Privacy policy

1. Updates to our privacy policy

This privacy policy ("Privacy Policy") is updated periodically; each time we make a modification, we will display it on our website https://carmistinfoundation.org/ and we will inform you accordingly.

2. Applicability

This Privacy Policy explains how we collect, use and otherwise process your personal data in the course of our business, when you work with us in whatever role, participate in our campaigns or are a beneficiary of them.

This Privacy Policy is aimed at and addressed to the following categories of persons:

a) Donors, volunteers and other partners of the Carmistin Foundation

This category refers to Carmistin Foundation partners who:

support in their own name as donors, volunteers or jurors the work of the Foundation through involvement in its campaigns;
are the representatives of contractual partners with whom the Carmistin Foundation has had or continues to have a contractual relationship for the implementation of its activities and campaigns - e.g. representatives and contact persons from associations and foundations that collaborate with the Carmistin Foundation, representatives and contact persons from suppliers that provide various services or from whom the Carmistin Foundation has purchased various goods or services.

b) Beneficiaries of the Carmistin Foundation campaigns:

This category refers to individuals (adults and minors) who benefit from the services and products resulting from the campaigns that the Carmistin Foundation carries out as part of its activity - e.g. beneficiaries of projects funded by the Carmistin Foundation, beneficiaries of individual donation campaigns, etc..

3. Who are we?

We are Carmistin Foundation. We are part of the Carmistin Group.

In this Privacy Policy:

"Carmistin Group" means the group consisting of legal entities controlled directly or indirectly by Carmistin International S.R.L.
"third" means a person other than us or an entity that processes personal data on our behalf;
"personal data" are personal data as defined in the relevant European and national legislation and are information about an identifiable individual, whether or not in combination with other information. Common examples of personal data processed by the Carmistin Foundation during day-to-day operations include names, addresses, telephone numbers as well as other contact details.

Our headquarters: Sos. Bucuresti - Ploiesti, nr. 172 - 176, Willbrook Platinum Business & Convention Center, Wing A2, 2nd floor, office nr. 88, Sector 1, Bucuresti, Romania. We are registered at the Court of Sector 1 Bucharest, registered in the Register of Associations and Foundations, in the file no. 62814/299/2022, at the registry of the Court of Sector 1 Bucharest.

4. How can you contact us?

Your opinion is important to us - if you have any questions about our Privacy Policy you can:

send us an e-mail to office@carmistinfoundation.org ;
to contact us using our number __________;
submit a written address to the

5. Our principles

The Carmistin Group, and therefore we, are committed to respecting your privacy. We take your privacy, security and compliance with data protection legislation seriously. We aim to ensure that these commitments underpin everything we do.

6. Basics

What personal data do we process?

The categories of personal data we process differ depending on your relationship with us as well as how you interact or have interacted with the Carmistin Foundation. Below is a general list of these categories, noting that the applicable lists for each category of individuals interacting with the Carmistin Foundation is detailed in the following sections:

Identification datafor example: your name, surname, address, copy of your identity document and signature; or
Date of contactfor example, your telephone and/or mobile number, and your e-mail or home address, if applicable;
Financial datae.g. income, information about your bank account;
Qualifications datafor example, education, profession or occupation, CV and professional experience;
Data collected by cookies and technologies For details, please visit our cookie policy at: https://carmistinfoundation.org /cookie-use-policy/
Login details - passwords, hints and similar security information used for authentication and access to platforms applicable to Carmistin Foundation campaigns;

Health data - respectively the data from the medical certificates attesting the type and degree of disabilities required to get involved and to be a beneficiary of the campaigns carried out by the Carmistin Foundation.

6.2. Where do we get your data?

We will collect your personal data:

Direct from , i.e. when you communicate information to us directly (e.g. by filling in a form) or through your interaction with our representatives.

For example, we will obtain your personal information when you: (i) register for a Carmistin Foundation campaign, (ii) apply for our programs, (iii) contact us through various channels, or request information about Carmistin Foundation campaigns and events.

When we receive data directly from you we will assume that it is true, accurate, complete and that it belongs to you or, where applicable, you have the right to use it. We will make every effort to ensure that the data is true, accurate and belongs to you, and if there is any suspicion that you are providing us with incorrect or incomplete data or using someone else's data without authorisation, we will take steps to rectify or stop this. For example, measures may include: updating, supplementing or deleting data, limiting access to data used unlawfully - including deleting accounts associated with data that does not belong to you.

We will also consider the data collected directly from you to be current as long as you have not requested changes through the communication channels mentioned in point 4 of the Privacy Policy or personally updated the data.

