Privacy policy

General

Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, in this document – GDPR, Regulation or GDPR) was adopted by the European Parliament and the Council of the European Union on 27 April 2016 and its provisions are directly applicable as of 25 May 2018. This Regulation expressly repeals Directive 95/46/EC, thus also replacing the provisions of Law 677/2001 (now repealed).

The Regulation is directly applicable in all Member States, protecting the rights of all natural persons in the European Union. From a substantive point of view, the Regulation applies to all controllers processing personal data. The Regulation does not apply to the processing of personal data relating to legal persons, and in particular to undertakings having legal personality, including the name and type of legal person and the contact details of the legal person.

Personal data are defined as any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

Processing of personal data means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Identity of the operator

In view of Article 4(7) of the Regulation, which defines the notion of “controller” as the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data, the controller who processes personal data through this website is Fapte Association, established in Cluj-Napoca, str. Donath nr. 192 ap. 12, jud. Cluj, with CIF: 31425230, represented by Alin Vaida, as executive director and organizer of the Jazz in The Park Festival and Jazz in The Park Competition, email: salut@fapte.org, in association with Beyond the Line Production Association, with registered office in Cluj-Napoca, str. Al. Vlahuță bl. Lama A, ap. 25, jud. Cluj with CIF: RO31425273, represented by Alin Vaida, as president.

Collection of personal data

What personal data is collected

The operator of this website collects, stores and processes the following personal data of / relating to you:

• Name, first name
• Home and/or residence address
• Contact details (such as e-mail, telephone)
• IP and other online identifiers
• Bank details (directly, in the case of contracts with operators and via the payment processor)
• Biometric data (photos, images)

Given that the Regulation mainly prohibits “the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of genetic data, biometric data for the unique identification of a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation” (as per Article 9(1)), the situations in which the processing of such data is allowed are then established:

1. there is explicit consent of the data subject;
2. processing is necessary for the purposes of carrying out obligations and exercising specific rights of the controller or the data subject in the field of employment and social security and social protection;
3. processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
4. processing is carried out in the course of their legitimate activities and with appropriate safeguards by a foundation, an association or any other non-profit-making body of a political, philosophical, religious or trade-union nature, provided that the processing relates only to members or former members of that body or to persons with whom it has ongoing contacts in connection with its purposes and that the personal data are not disclosed to third parties without the consent of the data subjects;
5. the processing relates to personal data which are manifestly made public by the data subject;
6. processing is necessary for the establishment, exercise or defence of legal claims or whenever the courts act in their judicial role;
7. processing is necessary for reasons of substantial public interest on the basis of Union or national law which is proportionate to the objective pursued, respects the essence of the right to data protection and provides for appropriate and specific measures to protect the fundamental rights and interests of the data subject;
8. the processing is necessary for the purposes of preventive or occupational medicine, the assessment of the employee’s ability to work, the establishment of a medical diagnosis, the provision of medical or social care or medical treatment or the management of health or social care systems and services, pursuant to Union or national law or pursuant to a contract concluded with a health professional and subject to compliance with the conditions and safeguards laid down in the Regulation;
9. processing is necessary for reasons of public interest in the field of public health, such as protection against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare and medicinal products or medical devices, on the basis of Union or national law providing for appropriate and specific measures to protect the rights and freedoms of the data subject, in particular professional secrecy;
10. processing is necessary for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, proportionate to the aim pursued, respecting the essence of the right to data protection and providing for appropriate and specific measures to protect the fundamental rights and interests of the data subject.

Obtaining Consent

General

For the processing of personal data to be lawful, the GDPR requires that it is carried out for a legitimate reason, such as the performance or conclusion of a contract, the fulfilment of a legal obligation, or on the basis of the data subject’s prior valid consent. In the latter case, the controller is required to be able to demonstrate that the data subject has given his or her consent to the processing. Consent given under Directive 95/46/EC remains valid if it meets the conditions laid down in the GDPR.

