Asociația Binele Există

Privacy policy

Last updated: 28 October 2025

PRIVACY POLICY / PROCESSING OF PERSONAL DATA

The protection of personal data is mandatory under European (GDPR) and national law. This Privacy Policy explains what data the Binele Există Association collects, why it collects it, the legal basis for using it and your rights in relation to it.

Asociația Binele Există, with its registered office in Brașov County, Str. Carpaților 22, building 2, entrance A, apartment 33, tax identification number (CUI) 47487167, acts as the controller of personal data for www.bineleexista.ro and for the humanitarian, social and charitable activities it carries out.

You can contact us with any questions about data protection at: binele.exista@gmail.com.

1. WHAT PERSONAL DATA IS

Personal data means any information that identifies or can identify an individual. Examples include:

first and last name;
email address and telephone number;
postal address (for example, when volunteers deliver material assistance to your home);
financial data relating to a donation/sponsorship (e.g. amounts donated and transactions);
medical or social circumstances publicly described in humanitarian campaigns, where the beneficiary or legal representative has given consent;
photos/videos taken during humanitarian activities (such as food distributions), where the people shown and/or the legal representatives of minors have given consent;
your IP address and other technical information generated by your device when you visit www.bineleexista.ro;
any other data you voluntarily send us through forms, email or messages.

Processing personal data means any operation performed on such data: collection, recording, storage, organisation, use, disclosure to third parties where legally necessary, archiving, deletion, anonymisation and so on.

2. HOW WE COLLECT DATA

We collect your personal data in several ways:

2.1. When you use www.bineleexista.ro

when you complete a contact form, a request for assistance or a volunteer application;
when you make a donation through the platform (for example, by card);
when you subscribe to communications from the Association (such as newsletters or campaign updates);
when you write to us directly by email or through our official social media channels.

2.2. Traffic and technical usage data

When you access www.bineleexista.ro, the server may automatically record:

your IP address and the date and time of access;
the pages you visit on the website;
your device and browser type;
your approximate location (e.g. city) based on your IP address.

This information is used solely to secure the website, prevent abuse and improve how we present our campaigns.

2.3. Cookies

The website may use cookies (session and/or persistent cookies) to:

remember your preferences (such as language);
measure traffic and interaction with pages (e.g. Google Analytics);
limit repeated displays of the same banners/messages.

You can restrict cookies in your browser settings. Some website features may be limited if you disable essential cookies.

2.4. Direct interactions with the Association

when you request help from the Association as a potential beneficiary;
when you become a beneficiary, volunteer, collaborator or partner;
in accounting and legal matters (e.g. sponsorship agreements, donation receipts and tax reports).

2.5. Charitable events and activities

During humanitarian activities (such as food distributions, fundraising or public campaigns), photos/videos may be processed for transparency and reporting to donors. They are published online (on the website or social media) only with the consent of the person concerned or their legal representative.

3. TYPICAL SITUATIONS IN WHICH WE REQUEST DATA

3.1. When you make a donation

To process a donation (e.g. an online card donation), we may request your first and last name, email address, possibly your telephone number and, sometimes, a billing/tax address, particularly for donations by legal entities or for issuing accounting documents.

Financial data (such as card details) is not stored by the Association; it is handled by the secure payment processor (such as Netopia Payments or a bank).
Transaction data and accounting documents must be retained in accordance with tax law.

3.2. When you request help

If you ask us for support for yourself or someone close to you, we may request sensitive personal information, such as medical, financial or family circumstances. This information:

is used to assess whether and how we can help;
may be made partly public on the website as part of a fundraising campaign, only with the written consent of the person concerned or their legal representative (e.g. parent or guardian);
may be shared with our partners (such as clinics, pharmacies or medical equipment suppliers) where necessary to pay directly for treatment or a service.

3.3. When you subscribe to updates (newsletters/case news)

We request your email address to send you information about campaigns, urgent situations and reports on how funds are used. You can withdraw your consent at any time; after withdrawal, you will no longer receive these communications.

3.4. When you apply to volunteer or collaborate

We may request contact details (name, telephone number and email) and, where necessary, a copy of an identity document or other minimum verification information, for example when volunteers enter vulnerable beneficiaries’ homes or transport donated goods.

4. PURPOSES FOR WHICH WE PROCESS DATA

The Binele Există Association processes your personal data for the following legitimate purposes:

processing donations and complying with accounting/tax obligations relating to donations and sponsorships;
verifying and managing the social, humanitarian and medical cases we present publicly for fundraising;
communicating with donors (reports, thank-you messages and case updates);
communicating with beneficiaries/potential beneficiaries to assess needs and provide support;
organising volunteer activities and logistics (transporting donations, purchasing goods and so on);
public transparency activities (publishing beneficiaries’ actual circumstances, funds raised and payments made), only within the scope of the consent given by those involved;
improving website functionality, cybersecurity and fraud prevention;
complying with the Association’s legal obligations (requests from tax authorities, supervisory authorities and so on).