Sources other than respectively data obtained from external sources.

External sources from which we can obtain your data include:

Public sourcesfor example, websites or social media pages, public databases (including the Register database

Commerce, Ministry of Finance database, Official Gazette, court portals, etc.);

Third private entitiesFor example, (i) Carmistin partners (associations and foundations or other entities in which you are registered as a volunteer, beneficiary or employee), (ii) our suppliers or contractors (including suppliers of goods or services;
Carmistin Group companies (including entities acquired or controlled by us or the Carmistin Group);
Public authorities or institutionsfor example, in the context of judicial investigations, court requests (in which case they may disclose certain information about you).

If you are a donor, volunteer or other partner of the Foundation Carmistin

We will process the following personal data:

Identification Data - name, surname, and depending on the activity you will carry out we may also process information on your address, copy of your identity document and your signature as appropriate;

Contact Date - your telephone and/or mobile number, and your e-mail address, if applicable;
Data collected by cookies and similar technologies related to the web platforms managed by the Carmistin Foundation that you visit.

For details, please visit our cookie policy at: https://carmistinfoundation.org/politica-de-utilizare-a-cookie-urilor/

Login Data - passwords, hints and similar security information used for authentication and access to the Carmistin Foundation campaign platforms you will use;

Your image - photos, video footage as appropriate;
Details of professional experience - i.e. data from your CV or other qualifications, only to the extent that you will carry out an activity supported by or for the Carmistin Foundation.

We will use your personal data for the following purposes:

Eligibility checks

Prior to your involvement in the Carmistin Foundation project and depending on the specifics of the activity to be carried out, we may carry out certain checks to determine whether you are eligible for involvement in the activity, as follows:

in the case of volunteers or partners who will be involved in projects run by the Carmistin Foundation, it may be necessary to check your CV to verify that you have the skills required for the project;

Legal basis:

the conclusion and execution of the contract with you;
compliance with our legal obligations;
the legitimate interest of the Carmistine Foundation to verify the fulfilment of the necessary criteria for involvement in Carmistin Foundation projects.

7.2. Implementation of activities carried out by Carmistin Foundation - projects, campaigns

Depending on your involvement in Carmistin Foundation projects, we will process your personal data as follows:

in the case of volunteers or partners who will be involved in projects run by Carmistin Foundation, personal data will be processed to allow access to the online platforms on which the project is run and for the development and implementation of the project. Personal data processed for this purpose are contact data, cookie and technology data, login data;

in the case of donors involved in projects run by the Carmistin Foundation, your personal data will be processed to allow access to the platforms where you will be able to make donations or, where appropriate, to complete donations and to communicate with you about them. Thus, the personal data processed for this purpose are contact data, contact data, cookie and technology data, login data;
if you are a contact person or legal representative of a legal entity partner of the Carmistin Foundation, we will process your identification data (e.g. name, surname, occupation/position, signature) in case we need to sign a contract with you and you act as a signatory party. We will also process your contact data (e.g. your telephone number and email) if you have been designated to act as our partner's contact person in relation to us and we may use that data to contact you in relation to any issues relating to our business relationship with you (e.g. payment processing, contract processing, etc.).

Based on this information, the Carmistim Foundation may generate aggregate and statistical management reports that do not identify you individually. The Carmistin Foundation may also retrieve this personal data and anonymize it in order to conduct a more in-depth analysis of the activities carried out.

Legal basis:

the conclusion and execution of the contract with you;
compliance with our legal obligations as a non-governmental organisation;
the legitimate interest of Carmistin to ensure the smooth implementation of the projects you are involved in;
consent to contact you about the work of the Carmistin Foundation and your involvement in our projects.

Marketing

Communications on events organized by the Carmistin Foundation

We would like to use your Contact Details to keep you informed about events and projects run by the Carmistin Foundation team. In this context, we may send you newsletters about our work, events we organise and projects we are about to implement.

We can contact you by:

electronic means of communicationsuch as e-mail or telephone (calls with human operators), and/or
mail (mail or courier services).

Legal basis: we will rely on your permission. to receive such communications.

Inclusion in promotional materials of activities and projects carried out by the Carmistin Foundation

In order to promote the various events organized by the Carmistin Foundation and to implement the various projects it runs, we can process your image (photo or video) and publish it either online or in physical promotional materials - brochures, banners, etc.

Legal basis: we will rely strictly on your permission. for your inclusion in such materials and actions of the Carmistin Foundation.

