2.0 from 10.06.2021
This document describes the personal data processing practices of the Association for the Defence of Human Rights in Romania – Helsinki Committee (APADOR-CH) concerning the websites www.apador.org and www.drepturicivile.ro as well social media pages (such as Facebook, Twitter, YouTube) named “APADOR-CH” and for data received by e-mail or telephone by the association as well as for data collected during the association’s public activities.
All the personal data processed by the Association for the Defense of Human Rights in Romania – Helsinki Committee situated in Bucharest, Strada Nicolae Tonitza nr. 8A, Sector 3, Bucharest, established based on civil sentence no. 1339 of 24 April 1990 of the Court of Sector 1 Bucharest, registration number in the National Register of non-profit legal entities MJ 3681/A/1990, tax reference number 4601950, telephone: +4021 312.45.28, e-mail firstname.lastname@example.org, as personal data controller (as specified by Regulation 679/2016 GDPR), referred to throughout this Policy as APADOR-CH.
This document is intended to inform you per Articles 13 and 14 GDPR about what personal data we process as a data collector, including how we collect it from you, how and where we might use this data, how we intend to protect this data, who has access to it, and how any errors which may occur can be corrected promptly.
- About us
APADOR-CH complies with the Romanian and European legislation in force concerning personal data protection and processes personal data only for specific purposes.
The primary purpose of collecting personal data is to inform internet users about APADOR-CH, the Association’s activities and interact with interested users through newsletters and social networks where APADOR-CH has a user account.
APADOR-CH receives requests and information from various individuals with issues concerning human rights. This data is generally first and last names, e-mail or phone addresses, and any other information that the individuals involved think may be useful in their respective cases. This personal data may be used, where appropriate, only to respond to the issue raised by the individual and is not shared with anyone else. If it becomes necessary to forward the collected data to the competent authorities for further action, this will only be done with the person’s prior consent.
The use of such data for journalistic or public information purposes on the organisation’s websites may only be made with the person’s consent whose data is so processed.
APADOR-CH organises various public meetings or projects, where public persons and others are invited or involved. This personal data, necessary for these activities, may be obtained directly, or, as an exception, collected from public sources (e.g., business cards, social media, Internet), and information about the data processing is given at the first communication with them.
For specific projects, APADOR-CH will collect personal data directly from data subjects, particularly for online or offline registration for participation in a particular project, interview event, or training. This data is used to facilitate the participation in the selected event and for similar information and invitations in the future.
Photographs and videos taken at public events are used to promote the event on the Internet and in the media or, where appropriate, for documenting the project the event is a part of, including reporting to a specific funder announced at the event.
In the materials created by APADOR-CH and published on apador.org and drepturicivile.ro or on social media accounts, personal data are also processed, which are used for journalistic purposes or artistic expression in the context of Article 7 of Law 190/2018 and Article 85 GDPR and are personal data which have been manifestly made public by the data subject or which are closely linked to the data subject’s status as a public person or to the public nature of the facts in which they are involved.
The legal grounds for processing these data are:
- consent (art 6 (1) a of GDPR) – for data used for newsletter subscriptions, messages sent via the contact form, interactions (comments, shares, questions, etc.) for visitors to our social media pages where we are active, for requests received by e-mail or phone or interviews for specific projects;
- contract (Art 6 (1) b GDPR) – for data collected as a result of the performance of a contract to which the data subject is a party or to take steps at the request of the data subject before the conclusion of a contract – usually those related to participation in a project, event or training;
- legal obligation (art 6 (1) c GDPR) – for data collected based on legal obligations for invoicing, reimbursement, or other obligations related to transparency and documentation of the expenditure of European or national public funds.
- legitimate interest (art 6 (1) f GDPR) – for data used for the security of the apador.org and drepturicivile.ro websites and data used for their statistics, as well as for contacting public persons for invitations to events, as well as for photos and videos taken during events.
- What personal data we collect and for what purpose
APADOR-CH collects information in four ways: directly from users of the sites or from people who participate in the association’s activities or contact the association by e-mail or telephone, indirectly from public sources, from traffic reports recorded by the servers hosting our sites and through cookies.
2.1. Personal data collected directly.
Given the primary purpose of information, APADOR-CH collects minimal personal data directly from the site. APADOR-CH collects personal data directly only if you decide to subscribe to our newsletter or contact us directly via our contact e-mail addresses or by phone.
These data are kept until the consent is revoked or for a maximum of 3 years after collection for direct communication.
Personal data may also be collected on APADOR-CH’s social networks if you subscribe to our pages, leave us a comment or write us a message. All this is collected with your consent through the actions you take. For social media accounts (Facebook, YouTube and Twitter), this data is collected in conjunction with the respective social networks with which we are associated data controllers. The respective platforms limit the functionality of accounts on these networks, so we recommend that you read the privacy policies of these sites for more details. This data is used exclusively for the purposes you have indicated – from posting the comment to replying to your message.