Consent must be given by an unequivocal statement or action which constitutes a freely expressed, specific, informed and clear expression of the data subject’s consent to the processing of his or her personal data. Where the data subject’s consent is given in the context of a statement, in electronic or written form, which also relates to other matters, the request for consent must be presented in a form which clearly distinguishes it from other matters and may even be made by ticking a box.

For the processing of personal data to be lawful, the GDPR requires that it is carried out for a legitimate reason, such as the performance or conclusion of a contract, the fulfilment of a legal obligation, or on the basis of the data subject’s prior valid consent. In the latter case, the controller is required to be able to demonstrate that the data subject has given his or her consent to the processing. Consent given under Directive 95/46/EC remains valid if it meets the conditions laid down in the GDPR.

Cookies

Cookies are used on this website. They do not harm your computer and do not contain viruses, but are intended to contribute to an easier, more efficient and safer use of the site. They are small text files that are stored on your computer and saved by the browser you are using.

Many of the cookies used are called “session cookies”, which are automatically deleted after your visit to this site. Others remain in the memory of your computer until you delete them, making it possible for your browser to recognise them on a subsequent visit.

You can configure your browser to inform you about the use of cookies so that you can decide on a case-by-case basis whether to accept or reject a cookie. Alternatively, your browser can be set to automatically accept cookies under certain conditions or to always reject cookies or automatically delete cookies when you close your browser. Disabling cookies may limit the functionality of this website.

Cookies that are necessary to enable electronic communications or to provide certain functions you want to use (such as shopping cart) are stored in accordance with the provisions of Article 6 (1) (f) of the GDPR, according to which processing is lawful only if and to the extent that it is necessary for the legitimate interests pursued by the controller or a third party. Therefore, the operator of this website has a legitimate interest in storing certain cookies in order to ensure technical error-free optimization. Other cookies (such as, for example, those used to analyse your browsing behaviour) are also stored and are described in.

Server log files

The provider of this site automatically collects and stores information that your browser automatically sends to us via log files. These are:

• Browser type and version
• Operating system used
• The URL of the page that originally generated the request to display the current page or object (Referrer URL)
• Host name of the accessing computer
• Time data of the server access
• IP address

The legal basis for processing such data is Article 6(6). 1 lit. b) GDPR, which allows the processing of data when it is necessary for the performance of a contract to which the data subject is a party or in order to take steps, at the request of the data subject, prior to entering into a contract.

Contact form

If you send us questions via the contact form, we will collect the data entered in the form, including the contact details you provide, in order to respond to your and subsequent questions. We do not transmit this information without your permission. We will therefore only process any data you enter into the contact form with your consent. [You can revoke your consent at any time, an informal e-mail to this effect is sufficient. Data processed prior to receiving your request may be processed lawfully.

We will keep the data you provide on the contact form until:

• you request deletion of the data;
• you revoke your consent to its storage; or
• the purpose for its storage is no longer valid.

Any mandatory legal provisions, in particular those relating to mandatory data retention periods, are not affected by the above.

Contact by e-mail or phone

If you contact us by e-mail or telephone, your request, including any personal data you provide, will be stored and processed by us for the purpose of dealing with your request, based on your consent.

We will therefore process all data you provide under the following legal provisions in the GDPR, respectively:

• only with your consent – in accordance with the provisions of Article 6 para. 1 lit. a) GDPR
• for the performance of a contract or at the pre-contractual stage – in accordance with the provisions of Art. 6 para. 1 lit. b) GDPR
• for the fulfilment of the purpose and legitimate interest pursued by us, i.e. the efficient processing of requests submitted by you – in accordance with the provisions of Art. 6 para. 1 lit. f) GDPR

We will keep the data you provide in this way until:

• you request deletion of the data;
• you revoke your consent to their storage; or
• the purpose for its storage is no longer valid, in all cases except for mandatory data retention periods.