7.4. Relationship with authorities | Dispute resolution and litigation

We process personal data where it is reasonable to do so to protect against fraud, to defend our rights or property, or to protect the interests of our partners, in the context of potential or existing litigation or disputes in which the Carmistin Foundation may be involved, including any proceedings before any administrative, criminal, arbitral or civil courts or institutions.

As part of these procedures, we may receive or disclose your personal data to third parties (e.g. courts, public authorities, litigants, lawyers) or we may need to disclose your information to comply with our legal obligation to respond to legitimate requests from authorities. Your personal data will only be provided where we believe we have an obligation to do so under the law and following a thorough assessment of all legal requirements.

Legal basis:

legal obligation, where we have an obligation to disclose information, or
legitimate interest, for disclosure of personal data to public authorities in any situation where disclosure is based on a compelling justification and there are no overriding fundamental rights of the data subject (analysis to be carried out on a case-by-case basis). In addition, in the case of disputes or litigation we rely on our legitimate interest to properly resolve disputes and litigation and to defend our rights and interests in such proceedings. Depending on the specific proceedings applicable, we may also be required by law to disclose information (including personal data) to third parties in the context of those proceedings.

7.5. Compliance with specific legal and regulatory requirements

We will also process and communicate your personal data whenever necessary to comply with other requirements of regulations (national or EU) applicable to our case.

Legal basis:

compliance with legal obligations or
the legitimate interest of the Carmistin Foundation to address and manage the relevant legal requirements applicable to us (whenever such legal requirement does not directly require the Carmistin Foundation to process personal data, but the achievement of the purpose involves the processing of your personal data).

8. If you are the beneficiary of a campaign run by the Carmistin Foundation

We will use your personal data for the following purposes:

Eligibility checks

Before your involvement in the Carmistin Foundation's project, we may carry out some checks to see if you are eligible to benefit from our campaigns, as follows:

In the case of individual projects, we will be able to verify the supporting documents you provide us with, including documents attesting to your health status, on the basis of which you apply for support from the Carmistin Foundation;
in the case of other projects run by the Carmistin Foundation, we may also process other personal data necessary for your involvement in the project in question - e.g. data on your address, income, etc.

Legal basis:

the conclusion and execution of the contract with you;
compliance with our legal obligations;
the legitimate interest of Carmistin to verify the fulfilment of the necessary criteria for involvement in Carmistin Foundation projects.

8.2. Implementation of activities carried out by Carmistin Foundation - projects, campaigns

Depending on your role in Carmistin projects, we will process your personal data as follows:

in the case of individual projects run by the Carmistin Foundation, we will use the contact details of
In the case of certain campaigns/projects run by the Carmistin Foundation, we may publish a limited amount of personal data about you on the online platforms necessary to run the campaign;
depending on the specifics of the campaign / project carried out by Carmistin Foundation, we may provide our partners with your limited personal data necessary for the implementation of the project - e.g. identification data, contact details.

Based on this information, the Carmistin Foundation may also generate aggregate and statistical management reports that do not identify you individually. The Carmistin Foundation may also retrieve this personal data and anonymise it in order to carry out a more in-depth analysis of the activities carried out.

Legal basis:

the conclusion and execution of the contract with you;
compliance with our legal obligations as a non-governmental organisation;
the legitimate interest of Carmistin to ensure the smooth implementation of the projects you are involved in;
consent to contact you about the work of the Carmistin Foundation and your involvement in our projects.

Marketing

Communications on events organized by the Carmistin Foundation

We can contact you by:

electronic means of communicationsuch as e-mail or telephone (calls with human operators), and/or
mail (mail or courier services).

Legal basis: we will rely on your permission. to receive such communications.

Inclusion in promotional materials of activities and projects carried out by the Carmistin Foundation

Legal basis: we will rely strictly on your permission. for your inclusion in such materials and actions of the Carmistin Foundation.

8.4. Relationship with authorities | Dispute resolution and litigation

As part of these procedures, we may receive or disclose your personal data to third parties (e.g. courts, public authorities, litigants, lawyers) or we may need to disclose your information to comply with our legal obligation to respond to legitimate requests from authorities. Your personal data will only be provided where we believe we have an obligation to do so by law and after a thorough assessment of all legal requirements.

Legal basis:

legal obligation, where we have an obligation to disclose information, or
legitimate interest, for disclosure of personal data to public authorities in any situation where disclosure is based on a compelling justification and there are no overriding fundamental rights of the data subject (analysis to be carried out on a case-by-case basis). In addition, in the case of disputes or litigation we rely on our legitimate interest to properly resolve disputes and litigation and to defend our rights and interests in such proceedings. Depending on the specific proceedings applicable, we may also be required by law to disclose information (including personal data) to third parties in the context of those proceedings.

