PERSONAL DATA PROCESSING POLICY

in force from 04.08.2026

1. INTRODUCTION

The "Potential in Education" Association (hereinafter referred to as the "Association" or the "Operator") respects the confidentiality of personal data and seeks to provide correct and complete information to users of the website https://adoptamstudenti.ro/.

The Association processes personal data in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “General Data Protection Regulation” or “GDPR”) and with Law No. 190/2018 on the application of the General Data Protection Regulation, as well as with Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, to the extent that the site uses cookies and similar technologies.

2. IDENTITY OF THE OPERATOR

The “Potential in Education” Association, headquartered in Ilfov, Voluntari city, George Bacovia street no. 15-17, block C2, staircase 2, apartment 9, room 1, registered in the Register of Associations and Foundations under no. 28003/A/2019, of the Cornetu Court, CIF: 41636774, is the personal data controller.

3. PERSONAL DATA

What categories of personal data we process

  • Identification data: name and surname;
  • Contact details: telephone number, address, email address;
  • Involuntarily collected data: IP addresses, time of visit to the site, operating system, online identifiers (cookie or similar) generated through Google Analytics and Google reCAPTCHA as well as other technical parameters.
  • Financial and payment data: amount donated, type and frequency of donation (one-time/recurring), last four digits of the card and other payment data processed directly by the payment processor (Stripe); for tax invoicing, address and, where applicable, tax identification data;
  • Data regarding the story of the supported students: photo, video material, biography, socio-economic and academic situation, university admission offer, estimated cost of studies — voluntarily provided by the student during the application process and published with his/her consent according to the Student Participation Regulations;

What are the legitimate grounds for data processing

  • Contract (art. 6 (b) GDPR): We may process personal data in order to execute the donation contract concluded in accordance with the Terms and Conditions provided on the site;
  • Consent (art. 6 (a) GDPR): We may process personal data that you have provided to us voluntarily, by filling in the contact section.
  • Legitimate interest (art. 6 (f) GDPR): We may process personal data based on legitimate interest, when, according to our assessment, we consider the processing to be reasonable and proportionate to the purpose of the processing.
  • Legal obligation (art. 6 (c) GDPR): We may process personal data in order to fulfill our legal obligations as a non-governmental organization.

The Association manages pages on Facebook (facebook.com/adoptamstudenti) and LinkedIn (linkedin.com/company/adoptamstudenti-ro), as an associated operator together with Meta Platforms Ireland Limited, respectively LinkedIn Ireland Unlimited Company, according to Art. 26 of the General Data Protection Regulation and in accordance with the documents published by each platform for page administrators.

Through your interaction with these pages, for example by commenting, liking or following the page, the Association may have access to the data you make public in that context, such as your display name or the content of the comment, as well as to aggregate statistics about the visitors to the page, made available by the platform. The Association does not extract or process this data for purposes other than those intended by you when interacting with the page. The primary responsibility for data processing at the level of the Facebook and LinkedIn infrastructure lies with these platforms, according to their own privacy policies, available on their websites.

Data storage period

We keep your data only for as long as necessary for the purposes mentioned above, in relation to the following criteria. Donor data is kept for the duration of the relationship with the Association, and subsequently for the duration required by the applicable financial and accounting legislation. Supported students' data is kept for the duration of the funding program. Published materials about students, namely stories, photos and videos, are kept for the duration of the expressed publishing agreement, an agreement that can be reviewed upon request. Data collected through cookies and similar tools are kept according to the criteria indicated in Section 5. Unsolicited correspondence is kept according to the criteria indicated in Section 6. Upon the termination of these criteria, the data is deleted or anonymized, unless the law requires their retention for a longer period.

