Your rights over your personal data

1. In short

Regulation (EU) 2016/679 (the “GDPR”) gives you control over your personal data. You can ask us at any time to see what data we hold about you, to correct it, to delete it or to stop using it. Exercising your rights is generally free of charge. The data controller is ASOCIAȚIA IVACATERINA’S WAYMAKERS (IvaCaterina’s Waymakers Association).

2. Your rights

Right of access (Art. 15 GDPR)

You can find out whether we process data about you and, if so, receive a copy of it, together with information about the purposes, recipients, retention period and source of the data.

Right to rectification (Art. 16 GDPR)

You can ask us to correct inaccurate data or complete incomplete data.

Right to erasure – the “right to be forgotten” (Art. 17 GDPR)

You can ask us to delete your data, for example when it is no longer needed, when you withdraw your consent or when you object to the processing. We may be unable to delete data that the law requires us to keep (for example, accounting documents relating to donations).

Right to restriction of processing (Art. 18 GDPR)

You can ask us to temporarily “freeze” your data (we keep it but do not use it), for example while we check its accuracy or an objection you have raised.

Notification of recipients (Art. 19 GDPR)

When we rectify, erase or restrict data, we inform the recipients to whom it was disclosed, unless this proves impossible or involves disproportionate effort. On request, we will tell you who those recipients are.

Right to data portability (Art. 20 GDPR)

For data you have provided to us and that we process by automated means on the basis of your consent or a contract, you can receive the data in a structured, commonly used and machine-readable format, or ask us to transmit it directly to another controller where technically feasible.

Right to object (Art. 21 GDPR)

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. We will stop processing unless we have compelling legitimate grounds or the data is needed for the establishment, exercise or defence of legal claims. You can object at any time, without giving reasons, to processing for direct marketing.

Automated individual decisions (Art. 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. The Association does not take such decisions.

Right to withdraw consent (Art. 7(3) GDPR)

Where processing is based on consent (for example, the newsletter or analytics cookies), you can withdraw it at any time, as easily as you gave it: through the unsubscribe link in our emails, through the “Cookie settings” link in the website footer, or by writing to us. Withdrawal does not affect the lawfulness of processing carried out before it.

3. How to exercise your rights

• Write to privacy@ivacaterina.org or send a letter to the Association's registered office: Str. Dropiei nr. 2, sc. D, et. III, ap. 14, Timișoara, jud. Timiș.
• Tell us which right you wish to exercise and, if possible, which data or interaction your request concerns (for example, a form you sent, your newsletter subscription or a donation).
• Exercising your rights is free of charge. If a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act on it, explaining our reasons.

4. How quickly we reply

We reply without undue delay and at the latest within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months; in that case we will tell you about the extension and the reasons for it within the first month. If we do not act on your request, we will tell you why, and inform you of your right to lodge a complaint with ANSPDCP and to seek a judicial remedy.

5. Identity verification

To protect your data, we may ask you for additional information strictly necessary to confirm that the request comes from you (for example, to write to us from the email address you used with us). We will not ask for more data than necessary. Please do not send us a copy of your identity document unless we expressly ask for it.

6. Right to lodge a complaint with ANSPDCP

If you believe that the processing of your data breaks the law, you can contact the Romanian supervisory authority:

• Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) – the National Supervisory Authority for Personal Data Processing
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania
• Phone: +40.318.059.211 / +40.318.059.212
• Email: anspdcp@dataprotection.ro
• Website: www.dataprotection.ro (opens in a new tab)

Complaints may be submitted in writing, in Romanian or English: in person at the authority's registry, by post, by email or through the electronic form on the ANSPDCP website. You may also go to court. We would appreciate the chance to resolve the issue first, but you are not obliged to do so.