Last update: May 08, 2025

1. Applicability

This GDPR Policy sets out the practices that CODA Farmecul Tacerii Foundation uses to collect, process, store and protect all your personal information and data provided as a result of your interaction with our website: www.farmecultacerii.ro (the “Site”) or communicated to us in any other way (by telephone, written/video message, email, etc).

The legal basis underlying this GDPR Policy is Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, in force as of May 25, 2018, and the provisions of the subsequent national legislation in force.

Ensuring the confidentiality of the personal data that we collect and process in the course of our work is a major concern of our Foundation, which makes every reasonable effort to comply with its legal obligations.

By providing any personal data in the ways set out below, you understand and agree that your personal data will be processed in accordance with the provisions of our GDPR policy

2. What data we collect

We collect and process information and personal data provided by you when you interact with us by:

• filling in the contact forms available on our Website, in the Contact section;
• telephone correspondence;
• written correspondence (by e-mail or by letter sent by post/courier to our office);
• any other means (e.g. face-to-face or virtual meetings/video recordings etc).

The information and data collected and processed may be:

• contact data such as your name and surname, e-mail address, telephone number, data necessary for the conclusion of a contractual relationship or other information you send us
• Your IP which is processed when you access the Site;
• details of your visits to our website (in this regard we recommend that you read the Cookie Policy available on the Website).

3. Purpose of data collection

We may collect and process personal data for the following purposes:

• in order to support you and provide you with the information/answers you request;
• for compliance with our legal obligations (such as obligations to keep accounting records and supporting documents);
• for forwarding them to third parties, if necessary for the conclusion of a contractual relationship and its implementation (e.g. courier service providers, etc.);
• for a legitimate purpose/if the obligation subsists on the basis of legal provisions in force
• for the security and improvement of our Website;

4. Data protection principles

In order to comply with the principles of personal data protection provided by the GDPR Regulation, we ensure that all personal data provided by you are:

• processed lawfully, fairly and transparently, i.e. that there is a legitimate basis for processing personal data (e.g. prior consent obtained from you, processing is necessary for compliance with a legal obligation, etc).
• processed only for the explicit and legitimate purpose for which the data was collected (e.g. providing an answer to the question you raised);
• adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed (we will only process personal data that are adequate, relevant and strictly necessary to achieve the purposes for which the processing takes place);
• accurate and, where necessary, kept up to date (we will use our best endeavors to ensure the accuracy of the data, delete or correct any inaccurate or incomplete data without delay, having regard to the purposes for which it was collected or for which it will be further processed);
• kept only as long as necessary for the purposes for which they have been collected or for which they are further processed; once the data are no longer necessary for these purposes, they are to be destroyed or anonymized and kept exclusively for statistical purposes;
• processed under secure conditions (we will do our utmost to ensure the integrity and confidentiality of the data, to ensure an adequate level of protection against unlawful or unauthorized processing operations and against accidental loss or destruction/ accidental damage);

5. To whom we disclose your personal data

CODA Farmecul Tacerii Foundation has implemented technical and organizational measures to maintain the confidentiality and security of your personal data, in accordance with internal procedures regarding the storage, disclosure and access to personal data. Personal data may be stored on our technological systems, those of our contractors or in hard copy.

Access to the personal data that we process will be allowed only to a limited number of our staff members respectively employees with specific tasks, on a need to know basis. All our staff is subject to confidentiality obligations regarding the personal data they come into contact with, which are managed and processed only within the limits and in accordance with the service instructions received.

We also inform you that access to your personal data may be permitted:

a). other partner entities for which you expressly grant us permission to do so;

b). when we are required by applicable law, requests from judicial or official bodies to do so;

c). governmental authorities and/or law enforcement agencies, if required by applicable laws or if necessary to exercise our rights, including the Terms of Use, or to protect our legitimate interests (including the legitimate interests of third parties) under applicable laws.

1. d) partner legal entities involved in the implementation of our projects and for which we can justify a legitimate reason;

e). persons or entities with whom we collaborate in the course of our business: e.g. service providers such as IT service providers, mail/ courier service providers, other service providers such as lawyers, accountants, auditors, etc.). We will require these entities and their staff to in turn respect the confidentiality and security of the data processing carried out.

We do NOT sell your personal data to third parties.

Where we process your personal data on the basis of your consent, such personal data will only be processed for the period set out in your consent, unless you withdraw or limit your consent before the expiry of this period. In such cases, we will cease processing the personal data concerned for the relevant purposes, subject to any legal obligation to process such personal data and/or our need to process such personal data for the purpose of exercising our legitimate rights (including the legitimate rights of others).

6. Your rights

We inform you that, according to GDPR regulations, if we process your personal data, you have the following rights:

• the right of access – you may, free of charge, ask us to confirm whether or not we are processing personal data concerning you. You can also ask us for a copy of the data we process that belongs to you.
• right to information – you can request information on the processing of your personal data;
• the right to rectification – when you notice that your data is incomplete or inaccurate, you can ask for it to be corrected;
• the right to restriction of processing – you can exercise this right when you contest the accuracy of the data or when you consider that the processing is unlawful or you object to the erasure of data.
• the right to portability – you can receive, under certain conditions, the personal data you have provided to us in a machine-readable format or you can request that the data be transferred to another operator.
• the right to object to data processing for marketing purposes. You can exercise this right at any time and we will ensure that your data will no longer be processed for this purpose.
• the right to erasure (“right to be forgotten“) – you have the right to have your personal data deleted without undue delay. This right is not an absolute right and only applies in certain situations expressly provided for by law (Art 17 GDPR). When making a deletion request, please bear in mind that deletion can be a complex process. Withdrawal of consent will only have effect for the future, processing carried out prior to the withdrawal will remain valid;
• the right to apply to the National Personal Data Supervisory Authority, a public authority in Romania, located at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania, website www.dataprotection.ro, which aims to protect the fundamental rights and freedoms of natural persons, in particular their right to privacy, family and private life, in relation to the processing of personal data and the free movement of such data (“ANSPDCP”), in case you report a breach of the GDPR Regulation.

In order to exercise these rights, please send us a written request to contact@fundatiacoda.ro. with the subject ˝Request personal information˝.

7. Complaints on breach of confidentiality

To the extent that you have any concerns about the privacy of your personal data that we process or would like to make a privacy-related complaint, please write to us at contact@fundatiacoda.ro. Once we receive your email, we will endeavor to provide you with our response as soon as possible.

8. GDPR policy update

CODA Farmecul Tacerii Foundation reserves the right to periodically update and amend this GDPR Policy to reflect any changes in the way we process your personal data or to respond to changes in applicable law.

In the event of any such change, we will post the amended version of this GDPR Policy on the Site.