Certain data is also used for internal statistics, internal audits, legal documentation and archiving, insofar as this is required by law or necessary to protect the Association’s legitimate interests.

5. LEGAL BASIS FOR PROCESSING

Under Regulation (EU) 2016/679 (GDPR), data is processed on one or more legal bases, as applicable:

Your explicit consent (Article 6(1)(a) GDPR) – for example, when you agree to have your medical/social story published on the website or subscribe to the newsletter;
Performance of a contract or steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) – for example, when you request help and we need to communicate with you and formally manage donations intended for you;
Legal obligation (Article 6(1)(c) GDPR) – for example, retaining accounting documents relating to donations, sponsorships and payments to medical providers, and reporting to tax authorities;
Legitimate interest (Article 6(1)(f) GDPR) – for example, website security, fraud prevention, defending the Association in potential disputes, retaining evidence of how donated funds are used and informing donors about campaign outcomes.

For sensitive data, such as medical information, we rely on the data subject’s consent or other grounds permitted by the GDPR for processing health data (Article 9 GDPR), only to the extent strictly necessary to conduct the humanitarian campaign.

6. IS PROVIDING DATA MANDATORY?

In some situations, yes.

If you wish to donate through the Association’s official channels, certain data is required to process the payment and maintain accounting records. If you refuse to provide this minimum information, we may be unable to process your donation.

If you request support as a beneficiary but refuse to provide relevant information, such as medical documents or basic financial details, we may be unable to assess your case or run a campaign for you.

Providing data for marketing communications/newsletters is optional. You may withdraw your consent at any time.

7. WHO MAY RECEIVE YOUR DATA (RECIPIENTS)

Where necessary, personal data may be accessed or received only by persons/entities bound by confidentiality or legally entitled to it:

Association members, staff, volunteers and collaborators managing your case or donation;
online/banking payment processors involved in transactions (e.g. card processors and banks);
service providers (accounting, IT/website maintenance, lawyers and auditors), only to the extent strictly necessary to provide their services to the Association;
public authorities where we are legally required to provide certain information (e.g. tax matters or fraud prevention);
medical facilities, medical service providers and pharmacies where the Association pays directly for a beneficiary’s treatment or medical services, with the beneficiary’s consent;
other partner NGOs when we direct support to them and the person concerned has consented.

In some situations, storing/transferring data may involve servers in other EU countries or, occasionally, outside the EU/EEA. For transfers outside the EU/EEA, we will take reasonable steps to ensure that appropriate safeguards, such as standard contractual clauses, are in place in accordance with the GDPR.

Data is retained for as long as necessary for the purpose for which it was collected or as required by law. For example:

accounting and tax documents relating to donations and payments must generally be retained for 10 years;
other contractual or supporting documents may be retained for 3 years or for the applicable limitation periods to protect the Association’s legitimate interests.

8. DATA SECURITY

We take data protection seriously. We implement reasonable technical and organisational measures to prevent unauthorised access, loss, alteration or unauthorised disclosure of personal data.

Depending on the context, these measures include:

internal access controls (only authorised people can view certain sensitive information);
passwords and secure authentication for accounts used to manage donations and cases;
logging internal operations (who accessed data and when);
limiting the printing or distribution of documents containing sensitive data;
IT security measures (firewalls, encrypted transmissions where possible and monitoring for suspicious activity).

9. YOUR RIGHTS AS A DATA SUBJECT

Under the GDPR, you have the following rights in relation to your personal data:

Right to be informed – to know what data we collect, why and how we use it (Articles 13 and 14 GDPR).
Right of access – you may request confirmation that we process your data and, if so, a copy of it (Article 15 GDPR).
Right to rectification – you may request that inaccurate data be corrected or incomplete data completed (Article 16 GDPR).
Right to erasure (right to be forgotten) – you may request the deletion of your data (Article 17 GDPR), within the limits permitted by law. In some situations, we cannot delete it immediately, for example because of accounting/tax obligations.
Right to restriction of processing – you may request that we limit how we use your data without deleting it (Article 18 GDPR).
Right to data portability – where this right applies, you may request that the data you provided be sent to you or another controller in a structured, commonly used and machine-readable format (Article 20 GDPR).
Right to object – you may object to certain types of processing, including the use of your data for direct communications/marketing.
Right to withdraw consent – where consent is the legal basis (e.g. newsletters or publishing your image), you may withdraw it at any time, and we will stop that processing.
Right to lodge a complaint – if you believe your rights have been infringed, you may contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or the competent courts in Romania.

To exercise any of the above rights, you can email us at binele.exista@gmail.com. To protect personal data, we may ask for reasonable proof of identity before responding.

10. CHANGES TO THE PRIVACY POLICY

We may update this Privacy Policy to reflect legislative or operational changes, such as new fundraising methods, tax obligations or medical partnerships.

The current version will always be available on www.bineleexista.ro. Continuing to use the website or work with the Association after changes are published constitutes acceptance of those changes.

This policy applies to all categories of people affected by the Binele Există Association’s activities: donors, beneficiaries, potential beneficiaries, volunteers, collaborators and website users.