Privacy Policy

1. Who we are (data controller)

The controller of the personal data collected through this website is:

• Asociația Română pentru Smart City (Romanian Smart City Association, "ARSC"), a non-governmental organisation founded in 2016.
• Registered office: Integral Business Center, Bd. Pipera nr. 1-IA, Voluntari 077190, Ilfov County, Romania.
• Email for requests concerning personal data: [email protected]

For any question, exercise of your rights or complaint concerning the processing of personal data, you can contact us directly at the email address above.

2. What personal data we collect

This website collects personal data in a single context: filling in the contact form on the Contact page. The data collected, according to the form fields, are:

• First name and surname (required)
• Position within the institution (required)
• Name of the institution / administrative-territorial unit (UAT) (required)
• County (required)
• Email address (required)
• Telephone number (optional)
• Type of UAT (optional)
• Message / context (optional)
• Technical data processed to prevent automated submissions: IP address, user agent and time of submission. The check is carried out by the Cloudflare Turnstile service, loaded on the form page.

The website uses a professional web traffic analytics tool, activated only with your explicit consent given through the cookie banner shown on your first visit. If you choose "Essential only", the analytics tool is not loaded and no analytics cookies are set. The IP address is anonymised automatically. We do not use advertising or retargeting tools and we do not profile visitors for commercial purposes.

Fonts are served from this website's own server, so loading them does not send data to third parties. On some pages, illustrative images are loaded from an external photo platform; loading them automatically sends the visitor's IP address and user agent to that platform, on the basis of the legitimate interest in presenting the pages. The categories of recipients are set out in section 5 and transfers in section 11.

3. Purposes for which we process the data

The data submitted through the form are used exclusively to:

1. Respond to the request you sent: scheduling the 30-minute call, clarifications by email or telephone.
2. Send you, at your request, a technical and financial proposal.
3. Keep an internal record of communications with the institution you represent, for continuity and administrative record-keeping.

The data are NOT used for direct marketing, are not sold, rented or shared with third parties for commercial purposes and are not subject to automated decisions producing legal effects concerning you.

4. Legal basis for processing

Processing is based on:

• Article 6(1)(a) GDPR: your consent, given by voluntarily submitting the contact form after being informed about this policy.
• Article 6(1)(b) GDPR: pre-contractual steps, where your request concerns starting a cooperation between ARSC and the institution you represent.

5. Who we share the data with (categories of recipients and processors)

Access to the data processed through this website is limited to the following categories of recipients:

• Members of the ARSC team who handle the request.
• ARSC infrastructure. The website is hosted on servers administered by the Romanian Smart City Association, and form messages are received by a service operated by ARSC itself (api.arsc.ro). No third-party form processor is involved.
• Cloudflare, Inc.: content delivery and traffic protection network for this website, including the anti-spam check on the form (Turnstile). It processes technical traffic data.
• Google: Google Analytics 4, loaded only with the visitor's consent, with IP address anonymisation. The data are not used for advertising or profiling.
• Plausible, installed on ARSC infrastructure (plausible.arsc.ro): aggregated traffic statistics, loaded only with the visitor's consent.
• The external image platform used on some pages for illustrative photographs: it receives the IP address and user agent as part of delivering the image.

All providers are selected according to strict GDPR compliance criteria and provide the safeguards laid down in Chapter V of the Regulation. On written request to [email protected], we can provide further information about the identity of the providers involved in processing your data, in line with the right of access in section 7.

We do not pass your data to any other third parties, except where we are required to do so by law (public authorities, courts).

6. How long we keep the data

• If no cooperation is started following the request: the data are deleted from the ARSC system that receives the form and from correspondence within a maximum of 12 months of the last communication.
• If a cooperation agreement is signed: the data relating to the project are kept for the duration of the contract plus the statutory archiving period (10 years for supporting documents, under Romanian financial and accounting legislation), after which they are deleted or anonymised.
• You can ask at any time for your data to be deleted by sending a written request to [email protected]; we will act on the request within a maximum of 30 days, subject to legal retention obligations.

7. Your rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15): to find out what data we hold about you and to receive a copy.
• Right to rectification (Art. 16): to correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17): to request deletion of the data, within the limits of legal obligations.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20): to receive the data in a structured, commonly used format.
• Right to object (Art. 21): to object to processing.
• Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint with the supervisory authority: the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, Romania, email: [email protected].

To exercise any of these rights, write to us at [email protected]. We reply within a maximum of 30 calendar days of receiving the request.

8. Whether providing the data is mandatory

Providing data through the contact form is voluntary. The only consequence of declining to fill in the required fields is that we cannot process your request: you are not obliged to provide data and you face no penalty if you choose not to. You can also contact us by email or telephone (see the Contact page).

9. Data security

The website is served exclusively over an encrypted connection and benefits from a full set of technical and organisational measures to protect data in transit and at rest. Messages sent through the form are encrypted. Access to ARSC's internal correspondence is limited to authorised persons, with authentication. We do not process sensitive data through this website (passwords, financial data, health data, data about minors) and we do not collect special categories of data within the meaning of Art. 9 GDPR.

10. Cookies

We use two categories of cookies and similar local storage technologies:

• Essential (no consent required under Art. 4(5) of Law 506/2004 on privacy in electronic communications): your accessibility preferences and the record of your cookie choice. These data remain only on your device and are not sent to ARSC or to third parties.
• Analytics: switched on only if you click "Accept all" on the banner shown on your first visit. The maximum storage period in the browser is 13 months. The IP address is anonymised. You can withdraw your consent at any time by deleting the cookies in your browser and returning to the site, or by writing to us at [email protected].

The cookie banner works with a default setting of "refused" for the analytics category: the traffic measurement tool receives no data about you until you give your explicit consent through an affirmative action.

11. International transfers

Messages sent through the form are received by a service operated by ARSC itself, not by a third-party processor. However, some technical operations involve providers with global infrastructure. These take place on the basis of the safeguards laid down in Chapter V GDPR:

• Cloudflare: technical traffic data and the anti-spam check on the form. Legal safeguard: Standard Contractual Clauses approved by the European Commission.
• Google Analytics 4: only with your consent. Legal safeguard: Standard Contractual Clauses and the adequacy decision on the EU-US Data Privacy Framework.
• The external image platform: IP address and user agent, when the illustrative photographs are loaded. Legal safeguard: Standard Contractual Clauses.

If you choose "Essential only" in the cookie banner, the analytics tools are not loaded, so the transfers related to them do not take place.

12. Changes to this policy

This policy may be updated from time to time, in particular when we introduce new tools on the website or when the applicable legal framework changes. The version in force always shows its date below the title. In the event of significant changes that directly affect the processing of your data, we will notify you by email (if you have an open request with us).

13. How to contact us about personal data

For any question, request or complaint concerning the processing of personal data:

• Email: [email protected]
• Postal address: Asociația Română pentru Smart City, Bd. Pipera nr. 1-IA, Integral Business Center, Voluntari 077190, Ilfov County, Romania.

We reply within a maximum of 30 calendar days. If you are not satisfied with our reply, you have the right to contact ANSPDCP (see section 7).