Privacy policy.

This English version is provided for convenience. The Romanian version of this policy is the reference text.

1. Who we are (the data controller)

The Romanian Smart City Association (Asociația Română pentru Smart City, "ARSC", "we") is the controller of the personal data we process through this website (arsc.ro) and the subdomains run by ARSC.

• Registered office: Bd. Pipera nr. 1-IA, Integral Business Center, Voluntari, Ilfov County, Romania
• Email: [email protected]
• Phone: +40 31 425 42 63
• Website: arsc.ro

For any request about the protection of your personal data, write to [email protected] with the subject "GDPR request".

2. What data we collect and where from

2.1. Data you send us directly

• Contact form (/contact/): name, email address, phone (optional), subject, message.
• Newsletter subscription: email address and first name (optional).
• Membership application (/inscrie-te/, /programe/): name, organisation, position, email, phone, a short statement of motivation.
• Direct communication by email, phone or in meetings: any data you choose to give us.

2.2. Data collected automatically when you visit the site

• Minimal technical data (server logs): IP address, user agent, page visited, time of the request. This data is needed for the site to work and for security (preventing attacks).
• Aggregated analytics data (a web measurement tool, with Consent Mode v2): pages viewed, duration, device, traffic source. This data is NOT collected until you have clicked "Accept" on the cookie banner. Before you accept, only aggregated pings without cookies (cookieless pings) are sent, which do not allow anyone to be identified.
• Technical local storage (localStorage): your choice on the cookie banner is stored locally in your browser under the key arsc-cookies-v1. It is not an HTTP cookie and is not sent to the server.

3. Why we use this data (purposes and legal basis)

Purpose	Data used	Legal basis (Art. 6 GDPR)
To reply to your contact messages	Name, email, phone, message	Our legitimate interest in communicating with people who contact us (Art. 6(1)(f))
To send you the weekly newsletter	Email, first name	Your explicit consent when subscribing (Art. 6(1)(a))
To process your membership application	Name, organisation, position, contact details	Pre-contractual steps and performance of the membership contract (Art. 6(1)(b))
To measure how the site is used (web analytics)	Anonymised analytics data	Your consent (clicking "Accept" on the banner, Art. 6(1)(a))
Site security and abuse prevention	IP, user agent, server logs	ARSC's legitimate interest in protecting its infrastructure (Art. 6(1)(f))
Compliance with legal obligations (accounting, tax)	Data from invoices / membership contracts	Legal obligation (Art. 6(1)(c))

4. Who we share data with

We do NOT sell or rent your data to anyone. We use third-party providers for website hosting, email services, analytics and the newsletter, all working under data processing agreements in line with Art. 28 GDPR. Where data is transferred outside the European Economic Area, the transfer is protected by mechanisms approved by the European Commission (in particular the EU-US Data Privacy Framework, approved since July 2023).

We may also disclose data to public authorities where there is an express legal obligation (a reasoned official request).

5. How long we keep the data

• Contact form messages: 24 months from receipt, then deleted automatically (exception: if the message has turned into a contractual collaboration, we keep it for the length of the contract plus the legal limitation period).
• Newsletter subscription: for as long as you are subscribed. You can unsubscribe at any time using the link at the end of every email; after you unsubscribe, the data is deleted within 30 days at most.
• ARSC member data: for the duration of membership plus 10 years after it ends (a legal accounting obligation).
• Technical server logs: 30 days at most (for security, in line with the hosting provider's policy).
• Web analytics data: 14 months (the shortest setting available), then automatically anonymised.

6. Cookies and similar technologies

We use a minimal set of local storage technologies, grouped by category:

Category	What it does	Consent needed?
Strictly necessary	localStorage arsc-cookies-v1 = remembers your choice on the banner (Accept or Decline)	No - it is essential for the banner to work
Analytics	A web traffic measurement tool (cookies such as _ga, _ga_*) - sees pages visited and the traffic source, anonymised	Yes - loaded ONLY after you accept
Advertising	We do not use advertising or retargeting cookies	-

To change your choice: delete the localStorage key arsc-cookies-v1 in your browser's DevTools (F12 → Application → Local Storage → arsc.ro → Delete), then reload the page and the banner appears again.

Some pages may load external content (for example maps, video or forms). These resources come from third-party providers that may set their own cookies when you interact with them. See their privacy policies for details.

7. Your rights (GDPR)

Wherever you are in the EU, you have the following rights regarding the personal data we process about you:

• Right of access (Art. 15): to ask for a copy of the data we hold about you.
• Right to rectification (Art. 16): to correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17): to ask for your data to be deleted, under the conditions set by law.
• Right to restriction of processing (Art. 18): to temporarily block the processing of your data in certain situations.
• Right to data portability (Art. 20): to receive your data in a structured, machine-readable format.
• Right to object (Art. 21): to object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) - at any time, without retroactive effect. For the newsletter: the unsubscribe link in every email. For analytics: delete the localStorage key arsc-cookies-v1 and make your choice again.
• Right to lodge a complaint with the supervisory authority - in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, [email protected].

8. How to exercise your rights

The simplest way: send us an email at [email protected] with the subject "GDPR request", stating:

1. Which right you are exercising (access, erasure, rectification and so on);
2. Your identification details (name, the email you used with us);
3. Proof of identity if the request concerns sensitive data (an identity card, only if strictly necessary; you may partly cover it, as we only need the name and photo).

We reply within 30 calendar days at most (Art. 12(3) GDPR). If the request is complex, we may extend this by a further 2 months, letting you know.

Exercising your rights is free of charge. Only where requests are manifestly unfounded or excessive (repeated) may we charge a reasonable fee or refuse the request.

9. Data security

We use reasonable technical and organisational measures to protect the data:

• The site runs over HTTPS only (TLS 1.2+), with HSTS preload active.
• A strict Content Security Policy (CSP) against unauthorised third-party scripts.
• Access to administrative data is restricted to ARSC staff, with individual authentication.
• Regular backups of public content; logs are kept only for as long as strictly necessary.

No system is perfect. If you suspect a security problem, write to us at [email protected] and we will investigate promptly.

10. Children's data

Our site is not aimed at children under 16 and we do not knowingly collect data about them. If you find out that a child has given us data, write to us and we will delete it.

11. Changes to this policy

We may update this policy as our services or the law change. Changes take effect on the date they are published. Previous versions are not publicly archived; if you need the version in force at a particular time, write to us.

Last updated: 20 May 2026.

12. Contact

Romanian Smart City Association (Asociația Română pentru Smart City)
Bd. Pipera nr. 1-IA, Integral Business Center
Voluntari, Ilfov County, Romania
Email: [email protected]
Phone: +40 31 425 42 63