Updated on October 7, 2026
Privacy policy
What data we use, why, who we share it with and how long we keep it
This is an English translation for your convenience. The Romanian version is the one that applies: read it in Romanian.
Who is responsible for your data
The controller of your data is Asociația Werdnig Hoffman (the Werdnig Hoffman Association, AWH), tax ID (CIF) 24623073, with its registered office at Str. Progresului nr. 28, Carei, jud. Satu Mare, 445100, Romania. For any question about your data, email us at [email protected] or write to us by post at our registered office.
This policy covers the website werdnighoffman.ro: visiting it, the Contact, Get involved and Căsuța Prieteniei forms, Form 230 and donations. Data about project beneficiaries, volunteers under a volunteering contract and employees is covered by separate notices.
What data we use, why and on what legal basis
- 1.
Visiting the website
When you open a page, Cloudflare, our hosting provider, processes your IP address, the date and time, the page requested and technical data about your browser, in order to deliver the page and protect the website from attacks. The legal basis is our legitimate interest in having a secure, functioning website (Article 6(1)(f) GDPR). AWH does not use traffic analytics, does not create profiles and does not keep access logs.
- 2.
The Contact, Get involved and Căsuța Prieteniei forms
Your name, email, phone number (optional), the subject or option you chose and your message. We use them to reply to you and, if you want to take part in activities or get involved, to make the necessary arrangements. The legal basis is your request (Article 6(1)(b)) and, for general questions, our legitimate interest in replying to correspondence (Article 6(1)(f)). Do not send medical data or other sensitive information through the forms unless your request requires it.
- 3.
Form 230
Your name, father's initial, personal code (CNP), home address, email, phone number (optional), the two-year option and your signature. We use them to file the form with ANAF (the Romanian tax authority) and to keep the records required by the tax procedure. The legal basis is your request to file the form through us (Article 6(1)(b)) and the Association's legal obligations (Article 6(1)(c)), under Article 123¹ of the Romanian Tax Code and ANAF President's Order no. 103/2025 (the ANAF order on Form 230). We use your CNP only for this purpose, and your email and phone number only if we need to contact you about the form.
- 4.
Data we receive from ANAF
If you check the consent box in the form, ANAF may share with us your name, CNP and the amount directed (Article 6(1)(a)). The box is not checked in advance, online or on the paper form prepared by AWH. We use this information only to keep records of the amounts received, not for marketing or publication.
- 5.
Donations by bank transfer
From our bank statement we receive your name and account, the amount, the date and the payment details. We use them for our accounting records (Article 6(1)(c), Accounting Law no. 82/1991) and, if you left us your contact details, to thank you or respond to a request (Article 6(1)(f)).
- 6.
Card donations, once card payment is available
Your name, email, the amount, currency and date, the transaction ID and status, any refunds and, for monthly donations, the details of the authorization and of its cancellation. We do not receive your full card number or your CVV/CVC code. The legal basis is the donation you make (Article 6(1)(b)) and our accounting obligations (Article 6(1)(c)).
- 7.
Requests, complaints and defending our rights
We use the data in refund requests, complaints and requests about personal data to resolve them and to be able to prove what we did (Article 6(1)(c) and (f)).
Required fields are marked. Without them we cannot reply to your message, file Form 230 or process your donation. We do not make decisions based solely on automated processing that significantly affect you. Your bank and euPlătesc may run automated fraud checks, which are described in their own privacy notices.
How form data reaches us
The website does not save the data you enter in its forms. When you submit a form, the data travels over an encrypted connection to a Cloudflare service, which immediately forwards it as an email to the Association's inbox, without keeping a copy. Form 230 is filled in and signed in your browser, and the Association receives the completed PDF. If sending fails, the data is not saved anywhere.
Who we share your data with
Only the people at AWH who handle your request see your data. We do not sell data or use it for advertising. We share it only with the following recipients:
- Cloudflare, Inc.: hosting the website and forwarding the forms to the Association's email inbox, as a processor, under the data processing agreement included in Cloudflare's terms;
- Google Ireland Limited: the provider of the Association's Gmail inbox, where messages and forms arrive;
- ANAF: Form 230, through the summary statement, and our responses to tax inspections;
- Banca Transilvania: donations by bank transfer and refunds, as described in the bank's own privacy notice;
- EuroPayment Services S.R.L. (euPlătesc) and the banks involved in the payment: card donations, once card payment is available; they process the data as controllers, under their own policies;
- the people who keep the Association's accounts and authorities entitled to it by law, only to the extent necessary.
We do not publish your CNP, your signature or your form. We publish donors' names and amounts only with each donor's separate consent. We may publish statistics from which no one can be identified.
Transfers outside the European Economic Area
Cloudflare and Google may also process data outside the EEA, including in the United States. Cloudflare, Inc. and Google LLC are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision, and, where applicable, they use the standard contractual clauses approved by the Commission. You can ask us for information about these safeguards.
How long we keep your data
- Messages from the contact forms and other correspondence: no more than 12 months after the conversation ends, unless they are needed for a donation, a collaboration or a legal obligation.
- Form 230 submissions and proof of filing: 5 years, counted from July 1 of the year following the last year in which the request takes effect.
- Accounting documents (donations, refunds, sponsorships): 5 years from July 1 of the year following the end of the financial year, under Article 25 of Law no. 82/1991.
- Monthly donation data: for as long as the authorization is active; once the donation is stopped, only the accounting documents remain.
- Technical data about visits: AWH does not keep it; Cloudflare keeps it according to its own policy.
If a tax inspection, a complaint or a legal dispute requires it, we keep the documents needed until it is concluded. When these periods expire, the data is deleted.
Cookies
The website does not set cookies or store data in your browser, for example in localStorage. We do not use traffic analytics, advertising, tracking pixels or embedded social media content: Facebook and Instagram appear only as links. Fonts, photos and videos are served directly from the website. This is why we do not ask for your consent to cookies.
Cloudflare may place a technical cookie that is strictly necessary to protect the website, but only when it displays a security check. The euPlătesc payment page, when you use it, has its own cookie policy. If we add tools that need your consent, we will ask for it before turning them on and will update this page.
Security
The website works only over encrypted connections (HTTPS), and access to the Association's email inbox and documents is limited to the people who handle them. No system is free of risk. If an incident affects your data, we will notify the authority and you, where the law requires it.
Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection. You can withdraw any consent you have given at any time and lodge a complaint with ANSPDCP (the Romanian data protection authority). The “GDPR and your rights” page explains how to exercise them.
Updates to this policy
We update this policy when the way we use data changes, and the date of the latest version appears at the top of the page. Before we use data for a new purpose, we will let you know.