Privacy Policy
regarding the processing of personal data
1. General information. Who are we and what does this document cover?
The content of the website https://asociatiasocialincubator.org/ (hereinafter the Site) is the exclusive property of Asociația The Social Incubator (hereinafter “ATSI” and the “Association”), with its registered office in Bucharest, District 2, 7 Spătarului St., recorded in the Special Register under no. 10/17.03.2020, registered in the Register of Associations and Foundations under no. 16760/A/2014 and in the ANAF Register of religious entities/units since 15.04.2019, fiscal registration code 33177409, e-mail: office@asociatiasocialincubator.org, phone: +40 790 599 908.
As data controller, ATSI permanently monitors and ensures that the processing of personal data strictly complies with the principles and legislation on personal data protection, in particular the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”/“Data Protection Regulation”). ATSI attaches particular importance to compliance with the applicable legislation and will ensure that the processing of your data is carried out in compliance with the applicable legislation mentioned above, according to the details presented in this document.
This version of the Privacy Policy was revised on 01.05.2025 and is intended to inform you about:
- the personal data processing activities concerning you, as a visitor of the Site or as a user of the features within the Site;
- the personal data processing carried out by ATSI in order to conduct its activities.
ATSI may subsequently update this Privacy Policy, in which case it will inform the data subjects through the Site of any changes before they become applicable.
Depending on your interaction with the Association, we will process your personal data according to the details set out below in this document.
2. Definitions
- “Personal Data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
- “Donor” means the natural or legal person who donates sums of money and/or services to ATSI and/or to the persons supported by ATSI, through the instruments made available by the latter.
- “Processing” (and its derivatives, including without limitation “to process”) means any operation or set of operations performed on Personal Data, including without limitation the collection, recording, storage, alteration, use, disclosure, access, transfer or destruction thereof.
- “Visitor” means any person who accesses or uses the Site.
- “Volunteer” means any natural person participating in the volunteering activities organised by ATSI.
3. Types of processing. What data are processed, what are the purposes and legal bases on which we process the data, and the retention period?
What personal data are processed?
ATSI will process, as controller of personal data, the following personal data:
- Surname
- First name
- Age
- Address
- Phone number
- Facebook profile
- Instagram profile
- LinkedIn profile
| Purpose of processing | Legal basis | Retention period |
|---|---|---|
| Participation in social, educational or professional integration projects and programmes | Performance of a contract or pre-contractual steps (art. 6 para. 1 let. b GDPR) | For the duration of the project and 5 years after its completion, in accordance with accounting legislation |
| Administrative or organisational communications, or communications related to events | Legitimate interest (art. 6 para. 1 let. f GDPR) or consent (as applicable) | For the duration of the collaboration or until an objection is expressed |
| Promoting the Association’s activity through images or video materials | Consent (art. 6 para. 1 let. a GDPR) | Until consent is withdrawn |
| Marketing communications (e.g.: newsletter, event invitations, campaigns) | Consent (art. 6 para. 1 let. a GDPR) | Until consent is withdrawn |
| Selecting and managing volunteers | Performance of a contract / legitimate interest | For the duration of the collaboration and up to 3 years after its termination |
| Fulfilling legal obligations (e.g.: financial reporting, archiving, audit) | Legal obligation (art. 6 para. 1 let. c GDPR) | In accordance with the applicable legislation (e.g.: 10 years for accounting documents) |
| Resolving requests or disputes | Legitimate interest / Legal obligation | For the period necessary to resolve the request and in accordance with limitation periods |
| If you are | Your data will be processed in order to | On the basis of | Retention period |
|---|---|---|---|
| A Visitor of our website | Respond to your requests sent through the contact forms. Receive the comments and messages you send by other means, and analyse and resolve them. | Your consent expressed by filling in and submitting the contact form or by contacting the Association in another way | The data will be kept for the period necessary to analyse and resolve the requests thus received from you, and subsequently in accordance with ATSI’s internal policies. You can request more information by sending a request using the contact details in section 1 above. |
| For more details on the use of cookie files, please see our Cookie Policy | Analyse how our website is used (1st party cookies) or evaluate feedback sent to ATSI in another way. Analyse how you interact with certain third-party features/tools (3rd party cookies). | Our legitimate interest. Your consent expressed in the banner displayed when first accessing the site/your browser settings. | The data will be used for the period necessary to evaluate your feedback and will subsequently be deleted. Please see our Cookie Policy. |
| A Volunteer | Conclude and perform the volunteering contract to which you are a party. Providing certain data is either a requirement necessary for concluding and performing the contract, or a legal obligation in certain cases, and failure to provide it may make it impossible to initiate or continue the relationship with you. | The volunteering contract (concluded separately from this document) | For the period necessary for the performance of the contract, and subsequently in accordance with legal provisions. |
