Privacy and Personal Data Processing Policy

I.C. Michail Cultural Association — effective as of July 9, 2026

I.C. Michail Cultural Association respects the privacy rights of its visitors and supporters and undertakes to protect the personal data it collects through the website www.icmichail.com. This policy explains what data we collect, for what purposes, on what legal basis, how long we keep it and what rights you have, in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable Romanian law.

1. Data Controller

Name: I.C. Michail Cultural Association

Fiscal identification code: 43995502

Registered office: Amilcar Săndulescu Street, block A36, apt. 2, Craiova, Dolj County, Romania

Email: asociatiaicmichail@gmail.com

Phone: 0729 172 530

For any question regarding the processing of your personal data or the exercise of the rights described below, you may contact us at the email address above.

2. What Data We Collect

2.1 Data collected through the contact form

When you write to us through a contact form on the Website, we collect:

  • first and last name;
  • email address;
  • the content of the message sent and any other data you choose to include in it.

2.2 Data collected when making a donation

Donations made through the Website are processed through a third-party payment processor, Netopia Payments. Payment data (card number, expiry date, CVV code) is entered directly into the payment processor’s platform and is not collected, stored or accessible to the Association, which receives only the confirmation and, where applicable, the data required to issue a receipt/invoice.

In connection with a donation, we may collect:

  • the donor’s first and last name (or company name, for legal entities);
  • email address;
  • the donated amount and the donation date;
  • data required to issue a supporting document (for example address, personal identification number/fiscal code), if requested by the donor or required by law.

2.3 Automatically collected data

When browsing the Website, technical data such as IP address, browser type and version, operating system, visited pages and visit duration may be collected automatically through cookies and similar technologies strictly necessary for the Website to function. We currently do not use analytics or marketing cookies; if this changes, the Website will display a cookie consent banner and this policy will be updated accordingly.

3. Legal Basis and Purposes of Processing

We process your personal data based on the following legal grounds under Article 6 GDPR:

  • your consent (Art. 6(1)(a)) — when you send a message through the contact form or make a donation;
  • performance of pre-contractual measures or an assumed obligation (Art. 6(1)(b)) — for processing the donation and issuing related documents;
  • compliance with a legal obligation (Art. 6(1)(c)) — for example, keeping financial and accounting documents in accordance with tax legislation;
  • the Association’s legitimate interest (Art. 6(1)(f)) — to respond to requests, prevent fraud and ensure the proper operation and security of the Website.

The data is used exclusively to respond to messages received through the contact form, process and confirm donations, issue supporting documents where applicable, comply with legal obligations (accounting, tax) and communicate, upon request, with the Association’s supporters. We do not use your data for automated profiling or automated decisions with legal effects.

4. To Whom We Disclose Data

We do not sell or rent your personal data. We may disclose it to:

  • the payment processor (Netopia Payments), for donation processing;
  • IT/hosting service providers that operate the Website, acting as processors under GDPR-compliant data processing agreements;
  • public authorities, where required by law (for example, tax authorities).

These entities may process data exclusively for the purposes indicated by us and are contractually required to ensure an adequate level of data protection.

5. Data Retention Period

  • Data submitted through the contact form is kept for the time necessary to resolve the request, but no longer than 2 years from the last interaction, unless the law requires another period or you request deletion earlier.
  • Data related to donations and supporting documents is kept for the period required by applicable financial-accounting and tax legislation in Romania (generally 5–10 years, depending on the document type).
  • After the above periods expire, the data is securely deleted or anonymised.

6. Your Rights

As a data subject, under the conditions and limits provided by GDPR, you have the following rights:

  • the right of access to your data (Art. 15);
  • the right to rectification of inaccurate or incomplete data (Art. 16);
  • the right to erasure ("right to be forgotten") in the cases provided by law (Art. 17);
  • the right to restriction of processing (Art. 18);
  • the right to data portability (Art. 20);
  • the right to object to processing based on the Association’s legitimate interest (Art. 21);
  • the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3));
  • the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 General Gheorghe Magheru Blvd., Bucharest, anspdcp@dataprotection.ro.

To exercise any of these rights, you may contact us at the email address indicated in Section 1. We will respond within one month of receiving the request, a period that may be extended by two additional months where necessary, taking into account the complexity and number of requests.

7. Data Security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss, destruction or accidental disclosure, including the use of secure connections (HTTPS) and limiting access to data only to persons within the Association who need it to perform their duties.

8. Transfers Outside the European Economic Area

To the extent that our service providers (for example the payment processor or hosting provider) process data outside the European Economic Area, we ensure that such transfer takes place in compliance with the safeguards provided by GDPR (for example, standard contractual clauses approved by the European Commission or adequacy decisions).

9. Changes to the Privacy Policy

This policy may be updated periodically to reflect legislative changes or changes in how the Website operates. The version in force at any given time is the one published on the Website, with the date of the latest update. We recommend that you consult this page periodically.

10. Contact

For any question regarding this policy or the way we process your data, you may write to us at asociatiaicmichail@gmail.com or call 0729 172 530.