Privacy policy

1. Who we are

The controller of the personal data processed through the website https://ivacaterina.org is ASOCIAȚIA IVACATERINA’S WAYMAKERS (the “Association”, “we”), a Romanian private-law, non-profit legal entity established under Government Ordinance no. 26/2000 on associations and foundations, founded on 4 June 2024, with its registered office at Str. Dropiei nr. 2, sc. D, et. III, ap. 14, Timișoara, jud. Timiș, tax identification code 50179280, entered in the Register of Associations and Foundations under no. 1441/A/2024.

For questions about your personal data, write to privacy@ivacaterina.org.

This policy explains what data we collect, for what purposes and on what legal basis, who we share it with, how long we keep it and what your rights are, under Regulation (EU) 2016/679 (the “GDPR”) and Romanian Law no. 190/2018 on measures implementing the GDPR.

2. What data we process and why

2.1. Contact and get-involved forms

The website has forms for: general contact, volunteering, ambassadors, fundraising for the campaign, corporate partnerships, research collaboration and the diaspora community.

• Data collected: name and email address; optionally, phone number, organisation and country; your message and the answers specific to each form; the site language; the date and time of submission; the version of the information notice you accepted; optionally, the campaign (UTM) parameters in the link that brought you to the site.
• Purpose: to reply to you and manage your request. Each submission triggers an internal email notification to the Association.
• Legal basis: steps taken at your request (Art. 6(1)(b) GDPR), our legitimate interest in answering correspondence, organising our work and understanding which awareness campaigns work (Art. 6(1)(f) GDPR) or, where applicable, your consent (Art. 6(1)(a) GDPR).

Sending a form does not subscribe you to the newsletter.

Medical information. Our forms expressly ask you not to send us information about your health or anyone else's. If you nevertheless send such information, we process it only as strictly necessary to reply to you, on the basis of your explicit consent (Art. 9(2)(a) GDPR), and delete it as soon as possible. We do not provide medical advice (see the Medical disclaimer).

2.2. Newsletter

• Data collected: email address, language, subscription status (pending, confirmed or unsubscribed), the dates of subscription, confirmation and unsubscription, the version of the consent text and the subscription source.
• How it works: we use double opt-in: your subscription stays “pending” until you click the confirmation link we email you. Every message contains an unsubscribe link.
• Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
• Providers: emails (for example, the confirmation email) are sent through Google Workspace. If the Association enables this option, the subscriber list may be synchronised with the email-marketing platform Brevo.

2.3. Donations

• Card payments (Stripe). Card payments are processed by Stripe (Stripe Payments Europe, Limited) through the Stripe Checkout page; your card details never reach the Association's servers. Stripe sends us the payment reference, amount, currency, date and the donor's name and email address, which we use to confirm the donation and for our accounting records. In the Association's financial ledger we keep only the payment reference, amount, currency, date and payment channel. For monthly recurring donations (where available), Stripe stores your payment method for future charges.
• Bank transfer. We process the data shown on bank statements (for example, the payer's name, account, amount, date and payment details) for accounting purposes.
• Bursa Binelui. Donations through Bursa Binelui (a platform operated by Banca Comercială Română) are processed under the platform's own terms and privacy policy; we receive aggregated data or donor data from it, within the limits of those terms.
• Other processors. We may add other authorised payment processors (for example, NETOPIA Payments or EuPlătesc); we will update this policy beforehand.
• Legal basis: carrying out the donation at your request (Art. 6(1)(b) GDPR), our legal financial and accounting obligations (Art. 6(1)(c) GDPR) and our legitimate interest in preventing fraud and thanking you (Art. 6(1)(f) GDPR).

We do not publish donors' names.

2.4. Redirecting 3.5% of income tax (Form 230)

If the Association collects Form 230 submissions (which is only meaningful once it is entered in the Register of entities/religious units eligible for tax deductions), it will process the data on the form, including the personal numeric code (CNP), solely to transmit it to ANAF (the Romanian tax authority), in line with its legal obligations and with the safeguards required by Law no. 190/2018. If you file the form directly with ANAF, the Association learns your identity and the redirected amount only if you tick the box on the form allowing this information to be shared.

2.5. Sponsors and partners

We process the contact details of sponsors' and partners' representatives (name, position, email, phone) to conclude and perform contracts, on the basis of our legitimate interest and our legal obligations.

2.6. Browsing and security

• Technical data: the hosting provider automatically processes data such as your IP address, browser and device type, the page requested, and the date and time, in logs kept for a limited period.
• Spam protection: our forms use a hidden anti-bot field, a minimum completion time and a limit on submissions from the same IP address; the IP address is used temporarily and is not saved with your message. If enabled, Cloudflare Turnstile processes technical data about your browser and device to tell humans from automated programs.
• Statistics: we use Google Analytics 4 only with your consent, with IP anonymisation and with Google Signals and ad personalisation disabled. Details are in the Cookie policy.
• Legal basis: our legitimate interest in keeping the website working and secure (Art. 6(1)(f) GDPR); for statistics, your consent (Art. 6(1)(a) GDPR).

2.7. Website administrators

For people within the Association who have access to the admin area, we process their email address, role, authentication data and a log of actions performed, on the basis of our legitimate interest in ensuring security and traceability.

3. Who we share data with

We do not sell or rent your data. We share it only with:

• processors that provide technical services to us under contract and only on our instructions: Amazon Web Services (hosting of the website, database and files, and administrator sign-in, in the EU Paris region), Google Workspace (email), Cloudflare Turnstile (spam protection for forms), Brevo (if enabled) and Google (Google Analytics, only with your consent);
• payment processors and financial institutions (Stripe, the Association's bank, Bursa Binelui/BCR), which act as independent controllers for certain operations (for example, fraud prevention or their own legal obligations), under their own policies;
• the Association's advisers (for example, accountant, auditor, lawyer), who are bound by confidentiality;
• public authorities (for example, ANAF), where the law requires it.

4. Transfers outside the European Economic Area

The website, database and files are hosted in the European Union (Amazon Web Services, Paris region). Some providers (for example, Google or Cloudflare) may process data outside the European Economic Area (EEA), including in the United States. In those cases the transfer relies on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the European Commission. You may ask for information about the applicable safeguards at privacy@ivacaterina.org.

5. How long we keep data

When the periods below expire, the data is deleted or anonymised.

6. How we protect data

We use encrypted connections (HTTPS), restricted and authenticated access for administrators, a log of administrative actions, data minimisation and providers that offer appropriate guarantees. No system is completely secure, however. If a personal data breach occurs, we will notify ANSPDCP and, where required, the people affected, under the conditions of the GDPR.

7. Automated decisions

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

8. Minors

Our forms and newsletter are not intended for children. If you are a minor, please write to us only with the agreement and involvement of your parent or guardian.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection, the right to withdraw your consent at any time and the right to lodge a complaint with the Romanian data protection authority (ANSPDCP). Details: Your GDPR rights.

10. Changes

We may update this policy; the date of the last update is shown on this page. Significant changes will be announced on the website and, where appropriate, by email.