Updated on October 8, 2026
Privacy policy
What data we use, why, how long we keep it and what rights you have
This is an English translation for your convenience. The Romanian version is the one that applies: read it in Romanian.
Who is responsible for your data
The controller of your data is Asociația Werdnig Hoffman (the Werdnig Hoffman Association, AWH), tax ID (CIF) 24623073, with its registered office at Str. Progresului nr. 28, Carei, jud. Satu Mare, 445100, Romania. For any question or request about your data, email us at [email protected] or write to us by post at our registered office.
This policy covers the website werdnighoffman.ro: visiting it, the Contact, Get involved and Friendship House forms, Form 230 and donations. Data about project beneficiaries, volunteers under a volunteering contract and employees is covered by separate notices.
What data we use, why and on what legal basis
- 1.
Visiting the website
When you open a page, Cloudflare, our hosting provider, processes your IP address, the date and time, the page requested and technical data about your browser, in order to deliver the page and protect the website from attacks. The legal basis is our legitimate interest in having a secure, functioning website (Article 6(1)(f) GDPR). AWH does not use traffic analytics, does not create profiles and does not keep access logs.
- 2.
The Contact, Get involved and Friendship House forms
Your name, email, phone number (optional), the subject or option you chose and your message. We use them to reply to you and, if you want to get involved, to make the necessary arrangements. The legal basis is your request (Article 6(1)(b)) or our legitimate interest in replying to correspondence (Article 6(1)(f)). Do not send medical data through the forms unless your request requires it.
- 3.
Form 230
Your name, father's initial, personal code (CNP), home address, email, phone number (optional), the two-year option and your signature. We use them to file the form with ANAF (the Romanian tax authority) and to keep the records required by the tax procedure. The legal basis is your request to file the form through us (Article 6(1)(b)) and the Association's legal obligations (Article 6(1)(c)), under Article 123¹ of the Romanian Tax Code and ANAF President's Order no. 103/2025 (the ANAF order on Form 230). If you check the consent box in the form, ANAF may share with us your name, CNP and the amount directed (Article 6(1)(a)), which we use only to keep records of the amounts received.
- 4.
Donations
For a bank transfer, we receive from our bank statement your name and account, the amount, the date and the payment details. For card payment, once it is available: your name, email, the amount, currency and date, the transaction ID and status, any refunds and, for a monthly donation, the details of the authorization; we do not receive your card number or CVV/CVC code. The legal basis is the donation you make (Article 6(1)(b)), our accounting obligations under Law no. 82/1991 (Article 6(1)(c)) and, if you left us your contact details, our legitimate interest in thanking you (Article 6(1)(f)).
- 5.
Requests and complaints
We use the data in refund requests, complaints and requests about personal data to resolve them and to be able to prove what we did (Article 6(1)(c) and (f)).
Required fields are marked. Without them we cannot reply to your message, file Form 230 or process your donation. We do not make decisions based solely on automated processing. Your bank and euPlătesc may run automated fraud checks, which are described in their own privacy notices.
How your data reaches us and who we share it with
The website does not save the data you enter in its forms. When you submit a form, the data travels over an encrypted connection to a Cloudflare service, which immediately forwards it as an email to the Association's inbox, without keeping a copy. You fill in and sign Form 230 in your browser, and we receive the completed PDF. Only the people at AWH who handle your request see your data. We do not sell it or use it for advertising, and we share it only with:
- Cloudflare, Inc., for hosting the website and forwarding the forms, as a processor, under the data processing agreement included in Cloudflare's terms;
- Google Ireland Limited, the provider of the Association's Gmail inbox;
- ANAF, for Form 230 and tax inspections;
- Banca Transilvania, for donations by bank transfer and refunds;
- EuroPayment Services S.R.L. (euPlătesc) and the banks involved in the payment, for card donations, once card payment is available; they process the data as controllers, under their own policies;
- the people who keep the Association's accounts and authorities entitled to it by law, only to the extent necessary.
Cloudflare and Google may also process data outside the European Economic Area, including in the United States. Cloudflare, Inc. and Google LLC are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision, and, where applicable, they use the standard contractual clauses approved by the Commission. We do not publish your CNP, your signature or your form, and we publish donors' names and amounts only with each donor's consent.
How long we keep your data
- Messages from the forms and other correspondence: no more than 12 months after the conversation ends, unless they are needed for a donation, a collaboration or a legal obligation.
- Form 230 submissions and proof of filing: 5 years, counted from July 1 of the year following the last year in which the request takes effect.
- Accounting documents (donations, refunds, sponsorships): 5 years from July 1 of the year following the end of the financial year, under Article 25 of Law no. 82/1991.
- Monthly donation data: for as long as the authorization is active; once the donation is stopped, only the accounting documents remain.
If a tax inspection, a complaint or a legal dispute requires it, we keep the documents needed until it is concluded. When these periods expire, the data is deleted. Technical data about visits is kept only by Cloudflare, according to its own policy.
Cookies
The website does not set cookies or store data in your browser. We do not use traffic analytics, advertising, tracking pixels or embedded social media content: Facebook and Instagram appear only as links. This is why we do not ask for your consent to cookies. Cloudflare may place a technical cookie that is strictly necessary to protect the website, but only when it displays a security check. The euPlătesc payment page, when you use it, has its own cookie policy.
Security
The website works only over encrypted connections (HTTPS), and access to the Association's email inbox and documents is limited to the people who handle them. If an incident affects your data, we will notify the authority and you, where the law requires it.
Your rights
Under Regulation (EU) 2016/679 (GDPR), you have the following rights:
- 1.
Access
You can find out what data we hold about you, where we got it, why we use it and who we have shared it with, and you can get a free copy of it.
- 2.
Rectification
You can ask us to correct inaccurate data and complete incomplete data.
- 3.
Erasure
You can ask us to erase your data, except what the law requires us to keep, such as accounting documents or a Form 230 that has been filed. We will tell you what remains and until when.
- 4.
Restriction
You can ask us to keep your data without using it any further, for example while we check whether it is accurate.
- 5.
Portability
You can receive the data you gave us based on your consent or on a donation in a structured, commonly used format, or ask us to transfer it to another controller, where this is technically possible.
- 6.
Objection
You can object, on grounds relating to your situation, to our use of your data based on our legitimate interest. We will stop, unless we have legitimate grounds that take precedence or we need to defend our rights in court.
- 7.
Withdrawing consent
You can withdraw any consent you have given at any time, without affecting what was done before. For the consent given on Form 230 for ANAF to share your details with us, we will tell you what steps to take with ANAF.
Send your request to [email protected] or by post to our registered office; no particular form is needed. Tell us which right you want to exercise and how we can identify you: the name and email you used and the date of your donation or form. Do not write your CNP in the email and do not send your card details. We reply free of charge within one month; for complex requests this period may be extended by up to two months, in which case we will let you know. If we have reasonable doubts about your identity, we will ask only for the information needed to verify it.
If you believe we have infringed your rights, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), the Romanian data protection authority, at B-dul G-ral. Gheorghe Magheru nr. 28–30, Sector 1, 010336 Bucharest, Romania (dataprotection.ro, [email protected]). You can also go to court.
Updates to this policy
We update this policy when the way we use data changes, and the date of the latest version appears at the top of the page. Before we use data for a new purpose, we will let you know.