We also collect personal data when registering online or offline for participation in an event, training, or project, as per the registration form for each event. We may also use this data to inform you on the same subject after the event has ended unless you do not want us to. In certain cases of events, projects or training programs, your data is also required for legal obligations of invoicing, reimbursement or other obligations related to transparency and documentation of the expenditure of European or national public funds. These data are kept in accordance with the legal obligations in force or in the case of contracts – for the duration imposed by the funder, or in the absence of such data – for the duration of the contract plus three years after its completion.
Some of the APADOR-CH events are public events and the photos and videos taken during these public events are used to promote the event on the Internet and in the media. If you appear in a photo and you do not want us to use it, please contact the photographer who took your photo or the APADOR-CH team immediately, and the image will not be used publicly.
In certain cases, the Association may process personal data belonging to special categories provided for in Article 9 of GDPR – such as data revealing ethnic origin, racial origin, religious denomination or trade union membership, health data, etc., only if such data is vital for the specific activity. In these cases, the basis for the processing is usually the express consent of the data subject (under Article 9(2)(a), and in some exceptional cases on the grounds provided for in Article 9(2)(d), (e) or (f). This data is kept securely according to internal procedures.
2.2. Personal data collected indirectly from public sources
APADOR-CH organises various public meetings, where public persons and others are invited – both as speakers and participants. Their data, necessary for these activities, may be obtained directly or, as an exception, collected from public sources (e.g., business cards, social media, Internet), and information about the data processing is given at the first communication with them. For this purpose, we usually collect at most first name, last name, e-mail address, and in some cases, phone number or social media contact.
2.3. Information provided automatically from the server traffic report. When you visit a website, regardless of the device you use, you disclose certain information about yourself, such as your IP address, the time of your visit, what directed you to our sites, the pages you visited. APADOR-CH, like other data processors, can record this information for a fixed period. APADOR-CH uses Google Analytics traffic analysis services.
This data is used exclusively by APADOR-CH to improve its websites and to ensure their security.
Under no circumstances does APADOR-CH use traffic data to identify people behind IP addresses. We use this data exclusively as statistical data.
As for external APADOR-CH services, which place cookies (third-party cookis) when browsing APADOR-CH websites, their purpose is to analyse traffic (Google Analytics) or to display video content from YouTube, as the case may be.
Most browsers are set to accept cookies automatically. But if you do not want this, you can reset your browser to either notify you every time you receive a cookie or refuse to accept cookies.
- Data hosting
Information, including personal data, received on our servers will be recorded, used, stored and organised on protected servers, where the Association’s websites are hosted, and on any other media allowing such operations, under optimal security conditions, by appropriate means. For the secure hosting of personal data, we use the services of specialised companies, acting as authorised persons of APADOR-CH.
- Your rights
Under GDPR, you have the right to access, rectify, erase, or restrict the processing of your data, as well as the right to object the processing of your personal data.
We do not collect personal data through automated systems, so the right to data portability cannot be exercised. We also do not make automated decision-making processes, including profiling.
For data collected by consent, you have the right to withdraw consent at any time.
In the case of photos or videos taken by APADOR-CH, if you have appeared in an image and you do not want us to use it, please contact the photographer or APADOR-CH team immediately, and the image will not be used publicly or will be deleted, as appropriate.
To exercise these rights, you can send us a request by e-mail to email@example.com regarding the personal data collected by us. For personal data collected by YouTube or Facebook we recommend that you contact these operators directly. Through account settings, we only have access to a minimal set of personal data.
You also have the right to lodge a complaint with a supervisory authority or take legal action.
- Who has access to your information
In the course of processing personal data, APADOR-CH may also use other companies (called proxies) to achieve the above-mentioned purposes, such as website hosting (Infomaniak Network Switzerland) or newsletter management and sending (Mailchimp- USA).
These companies are obliged to use these data securely and exclusively for the purposes specified by APADOR-CH. They only have access to the personal data strictly necessary to provide the service established by APADOR-CH and may not use the personal data for their own purposes. All these are in Romania and the European Union or in any other legal area that offers an adequate level of protection of personal data according to European Union standards (art 45 GDPR) or other appropriate safeguards, including standard data protection clauses (art 46 (2) GDPR).
As far as social media accounts are concerned, this data is collected together with the respective social networks (Facebook, Twitter, Youtube), with which we are associated operators, but which probably collect even more personal data. The respective platforms limit the functionality of accounts on these networks for us, so we recommend that you read the privacy policies of these sites for more details.
In some instances, such as events, projects or training programs, your data is also required for legal obligations of invoicing, reimbursement or other obligations related to the transparency and documentation of the expenditure of European or national public funds. This data may be shared with the respective funder, which is separately mentioned when collecting the data.
- Final provisions
The APADOR-CH Policy on the processing of personal data 2.0 was adopted on 10.06.2021, and in the future, whenever we modify it, we will publish the new version on the Association’s websites and inform you of this effect, if necessary.
Comments policy on the website and social media:
The Association aims to use the comments hosted on this website and on social networks (Facebook, Twitter, Youtube) to create a civilised dialogue based on facts and conducted in good faith.
The Association reserves the right to delete comments containing hate speech, insults, threats, inciting ethic hatred or violence and comments made in bad faith or for harassment.