| A collaborating partner, natural person or authorised natural person (PFA) (including sponsors) | Negotiate, conclude and perform the contractual relationship between ATSI and you and resolve any requests related to these relationships. Fulfil the legal obligations incumbent on ATSI (e.g., in the financial field, archiving – in the context of invoices, sponsorships). Providing certain data is either a requirement necessary for concluding and performing the contract, or a legal obligation in certain cases, and failure to provide it may make it impossible to initiate or continue the relationship with you. | The contract concluded with you. The legal obligations incumbent on ATSI | For the duration of the collaboration relationship with ATSI, and subsequently in accordance with legal provisions. |
| A representative / employee / collaborator / contact person of our legal-entity partners (including sponsors or in the context of partnerships with social assistance directorates or other institutions) | Negotiate, conclude and perform the contractual relationship between ATSI and our legal-entity partner and resolve any requests related to these relationships. Fulfil the legal obligations incumbent on ATSI (e.g., in the financial field, archiving – in the context of invoices, sponsorships, social assistance activities). Providing certain data is either a requirement necessary for concluding and performing the contract, or a legal obligation in certain cases, and failure to provide it may make it impossible to initiate or continue ATSI’s relationship with that partner. | ATSI’s legitimate interest in carrying out its activities and relationships with its partners. The legal obligations incumbent on ATSI | For the duration of the collaboration relationship with ATSI, and subsequently in accordance with legal provisions. |
| A participant in the events / projects / actions carried out by ATSI | Ensure your participation in various events / projects / actions carried out by ATSI within our activity, as well as fulfil legal obligations, as applicable. Take photographs or video materials during the events / projects / actions. You have the possibility to withdraw this consent or to object to this processing by informing the ATSI staff present at the time of the events / projects / actions or by sending a request to ATSI using the contact details in section 1 above. These actions will have no consequences for you. | The contract or, as applicable, your consent expressed through voluntary participation in events / projects / actions. The legal obligations incumbent on ATSI (e.g., in the context of social assistance, financial matters, archiving). Our legitimate interest in creating overview materials, documenting how ATSI’s events / projects / actions took place and promoting the events / projects / actions of the Association. Your consent expressed through your unequivocal action of being photographed / filmed. | For the period necessary to carry out the event / project / actions in which you participated, and subsequently for no more than 3 years, except where there is a legal obligation or a legitimate interest justifying a longer period (such as the existence of judicial proceedings). For a period of at least 5 years, except where separate image-use agreements have been concluded establishing a different retention period. |
| An applicant for a job or position within ATSI | Analyse your application and, as applicable, contact you, set up and conduct interviews, and make a decision in this respect. Providing certain data is a requirement necessary for analysing your application, and failure to provide it may make it impossible to analyse your application. Keep your application for other positions or subsequent recruitment campaigns carried out by ATSI. | The contract (steps towards concluding a contract). Personal data are provided voluntarily, with a view to concluding a contract with you (e.g., an individual employment contract, a collaboration contract). If, following your application, you start a collaboration with ATSI, your data will continue to be processed in accordance with the Association’s internal policies. Your consent — you have the possibility to withdraw this consent by sending a request to ATSI using the contact details in section 1 above. | The personal data of rejected candidates will be deleted after a period of 3 years, except where certain judicial proceedings require the data to be kept for a longer period. If you have given your consent in this respect, the data may be used until you withdraw your consent, but without exceeding a period of 5 years. |
| A newsletter subscriber | Receive from ATSI (usually by e-mail) messages regarding the events / projects / actions carried out by the Association within its activity. Providing these data is voluntary. | Your consent expressed expressly, in writing, electronically or orally. ATSI’s legitimate interest in communicating to you information regarding the social activities in which you have taken part in the past (e.g., regarding their impact or results) or similar ones. You have the possibility to withdraw your consent or to object to this processing by accessing the unsubscribe link at the end of the e-mails or by sending a request to ATSI using the contact details in section 1 above. | For the period during which we have your consent, respectively until the right to object is exercised. Withdrawing consent or objecting to this processing produces effects for the future and does not automatically amount to the deletion of the data (for which a separate request is necessary), but it will result in such messages no longer being sent to you. |
| A natural person submitting requests to exercise rights in connection with the processing of personal data (detailed in the final section of the document) | Resolve the requests in accordance with the legislation applicable to the processing of personal data. Providing certain data is either a requirement necessary for resolving your request, or a legal obligation, and failure to provide it may make it impossible to resolve your request in accordance with the law. | The legal obligation incumbent on ATSI as data controller | 4 years from the date of receipt of such requests from you, except where certain judicial proceedings require the data to be kept for a longer period. |