The purpose of processing the collected data

Some of the data collected on this site is used to:

• provide services, i.e. to provide the services we offer for your benefit (e.g. to solve problems of any kind related to our events, to provide support services, etc.)
• optimal operation and optimization of this site (statistically and analytically) – We always want to give you the best experience on our site, which is why we may collect and use certain information in relation to your satisfaction while browsing this site, invite you to fill in suggestion questionnaires or the like
• online advertising and promotional activities. You can ask us at any time, by the means described in this document, to stop processing your personal data for marketing purposes, and we will comply with your request as soon as possible
• regular user information – We want to keep you up to date with our events. To this end, we may send you any type of message containing general and thematic information, information on offers or promotions, as well as other commercial communications such as market research and opinion polls. For such communications, we rely on your prior consent. You can change your mind and withdraw your consent at any time
• the protection of our legitimate interests. There may be situations where we use or transmit information to protect our rights and business. These may include: measures to protect our website and the user of our website from cyber-attacks; measures to prevent and detect fraud attempts, including the transmission of information to the relevant public authorities; measures to manage other types of risks

The processing of personal data is carried out in accordance with the provisions of the General Data Protection Regulation, based both on the consent of the data subject and for reasons of proper performance of contracts or the legitimate interests of the controller (unless the interests or fundamental rights and freedoms of the data subject prevail, which require the protection of personal data, in particular when the data subject is a child).

User rights

Your rights regarding personal data and the means to exercise them are: Right of information, Right of access, Right to rectification, Right to erasure of data, Right to restriction of processing, Right to data portability, Right to object, Right not to be subject to a decision based solely on automatic processing of data, Right to lodge a complaint and to apply to the courts, Right to withdraw consent.

• Right to information – you can request information on the processing activities of your personal data, on the identity of the controller and its representative or on the recipients of your data
• Right of access – you can obtain confirmation from the controller whether or not personal data relating to you are being processed and, if so, access to those data and to the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; where possible, the period for which the personal data are expected to be stored or, if this is not possible, the criteria used to determine this period; the right to request the controller to rectify or erase the personal data or to restrict the processing of the personal data or the right to object to the processing, etc.
• Right to rectification – you can rectify inaccurate personal data or complete them
• Right to erasure of data – you can obtain erasure of data if the processing was unlawful or in other cases provided for by law
• The right to data portability – you can receive, under certain conditions, the personal data you have provided to us in a machine-readable format, or you can request that the data be transferred to another controller
• Right to object – you can object in particular to data processing based on the legitimate interest of the controller
• The right not to be subject to a decision based solely on automated processing – you can request and obtain human intervention with regard to such processing or express your own point of view on such processing
• The right to lodge a complaint and to apply to the courts – you can lodge a complaint against the way personal data is processed with the National Supervisory Authority for Personal Data Processing and/or apply to the courts for the enforcement of your rights
• Right to withdraw consent – in cases where the processing is based on your consent, you can withdraw it at any time. Withdrawal of consent will only be effective for the future, the processing carried out prior to withdrawal will remain valid

Obligations of the data controller

Hosting

Personal data recorded on this website are stored on Hosterion SRL servers.

The processing of the data provided and stored complies with the following legal provisions:

• 6 para. 1 lit. a) GDPR – data processing by Hosterion SRL is carried out on the basis of your consent, obtained after a correct and complete information
• 6 para. 1 lit. b) GDPR – data processing by Hosterion SRL takes place for the purpose of fulfilling contractual obligations
• 6 para. 1 lit. f) GDPR – data processing by Hosterion is carried out for the purposes of the legitimate interests pursued by the controller

Regardless of the purpose for which the processing of personal data takes place, the principles of lawfulness, fairness and transparency are respected, as well as the principle that the personal data processed are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

For more information on the processing of personal data by Hosterion SRL, please visit https://hosterion.ro/.

We have a legal contract/agreement/contract (including the possibility to include and agree to the clauses in the Website Terms and Conditions) with Hosterion SRL to ensure the processing of personal data in accordance with the relevant legal regulations. We comply with our obligations under Article 28 of the GDPR by choosing an external service provider that provides sufficient guarantees for the implementation of appropriate technical and organizational measures so that the processing complies with the requirements set out in the regulation and ensures the protection of your rights.

