GDPR
Privacy Policy
How we collect, use and protect your personal data.
Last updated: 03.11.2026
1. Who we are
The data controller is Asociația Down Plus București, registered office at 3 Oltina St, bl. 28, sc. 1, fl. 1, ap. 4, Sector 5, Bucharest, Romania. Contact: office@downplusbucuresti.ro, +40 730 370 290.
2. What data we collect
- Contact form: name, email, phone (optional), subject and message, plus IP address and timestamp (for security and abuse prevention).
- Cookies: essential cookies and, only with your consent, analytics (Google Analytics) and marketing (Meta Pixel) cookies. See our Cookie Policy.
- Donations and sponsorships: data provided by bank transfer or contract, for accounting purposes.
3. Purposes and legal basis
- Replying to your messages – consent (Art. 6(1)(a) GDPR) and steps at your request (b).
- Website usage statistics – consent.
- Accounting and tax obligations – legal obligation (c).
- Website security – legitimate interest (f).
4. Retention
Contact messages are kept for up to 24 months after the last interaction and then deleted. Accounting records are kept for the legally required periods.
5. Recipients
We never sell or rent your data. We share it only with providers that help us operate (web hosting, email, Google, Meta – only with your cookie consent) and with authorities where required by law. Some providers may transfer data outside the EEA under appropriate safeguards (standard contractual clauses).
6. Your rights
You have the right of access, rectification, erasure, restriction, portability, objection, and to withdraw your consent at any time without affecting prior processing. To exercise your rights, email office@downplusbucuresti.ro. You may lodge a complaint with the Romanian supervisory authority ANSPDCP (www.dataprotection.ro).
7. Security
We use encrypted connections (HTTPS), restricted access to the admin area and anti-spam measures to protect your data.