4. To whom may personal data be disclosed?
The personal data processed by ATSI for the purposes detailed above may be disclosed to the following categories of recipients:
- ATSI’s partners and collaborators, both those acting as processors of the Association and those acting as controllers, from fields such as: PR agencies, marketing agencies, sponsors, photography and videography companies, mobile phone operators, courier companies;
- the public, in the case of images taken during the events/projects/actions carried out by ATSI, for the purposes described above (including on the site or through social networks – such as Facebook, Instagram, LinkedIn);
- external consultants supporting ATSI in carrying out its activity in compliance with legal provisions (such as PR agencies, lawyers, legal advisers, notaries);
- public authorities and institutions at their request or where there is another basis, such as a legal obligation or the legitimate interest of the Association.
5. Data transfers
ATSI will not transfer your personal data to states outside the European Economic Area. To the extent that such transfers are carried out, the Association will ensure that it implements the appropriate transfer safeguards and will duly inform you of the transfer states and of the fact that you may at any time request information or copies of the adopted transfer safeguards.
6. What rights do you have regarding the processing of personal data?
Under the conditions of the legislation applicable in the field of data protection, in particular under the GDPR, you benefit from the following rights:
- the right to information – the right to receive a minimum content of information regarding the processing activities carried out by ATSI, in accordance with legal requirements;
- the right of access – the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed and, where that is the case, information on the details of the processing (e.g., purpose, categories of data, recipients/categories of recipients and, where possible, the envisaged storage period or the criteria used to determine that period);
- the right to rectification – the right to obtain from the controller the rectification of inaccurate personal data concerning you or the completion of incomplete data, including by means of providing a supplementary statement;
- the right to erasure (“the right to be forgotten”) – the right to obtain from the controller the erasure of personal data in the cases established by law – such as, where the data are no longer necessary for the purposes for which they were collected/processed; you withdraw the consent on the basis of which the processing took place and there is no other legal ground for the processing; the data have been unlawfully processed; the data must be erased for compliance with a legal obligation incumbent on the controller – and subject to the other conditions;
- the right to restriction of processing – the right to obtain from the controller the restriction of processing where one of the following applies: (i) the accuracy of the data is contested by the data subject; (ii) the processing is unlawful and the data subject opposes the erasure of the data; (iii) the controller no longer needs the data, but the data subject requires them for the establishment, exercise or defence of a legal claim; (iv) for the period of time in which it is verified whether the legitimate rights of the controller prevail over those of the data subject, in the event of the latter’s objection;
- the right to data portability – the right to receive the data concerning them, which they provided to the controller, in a structured, commonly used and machine-readable format, and to request the transmission of those data to another controller where the processing is based on consent or on a contract and the processing is carried out by automated means;
- the right to object – the right to object at any time, on grounds relating to their particular situation, to processing based on legitimate interest. Where data are processed for direct marketing purposes, the data subject has the right to object at any time;
- the right to withdraw consent where the processing is based on it, with the withdrawal producing effects for the future without affecting the lawfulness of the processing carried out prior to the withdrawal;
- the right not to be subject to an automated individual decision – the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly affects them, except where such decisions/profiles are permitted under the applicable legislation. Where such decisions or profiles may be made/created in compliance with the law, you have the right to obtain information on the logic used, the consequences for you and their significance, as well as the right to contest the decision or to obtain human intervention in another way;
- the right to lodge a complaint with the supervisory authority (the National Supervisory Authority for Personal Data Processing – ANSPDCP) or before the competent courts of law.
Please note that, in the event of the withdrawal of consent in accordance with the applicable legal provisions, where such consent was previously given for direct marketing activities, ATSI, after taking note of this fact, will no longer send you direct marketing communications. Although you will no longer receive direct marketing communications, ATSI may still lawfully process your Personal Data on other grounds and for other purposes, such as fulfilling certain legal obligations incumbent on it, performing the contract or ATSI’s legitimate interest (e.g., improving services, resolving complaints received, defending rights and interests).
Where the data subject submits a request in electronic form for the exercise of their rights, the information will be provided by our Association in electronic form where possible, unless the data subject requests another format.
We will try to respond promptly to any request from you and, in any case, within the time limits expressly set out in the applicable legal provisions (as a rule, 1 month from the registration of the request). Depending on the complexity of the request, the response period may be extended, in accordance with legal provisions, by a further 2 months.
To exercise the rights mentioned above or for more information on how ATSI processes personal data, you can contact us at the e-mail address: office@asociatiasocialincubator.org or at our registered office in Bucharest, District 2, 7 Spătarului St.