Data encryption

This site uses SSL encryption for security reasons and to protect the transmission of confidential information. This encryption can be recognized by you by the lock icon that appears in your browser bar and by changing the browser address from http:// to https://.

Once this type of encryption is activated, the data transmitted or transferred will not be visible to third parties.

According to the GDPR, if a breach of personal data security is likely to result in a high risk to your rights and freedoms, the operator of this website will inform you, without undue delay, of this breach, unless the additional provisions of the same Regulation become applicable (Article 34(3)).

Data Protection Officer

As the provisions of the GDPR are not applicable (art. 37 para. 1 – according to which the Controller and the Processor shall appoint a Data Protection Officer whenever:

1. the processing is carried out by a public authority or body, with the exception of courts acting in their judicial capacity;
2. the main activities of the controller or processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, necessitate regular and systematic monitoring of data subjects on a large scale; or
3. the main activities of the controller or processor consist of the processing on a large scale of special categories of data pursuant to Article 9 or of personal data relating to criminal convictions and offences referred to in Article 10)

For any information or clarification on the operation of this website, please contact us at the following details:

• Name: Alin Vaida
• Email: salut@fapte.org
• Correspondence address: Cluj-Napoca, str. Franz Liszt nr. 28 A, jud. Cluj

Records of processing activities

According to the GDPR Regulation, the controller or processor should keep, for a reasonable period of time, records of the processing activities under its responsibility. Thus, these records will include the following information:

• the name and contact details of the controller
• the purposes of the processing
• description of the categories of data subjects and categories of personal data
• the categories of recipients to whom personal data have been or will be disclosed
• where applicable/possible:
• transfers of personal data
• the expected deadlines for deletion of the different categories of data
• general description of technical and organizational security measures

The obligation detailed above does not apply to an undertaking or organization with fewer than 250 employees, unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional or the processing includes special categories of data or personal data relating to criminal convictions and offences.

Appropriate technical and organizational measures

Having regard to the state of the art, the context and purposes of the processing, and the risks to the rights and freedoms of natural persons, the controller shall implement appropriate technical and organizational measures to ensure that, by default, only personal data necessary for each specific purpose of the processing are processed.

Notification of the supervisory authority in the event of a personal data breach

According to Article 33 para. 1 of the GDPR, if a personal data breach occurs, we will notify the National Supervisory Authority for Personal Data Processing without undue delay and, if possible, no later than 72 hours after we become aware of it, unless it is unlikely to result in a risk to the rights and freedoms of individuals.

Informing the data subject of the personal data breach

With reference to the provisions of Article 34 of the GDPR, if the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, we will inform the data subject without undue delay about the breach, unless:

• appropriate technical and organizational safeguards have been implemented and applied to personal data affected by personal data breaches, in particular measures ensuring that personal data are rendered unintelligible to anyone not authorized to access them, such as encryption
• subsequent measures have been taken to ensure that the high risk to the rights and freedoms of data subjects referred to above is no longer likely to materialize
• it would require a disproportionate effort. In this case, public information or a similar measure is taken whereby data subjects are informed in an equally effective way

Personal data of minors

Another of our priorities is to ensure the protection of minors while using this website. We encourage parents and guardians to observe, participate and/or monitor and guide the online activity of minors.

We do not knowingly collect personal data from children under the age of 13. In the event that your child has provided this type of information on our website, we encourage you to contact us immediately and we will make every effort to promptly remove such information from our records.

Social Media – plug-ins on https://www.jazzinthepark.ro/

Facebook Plug-ins (Like & Share Button)

This website uses social plugins (“plugins”) managed by the social network facebook.com. Plugins can be identified by a Facebook logo (a white “f” on a blue plate or a “thumbs up” sign) or are labeled by adding the phrase “Facebook Social Plugin”. The list and layout of Facebook plugins can be seen here: https://developers.facebook.com/docs/plugins/. As long as you use the Like extension, you will appreciate the Facebook page of our website without having to leave it. To the extent that you use the Share extension, you will share our site or certain content within it on your personal Facebook page without having to leave the site.