8.5. Compliance with specific legal and regulatory requirements

We will also process and disclose your personal data whenever necessary to comply with other regulatory requirements (national or EU) applicable to us.

Legal basis:

compliance with legal obligations or
the legitimate interest of Carmistin to address and manage the relevant legal requirements applicable to Carmistin (whenever such legal requirement does not directly require Carmistin to process personal data, but the achievement of the purpose involves the processing of your personal data).

Marketing

Inclusion in promotional materials of activities and projects carried out by the Carmistin Foundation

In order to promote the various events organized by the Carmistin Foundation and to implement the various projects carried out by the Foundation in which you participate as a collaborator / donor of the Carmistin Foundation, we may process your image (photo or video) and publish it either online or in physical promotional materials - brochures, banners, etc.

Legal basis: we will rely strictly on your permission. for your inclusion in such materials and actions of the Carmistin Foundation.

8.7. Relationship with authorities | Dispute resolution and litigation

As part of these procedures, we may receive or disclose your personal data to third parties (e.g. courts, public authorities, litigants, lawyers) or we may need to disclose your information to comply with our legal obligation to respond to legitimate requests from authorities. Your personal data will only be provided where we believe we have an obligation to do so by law and after a thorough assessment of all legal requirements.

Legal basis:

legal obligation, where we have an obligation to disclose information, or
legitimate interest, for disclosure of personal data to public authorities in any situation where disclosure is based on a compelling justification and there are no overriding fundamental rights of the data subject (analysis to be carried out on a case-by-case basis). In addition, in the case of disputes or litigation we rely on our legitimate interest to properly resolve disputes and litigation and to defend our rights and interests in such proceedings. Depending on the specific proceedings applicable, we may also be required by law to disclose information (including personal data) to third parties in the context of those proceedings.

8.8. Compliance with specific legal and regulatory requirements

We will also process and disclose your personal data whenever necessary to comply with other regulatory requirements (national or EU) applicable to us.

Legal basis:

compliance with legal obligations or
the legitimate interest of Carmistin to address and manage the relevant legal requirements applicable to Carmistin (whenever such legal requirement does not directly require Carmistin to process personal data, but the achievement of the purpose involves the processing of your personal data).

9. How and to whom do we disclose your personal data?

We disclose your personal data authorised persons Carmistin Foundation to process personal data, namely entities that we engage to provide services on our behalf. We have written contracts in place with persons engaged by Carmistin to process personal data whereby they undertake not to take any action in relation to your personal data unless instructed to do so by us. Authorised persons will undertake to keep your personal data secure for the entire period indicated by us.

We may also disclose your personal data to third parties when we are obliged or entitled to do so, acting as independent operators (entities processing data for their own purposes) or, where applicable, entities acting as associated operators with us (in which case we determine with them the purposes and/or means of data processing).

Categories of recipients of your personal data (processors, independent controllers, associated controllers - as appropriate) case), include:

Carmistin Group companies, which supports us in managing our business;
Partners or agents involved in the delivery of products and services that we need to run our business and implement the projects you are involved in;
Companies contracted by us for events/marketing initiatives necessary to promote the work of the Carmistin Foundation;
Public and regulatory authorities, government bodies courts - if necessary, including if required by law or as appropriate, o third party entity or organisation - where such disclosure is necessary to comply with any applicable legal requirements, or other legal or regulatory requirements.

In some situations we have a legal obligation to disclose your information (for example, under a court order or at the request of a regulatory body, including a data protection authority). We may also disclose information with other regulatory bodies to fulfil their powers or our objectives. In any of these situations, we will check that we have a legal basis for disclosing personal data;

Third party consultants (by external lawyers, auditors, experts) in cases where we involve them in litigation or disputes relevant to us or other activities requiring their professional expertise;
Third-party organisations involved in the provision of services related to cookies and similar technologies, as detailed in our Cookie Usage Policy, available here: https://carmistinfoundation.org/politica-de-utilizare-a- cookies/

10. Retention and storage of your personal data

The Carmistin Foundation has implemented policies and rules on the retention of personal data that comply with the principles of retention of data provided for by the legislation on the protection of personal data. Retention periods are reviewed periodically.

