defend rights or legitimate interests;
• the person’s consent, where the processing is based on it.

At the end of the applicable period, data is deleted, anonymised, or archived where its retention is required by law.

12. Data security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

Access to data is limited to the people who need it in order to carry out their duties within the Association.

Nevertheless, no method of electronic transmission or storage can guarantee absolute security of information.

13. Your rights

Under the conditions provided by the GDPR, you have the following rights:

• the right of access to your data;
• the right to rectification of inaccurate data;
• the right to erasure (the “right to be forgotten”);
• the right to restriction of processing;
• the right to data portability, where applicable;
• the right to object to certain processing;
• the right to withdraw consent at any time, where processing is based on consent;
• the right not to be subject to a decision based solely on automated processing, under the conditions provided by the GDPR;
• the right to lodge a complaint with the competent data protection authority.

To exercise these rights you can contact us at oradea@rotaract.ro.

We will respond to the request without undue delay and, in principle, within one month of receiving it, in accordance with the GDPR. In complex cases, or where there is a large number of requests, that period may be extended under the conditions provided by law.

In order to protect the data, we may ask for additional information where it is necessary to verify the identity of the person making the request.

14. The right to lodge a complaint

If you consider that your personal data is processed in breach of applicable legislation, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

• B-dul General Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, Romania
• E-mail: anspdcp@dataprotection.ro

You also have the right to bring proceedings before the competent courts.

15. Changes to this privacy policy

We may update this privacy policy from time to time to reflect legislative changes, changes in the services used, or in the way the website works.

The updated version will be published on this page, together with the date of the last update.

In the case of significant changes to the way we process personal data, we will take reasonable steps to inform the people concerned.

16. Contact

For questions, requests or to exercise your rights regarding the protection of personal data:

Asociația Rotaract Club Oradea

• Str. Ceyrat nr. 4, office 1.1, floor 1, Oradea, Bihor County, Romania
• Tax identification number (CIF): 29984036
• E-mail: oradea@rotaract.ro