GDPR and your rights

This is an English translation for your convenience. The Romanian version is the one that applies: read it in Romanian.

Who to contact

Send your requests to Asociația Werdnig Hoffman (the Werdnig Hoffman Association), the controller of your data, at [email protected] or by post to Str. Progresului nr. 28, Carei, jud. Satu Mare, 445100. You do not need an account on the website or any particular form.

This page explains your rights under Regulation (EU) 2016/679 (GDPR). The “Privacy policy” sets out what data we use, why, who we share it with and how long we keep it.

Your rights

1. 1.

   Access

   You can find out whether we use data about you, what that data is, why we use it, where we got it, who we have shared it with and how long we keep it, and you can get a copy of it. The first copy is free.

   
   
2. 2.

   Rectification

   You can ask us to correct inaccurate data and complete incomplete data, such as the name or email linked to a donation. Accounting documents that have already been drawn up are corrected according to accounting rules.

   
   
3. 3.

   Erasure

   You can ask us to erase your data under the conditions set out in Article 17 GDPR, for example when it is no longer needed or when you withdraw your consent and we have no other legal basis. We cannot erase what the law requires us to keep, such as accounting documents or a Form 230 that has been filed. We will tell you what remains, why and until when.

   
   
4. 4.

   Restriction

   You can ask us to keep your data without using it any further in the situations set out in Article 18 GDPR, for example while we check whether it is accurate or consider your objection. We will let you know before we lift the restriction.

   
   
5. 5.

   Portability

   You can receive the data you gave us that we process by automated means, based on your consent or on a donation, in a structured, commonly used format. You can also ask us to transfer it to another controller, where this is technically possible. This right does not apply to processing based on legal obligations.

   
   
6. 6.

   Objection

   You can object, on grounds relating to your situation, to our use of your data based on our legitimate interest. We will stop, unless we have legitimate grounds that take precedence or we need the data to defend our rights in court. You can object to marketing messages at any time, without giving a reason.

   
   
7. 7.

   Withdrawing consent

   You can withdraw any consent you have given at any time, as easily as you gave it, for example your consent for ANAF (the Romanian tax authority) to share your details and the amount directed with us. Withdrawing consent does not affect what was done before and does not cancel a donation or a Form 230 that has already been filed; for those, see “Cancellation and refunds”. For information that ANAF shares with us, we will tell you what steps you need to take with ANAF.

   
   
8. 8.

   Automated decisions

   You have the rights set out in Article 22 GDPR regarding decisions based solely on automated processing. AWH does not make such decisions. For automated checks run by your bank or the payment processor, see their privacy notices.

Your rights regarding Form 230

You can ask for a copy of your form, information about its filing or the correction of your data. If the form has already been sent to ANAF, the correction also goes through the tax procedure: we will tell you what we can do and what you need to ask ANAF for. A request for erasure does not release us from the obligation to keep the filed form for the period required by law.

How to send a request

Tell us which right you want to exercise and help us identify you: the name and email you used and, for a donation, the date and amount, or for Form 230, the year and the date you sent it. Do not write your personal code (CNP) in the email, and do not send your card number, CVV/CVC code, PIN or banking passwords. You can also send the request through a representative, with proof that they are authorized to act for you.

We do not automatically ask for a copy of your ID. If we have reasonable doubts about your identity, we will ask only for the information needed to verify it and explain why.

Response time and cost

We reply without undue delay and no later than one month after receiving your request. If the request is complex or there are many requests, this period may be extended by up to two months; we will let you know within the first month and explain why. If you send a request by email, we will reply by email unless you ask otherwise.

Exercising your rights is free. For requests that are manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request, giving our reasons. If we do not act on a request, we will tell you why and how you can challenge our decision. If we rectify, erase or restrict data, we will also inform the recipients we shared it with, as required by Article 19 GDPR.

Complaints and going to court

If you believe we have infringed your rights, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), the Romanian data protection authority:

• •Website: https://www.dataprotection.ro/, “Plângeri” (Complaints) section.
• •Email: [email protected].
• •Address: B-dul G-ral. Gheorghe Magheru nr. 28–30, Sector 1, postal code 010336, Bucharest, Romania.

You can also turn to the supervisory authority in the member state where you live or work, or where the alleged infringement took place (Article 77 GDPR), and to the courts, including to claim compensation.