In general, we will retain your personal data (1) for the duration of the contract with us or the duration of the project in which you are involved, plus a reasonable period (depending on the circumstances), or (2) for the duration required by law or determined by a public authority under the terms of the law, or (3) in the event of disputes or litigation, until their closure, plus a reasonable period (depending on the circumstances). After the expiry of this period, personal data may be irreversibly destroyed, erased or made anonymous (as appropriate).

If you would like detailed information on Carmistin's data retention rules, you can contact us via the following channels communication mentioned in paragraph 4 of the Privacy Policy.

11. International data transfers

In general, we keep your personal data in our location in Romania.

It may be necessary for the Carmistin Foundation to transfer your data to other companies within the Carmistin Group or to external service providers in countries within the European Economic Area (EEA) as well as outside the EEA. The transfer outside the EEA may take place if our servers (i.e. the ones on which we store the data) or our suppliers and service providers are based outside the EEA or if you use Carmistin services and products while visiting countries outside the EEA.

If the Carmistin Foundation transfers your personal data to a country outside the EEA, we will ensure that your data is adequately protected. As a rule, we will ensure that there is an appropriate legal agreement in place regarding the transfer of data in accordance with the standard contractual clauses approved by the European Commission (https://ec.europa.eu/info/law/law-topic/data- protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en). In addition, if it is considered that the country in question does not have laws that are equivalent to EU data protection standards, the Carmistin Foundation will ask the third party to enter into a legal agreement reflecting these standards. If the transfer will not be based on such an agreement, we will ensure that the transfer is always based on another mechanism provided by law to ensure the protection of your personal data.

Where personal data is transferred to countries outside the EEA, we will attach to this Privacy Policy a list of destination countries. The Carmistin Foundation may periodically update this list whenever there are changes in the way personal data is transferred.

12. Keeping your personal data secure

As part of the Carmistin Group, the Carmistin Foundation benefits from dedicated security teams who are constantly reviewing and improving our measures to protect your personal data from unauthorised access, accidental loss, disclosure or destruction.

Our website may provide links to third party websites. Carmistin assumes no responsibility for the security and content of these third party sites. Therefore, please make sure you read the respective company's policies on privacy and use of cookies before using their site or entering your personal data on that site.

13. Your rights.

Right to rectification of personal data

You have the right to rectify data held about you if it is not correct. If the data we hold about you needs to be updated or if you believe it may be incorrect, please contact us using the contact details at section 4.

Right of access to personal data

You can obtain from us the confirmation that we process your personal data, as well as information on the specifics of the processing such as: purpose, categories of personal data processed, recipients of the data, period for which the data is kept, existence of the right of rectification, erasure or restriction of processing.

You have the right to request a copy of the personal data that the Carmistin Foundation holds about you. To make this request as an individual or authorised third party, please contact us using the contact details at section 4.

Right to data portability

You have the right to receive personal data about you that you have provided to us in a structured, commonly used format that can be read or transmitted to another data controller. To do so, please contact us using the contact details at section 4.

The right to object to the use of personal data

In certain circumstances, you have the right to object to the processing of your personal data by the Carmistin Foundation.

If you no longer wish to receive marketing messages (commercial communications) from Carmistin, you can opt-out of all marketing communications and please contact us using the contact details at section 4.

For Cookie management and better understanding:

Want to disable a cookie or understand more about them? See the Cookie Policy on our website https://carmistinfoundation.org/politica-de-utilizare-a- cookies/ for full details.

To object to other processing carried out on the basis of our legitimate interests: Please contact us using the contact details at section 4.

The right to restrict the use of your personal data

If you believe that the data we hold about you is inaccurate or you believe that we should not process your data, please contact us using the contact details at section 4. In certain circumstances, you will have the right to ask us to restrict processing.

Rights in relation to automated decision-making

You have the right to opt out of the automated decision-making process we use in our business and to request human intervention. To exercise your rights in relation to automated decision-making that may be used by the Carmistin Foundation, please contact us using the contact details at section 4.

Right of erasure

Carmistin Foundation strives to process and store your data only as long as necessary. In certain circumstances, you have the right to ask us to delete the personal data we hold about you. If you feel that we are keeping your data for longer than is necessary, please contact us using the contact details at section 4. Although any contract with you may have ended, we may still have legal grounds for processing your personal data (for further information on retention periods, please see Section 11 Keeping and storing your personal data).

How to make a complaint

If you wish to contact us about any of your rights or to make a complaint about the way we use your personal data, please contact us using the contact details at section 4. We will do our best to help you, but if you still have complaints, you can contact the National Supervisory Authority for Personal Data Processing contact details can be found at www.dataprotection.ro.