Through the plugin, Facebook receives the information that you access on our site. If you are logged in and on Facebook at the same time, Facebook can attribute the actions performed on the page to your account and, by default, to you personally. When you interact with the plugins, for example by clicking on the Like button or by sharing certain content on the site, the corresponding information is transferred directly from your browser to Facebook and stored there. Even if you are not a Facebook member, there is still a possibility that the social network obtains and stores your IP address.

By clicking on one of these buttons, you agree to the use of this plugin and therefore to the transfer of personal data to Facebook. We have no control over the nature and purpose of this transmitted data and its further processing.

If you do not want Facebook to associate your visit to this site with your Facebook account information, you have the option of not logging in.

In view of the judgment of 16 July 2020 (Case C-311/18 – Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice has ruled that the protection offered by the EU-US Privacy Shield is not adequate.

The transmission of personal data to the US and other countries outside the European Economic Area (EEA) is therefore based on the European Commission’s Standard Contractual Clauses (SCC). The Commission has issued two sets of Standard Contractual Clauses for data transfers from EU data controllers to data controllers established outside the EU or the European Economic Area (EEA). It has also issued a set of contractual clauses for data transfers from EU data controllers to processors established outside the EU or the EEA. For more information on these clauses, we recommend that you visit https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_ro.

Facebook uses Standard Contractual Clauses as adequate data protection safeguards in line with the level of protection guaranteed by the GDPR.

For more details, please visit: https://www.facebook.com/legal/EU_data_transfer_addendum, regarding the purpose and extent of data collection, further processing and use of data by Facebook, as well as permissions and privacy settings.

Instagram plug-in

This website uses social plugins (“plugins”) operated by the Instagram social network, features provided by Instagram Inc. based at 1601 Willow Road, Menlo Park, CA 94025, USA. Plugins can be identified by an Instagram logo or are labeled by adding the phrase “Instagram Social Plugin”.

Through the plugin, Instagram is informed about your actions on our page. If you are also logged in to your personal account on the social network at the same time, it can attribute the actions taken on the page to your Instagram account and, by default, to you personally. When you access the plugins, the corresponding information is transferred from your browser to the social network and stored there. Even if you are not a member of Instagram, there is still a possibility that it may obtain and store your IP address.

By clicking on one of these buttons, you agree to the use of this plugin and therefore to the transfer of personal data to Instagram. We have no control over the nature and purpose of this transmitted data and its further processing. Regarding the purpose and extent of data collection, further processing and use of data by Instagram, as well as permissions and settings to protect user privacy, you can refer to Instagram’s privacy policies at: https://help.instagram.com/519522125107875.

If you are a member of Instagram and do not want Instagram to collect your data through the plugin and link it to data already stored on Instagram, you should log out of the social network before visiting this site.

In view of the judgment of 16 July 2020 (Case C-311/18 – Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice has ruled that the protection offered by the EU-US Privacy Shield is not adequate.

The transmission of personal data to the US and other countries outside the European Economic Area (EEA) is therefore based on the European Commission’s Standard Contractual Clauses (SCC). The Commission has issued two sets of Standard Contractual Clauses for data transfers from EU data controllers to data controllers established outside the EU or the European Economic Area (EEA). It has also issued a set of contractual clauses for data transfers from EU data controllers to processors established outside the EU or the EEA. For more information on these clauses, we recommend that you visit https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_ro.

Instagram uses Standard Contractual Clauses as adequate data protection safeguards in line with the level of protection guaranteed by the GDPR.

For more details, visit: https://www.facebook.com/legal/EU_data_transfer_addendum.

Plugins & Tools

YouTube

Our website uses plugins of the YouTube platform, which is operated by Google. The operator is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA.

If you visit a page on our website where a YouTube plug-in has been integrated, a connection to YouTube servers will be created. As a result, the YouTube server will be notified which pages you have visited.