Data recipients and international transfers

In addition to Facebook and LinkedIn, we transmit personal data to the following categories of recipients, as processors or independent operators: (i) Stripe (online payment processor, based in the United States of America), for processing card donations; (ii) Google LLC (Google Analytics, for website traffic analysis and Google reCAPTCHA for anti-spam/anti-bot protection), based in the United States of America; (iii) Banca Transilvania, for banking operations related to donations; (iv) the website hosting provider. To the extent that these transfers take place to countries outside the European Economic Area, they are carried out on the basis of standard contractual clauses approved by the European Commission or another legal transfer mechanism provided for in art. 46 of the General Data Protection Regulation. The updated list of processors can be requested at contact@adoptamstudenti.ro.

Processing of data of minors

Some stories published on the website and blog may concern individuals who were under 18 at the time of the events described (e.g. high school students participating in mentoring programs). For consent-based processing of data of a person under 16 years of age (the threshold established by Law no. 190/2018), consent is given or authorized by the holder of parental authority. The publication of photographs, video materials or biographical/socio-economic details regarding minors is made only with the written consent of the parent or legal representative, distinct from the consent of the adult student, and this consent can be withdrawn at any time, by request to contact@adoptamstudenti.ro, in which case the materials will be withdrawn from the website and social networks within 30 days at most.

4. PURPOSES OF PROCESSING

The operator processes your personal data in order to record your contributions, as well as for the other purposes detailed below, depending on your status as a donor, student, volunteer or visitor to the site. Refusal to provide the necessary data determines the impossibility of contributing financially to the activities of the Association.

By filling in your data in the forms within the process of registering a financial contribution for a student or for our Association, you express your consent for your personal data to be included in the Association's database.

The data of students applying for funding is processed for the evaluation and selection of candidates, verification of the information provided, including by contacting professors or institutions indicated by the student, drafting and publishing the funding story for the purpose of attracting donors, as well as for periodic communication between the student and donors during the program, according to the Student Participation Regulations.

The data of people who register as volunteers are processed to assess their availability and suitability for the Association's activities, as well as for communication related to the organization of volunteering activities.

Data collected through cookies and similar technologies are processed for the operation of the site, traffic analysis and prevention of automated or fraudulent access, according to the purposes detailed in Section 5.

The Association also reserves the right to use anonymous data collected from the site for any purpose with the possibility of disclosing statistics or other reports that do not directly and individually affect the users of the site. Any statistics regarding our users' traffic, which we will provide to third parties or to partner sites (for example, universities, partner organizations or project ambassadors, for the purpose of reporting social impact), with the exception of authorities, is provided only as a set of data and does not include any personally identifiable information about any individual user.

For direct marketing purposes, the Association will process personal data only based on your consent.

5. COOKIES

The website https://adoptamstudenti.ro/ uses cookies and similar technologies. We use: (i) strictly necessary cookies, for the functioning of the site; (ii) analysis cookies (Google Analytics), to understand how the site is used; (iii) security cookies (Google reCAPTCHA), to prevent automated access (robots/spam); (iv) cookies associated with the payment processor (Stripe), when you make an online donation.

Strictly necessary cookies cannot be disabled, as they are essential for the functioning of the site. Analysis and security/payment cookies are placed only after obtaining your consent, expressed through the cookie banner displayed when you first access the site. You can withdraw your consent at any time or change your preferences in the cookie banner or in your browser settings, without this affecting the lawfulness of the processing carried out prior to the withdrawal.

The detailed list of cookies used (name, provider, purpose, storage duration) is available in the Cookies Policy, published separately on the site and updated periodically.

6. MEASURES TAKEN TO ENSURE SECURITY OF PERSONAL DATA

In order to limit the risks resulting from the processing of personal data, the Association has implemented appropriate technical and organisational measures:

  • Processing through the website and social networks is strictly limited to what is necessary to fulfill the purposes brought to your attention, as a data subject;
  • If unsolicited information is sent to contact@adoptamstudenti.ro by the operator (including but not limited to work documents, CVs, requests containing personal data, etc.), they will be deleted within a period of more than 30 days;
  • Access to the data collected through the website and the social media networks referred to in this document is limited, being made by subjects of confidentiality clauses.
  • Communications through the site are secured via HTTPS/TLS protocol, and with the processors who process data on behalf of the Association (Stripe, Google, hosting provider) there are or will be concluded data processing agreements that establish the guarantees provided for in art. 28 of the General Data Protection Regulation.