In addition, YouTube will also be able to set different cookies, with the help of which it will be possible to obtain information about visitors to our website. Among other things, this information will be used to generate video statistics in order to improve the usability of the site and prevent fraud attempts.

If you are logged in to your YouTube account while visiting our site, you allow YouTube to host your navigation patterns directly in your personal profile. You have the option to prevent this by logging out of your YouTube account.

Your use of YouTube is based on our interest in presenting your online content in an engaging manner. According to Art. 6 para. 1 lit. f) GDPR, this is a legitimate interest.

In view of the judgment of 16 July 2020 (Case C-311/18 – Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice ruled that the protection offered by the EU-US Privacy Shield is not adequate. Therefore, transmission of personal data to the US and other countries outside the European Economic Area (EEA) should be based on the European Commission’s Standard Contractual Clauses (SCC).

For more information about how YouTube handles user data, see YouTube’s Data Privacy Policy at: https://policies.google.com/privacy?hl=en.

iabilet.ro

According to the Regulation, “in order to maintain security and prevent processing in breach of this Regulation, the controller or processor should assess the risks inherent in the processing and implement measures to mitigate those risks, such as encryption” – Recital 83. Thus the availability of strong and effective encryption is a necessity to guarantee the protection, confidentiality and integrity of personal data.

During the purchase process of products marketed through this website (tickets to the Operator’s events), your bank details are safe.

We use secure encryption methods, data is transmitted via high-security connections to financial units. This means that the data you provide to make payments is not passed on to third parties and does not remain stored in databases.

The purposes of the processing, the data processed, the conditions of their transfer and distribution, ensuring the security of the operations and of the data processed and stored, as well as all other information made available by iabilet.ro, are based on some of the mechanisms for ensuring the lawfulness of the processing, in accordance with the GDPR, namely: the consent of the data subject (Article 6(1)(a)), the performance of a contract (Article 6(1)(b)) and the fulfilment of the legitimate interest of the controller (Article 6(1)(f)).

You have the option to withdraw your consent to the processing of your data at any time. Such revocation has no impact on the effectiveness of data processing transactions that have taken place in the past.

For more details, please visit: https://www.iabilet.ro/privacy/ro/.

Google Web Fonts

This site uses Web Fonts provided by Google to ensure consistent use of fonts on this site.

When you access a page on this website, your browser will, as a result of establishing a connection with Google’s servers, load the web fonts required to display text and fonts correctly. Thus, the use of Google Web Fonts is based on Art. 6 para. 1 lit. f) GDPR, there being a legitimate interest in the uniform presentation of the font on this website. If there is an expressed consent to this (e.g. consent to cookie archiving), the data will be processed solely on the basis of Art. 6 para. 1 lit. a) GDPR.

For more information on how Google Web Fonts handles user data, please see the Privacy Policy available at: https://policies.google.com/privacy?hl=en.

Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter referred to as “reCAPTCHA”) on our website. The provider is Google Inc. located at 1600 Amphitheater Parkway, Mountain View, CA 94043, U.S.A. (“Google”). The purpose of reCAPTCHA is to determine whether data entered on our website (for example, information entered in a contact form) is provided by a human user or by an automated program. To determine this, reCAPTCHA analyzes the behavior of site visitors based on a variety of parameters. This analysis is triggered automatically as soon as the site visitor enters the site. For this analysis, reCAPTCHA evaluates a variety of data (e.g. IP address, time the site visitor has spent on the site or user-initiated cursor movements). The data tracked during these analyses is sent to Google. reCAPTCHA analytics run entirely in the background. Site visitors are not warned that an analysis is in progress. The data is processed on the basis of Art. 6 para. 1 lit. f) GDPR. The website operators have a legitimate interest, to protect the operator’s web content against misuse by automated industrial espionage systems and against SPAM.

In view of the Judgment of 16 July 2020 (pronounced in case C-311/18 – Data Protection Commissioner/Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice ruled that the protection offered by the EU – US Privacy Shield does not have an appropriate character.

Therefore, the transfer of personal data to the USA and other countries outside the European Economic Area (EEA) is based on the Standard Contractual Clauses (SCC) of the European Commission. The Commission has issued two sets of Standard Contractual Clauses for data transfers from EU data controllers to data controllers established outside the EU or the European Economic Area (EEA). It also issued a set of contractual clauses for data transfers of EU operators to processors established outside the EU or EEA. For more information on these Clauses, we recommend that you access https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_ro.

Google reCAPTCHA uses Standard Contractual Clauses as an adequate data protection guarantee, in accordance with the level of protection guaranteed by the GDPR. For more information, see Google’s Data Privacy Statement available here: https://policies.google.com/privacy and here https://policies.google.com/terms?hl=en.

Advertising and Analytics

Google Analytics

This website uses the functions of the web analysis service Google Analytics. The provider of this service is Google Inc., based in the United States of America, 1600 Amphitheater Parkway, Mountain View, CA 94043.

Google Analytics uses so-called cookies. Cookies are text files that are stored on the computer and that allow an analysis of the use of the website by users. The information generated by the cookie about your use of this website is usually transferred to a Google server in the United States, where it is stored.

The storage of Google Analytics cookies and the use of this analysis tool is based on Art. 6 para. 1 lit. f) GDPR. The operator of this website has a legitimate interest in analyzing user patterns in order to optimize both the online services offered and the operator’s advertising activities.

Considering the Judgment of July 16, 2020 (pronounced in case C-311/18 – Data Protection Commissioner/Facebook Ireland Limited, Maximillian Schrems), the European Court of Justice ruled that the protection offered by the EU – US Privacy Shield does not have an appropriate character.

Therefore, the transmission of personal data to the USA and other countries outside the European Economic Area (EEA) is based on the Standard Contractual Clauses (SCC) of the European Commission. The Commission has issued two sets of Standard Contractual Clauses for data transfers from EU data controllers to data controllers established outside the EU or the European Economic Area (EEA). It also issued a set of contractual clauses for data transfers from EU operators to processors established outside the EU or EEA. For more information on these Clauses, we recommend accessing https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_ro.

The transfer of data to the United States of America is based on the Standard Contractual Clauses (SCC) of the European Commission.

IP anonymization

On this site we have activated the IP anonymization function. As a result, the IP address will be abbreviated by Google in the member states of the European Union or in other states that have ratified the Convention on the European Economic Area before it is transmitted to the United States. The full IP will be transmitted to one of Google’s servers in the United States and abbreviated there only in exceptional cases. On behalf of the operator of this website, Google will use this information to analyze your use of this website, to generate reports on website activities and to provide other services to the operator of this website in connection with the use of the website. The IP address transmitted together with Google Analytics from your browser will not be merged with other data held by Google.

Demographic parameters provided by Google Analytics

This site uses the “demographic parameters” function provided by Google Analytics, through which reports are generated that provide information on the age, gender and interests of website visitors. The sources of this information are interest-based advertising generated by Google, as well as visitor data obtained from third-party service providers. This data cannot be assigned to a specific individual. You have the option to deactivate this function at any time by making relevant changes to the advertising settings in your Google account or you can generally prohibit the recording of your data by Google Analytics.

Archiving period

User- or incident-level data stored by Google related to cookies, user IDs or advertising IDs (eg DoubleClick cookies, Android advertising IDs) will be anonymized or deleted after a maximum of 14 months. For details, click on the following link:

https://support.google.com/analytics/topic/2919631?hl=en&ref_topic=1008008.

Conclusion

This policy regarding the processing of personal data is generated in accordance with the provisions of Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, but also with the other applicable national legal provisions.

We reserve the right to make any additions or changes to this policy. We recommend consulting the Policy regularly for correct and up-to-date information regarding the processing of personal data.

For more details regarding this GDPR Policy, as well as to exercise any of the aforementioned rights, a written notification can be sent to the contact details indicated above.

Last update: 14.04.2025