7. YOUR RIGHTS

  • Right of information and access: means the right of the data subject to obtain confirmation from the Operator as to whether or not personal data concerning him or her are being processed and, if so, access to that data and to information on how the data are being processed.
  • The right to data portability refers to the right to receive personal data in a structured, commonly used and machine-readable format and to have those data transmitted directly to another controller, where technically feasible. Data portability complements the right of access.
  • The right to object concerns the right of the data subject to object to the processing of personal data where the processing is necessary for the performance of a task carried out in the public interest or where it is based on a legitimate interest of the Controller. Where the processing of personal data is for the purpose of direct marketing, the data subject has in particular the right to object to the processing at any time.
  • The right to rectification concerns the correction, without undue delay, of inaccurate personal data stored. The rectification must be communicated to each recipient to whom the data have been transmitted, unless this proves impossible or involves disproportionate (demonstrable) effort.
  • The right to erasure (“right to be forgotten”) means the right of the data subject to request that personal data concerning him or her be erased without undue delay where one of the following reasons applies: (i) the personal data are no longer necessary for the purposes for which they were collected or processed, (ii) he or she withdraws his or her consent and there is no other legal basis for the processing, (iii) he or she objects to the processing and there are no overriding legitimate grounds, (iv) the personal data have been processed unlawfully, (v) the personal data must be erased for compliance with a legal obligation, or (vi) the personal data have been collected in connection with the provision of information society services.
  • The right to restriction of processing may be exercised: (i) where the person contests the accuracy of the data, for a period allowing the verification of the accuracy of the data, (ii) where the processing is unlawful and the person opposes the erasure of the personal data, requesting restriction instead, (iii) where the Operator no longer needs the personal data for the purpose of processing, but the person requests them for the establishment, exercise or defense of a right in court or (iv) where the person has objected to the processing for the period of time during which it is verified whether the legitimate rights of the Operator prevail over those of the person concerned.
  • The right to withdraw consent at any time, where processing is based on consent, without this affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. For minors, the above rights may be exercised by the holder of parental responsibility or the legal representative of the minor.
  • The right to file a complaint with the National Supervisory Authority for Personal Data Processing, in the event that the data subject, after contacting and making requests to the Operator, considers that his or her legal rights in relation to data processing are not respected.
    The contact details of ANSPDCP are as follows:
    Adresa: B-dul G-ral. Gheorghe Magheru 28-30
    Sector 1, cod poștal 010336
    București, România
    Telefon: +40.318.059.211 / +40.318.059.212
    Fax: +40.318.059.602
    Email: anspdcp@dataprotection.ro
    Web page: www.dataprotection.ro
  • The right to refer the matter to the competent court

Regarding the exercise of your rights, you can send us your requests to the e-mail address contact@adoptamstudenti.ro or to the address at Str. George Bacovia, 15-17, C2, U9, Voluntari, Ilfov. We ask the data subjects who send such requests to the Association to mention either in the subject of the e-mail or on the envelope in which documents will be sent/delivered, information such as “data protection”.

The operator will analyse your requests and requests and will respond to you within 30 days at most. If you consider that the answer is not a favorable one, you can address the National Supervisory Authority for the Processing of Personal Data or the competent court.

8. MODIFICATION OF THE PERSONAL DATA PROCESSING POLICY

This privacy policy may change at any time.

The new privacy policy will be displayed on the website, for the correct information of the persons concerned, in accordance with the applicable legislation on the protection of personal data.

In the event of a substantial change (e.g. new data categories, new purposes or new recipients), registered users will be additionally notified by email or by a visible notice on the website, before the change is applied.

Date: 04.08.2026