NOTICE on the PERSONAL DATA PROTECTION policy
of natural persons within or affiliated in any way with the organisation
as a beneficiary / potential beneficiary of the services of the Cluj IT Association / Technical University of Cluj-Napoca / Bistrița-Năsăud Chamber of Commerce and Industry / University of Medicine and Pharmacy of Craiova (as applicable), provided free of charge to small and medium-sized enterprises (SMEs), under the DIH4Society 2.0 project, the Digital Innovation Hub for a smarter, safer and more sustainable society.
1. Preamble and general statements
1.1 The undersigned, the Cluj IT Association (Asociația CLUJ IT), a Romanian non-profit legal entity, established on 26 October 2012, with its registered office in Cluj-Napoca, strada Memorandumului nr. 28, telephone 0755-122057, e-mail: contact@clujit.ro, registered in the Register of Associations and Foundations at the Cluj-Napoca Court under no. 174/2012, tax registration code no. 30866506, represented by executive director Kelemen Andrei, hereinafter referred to as “CLUJ IT”,
1.2 In its capacity as a personal data controller, independently or jointly with other controllers, including and mainly of the company to which we provide services under the DIH4Society 2.0 project, the Digital Innovation Hub for a smarter, safer and more sustainable society,
1.3 Considering the nature of some of our association's activities, which require knowledge and processing of personal data of persons within or affiliated in various ways with the company mentioned in Art. 1.2, namely employees, staff, directors, business partners and collaborators of the SMEs, etc.,
1.4 Considering the provisions of personal data protection legislation, in particular the General Data Protection Regulation (Regulation (EU) 2016/679, known as GDPR – the acronym for General Data Protection Regulation) and the rules issued for its application by the competent entities,
1.5 We confirm that we, as an association, and also all the persons involved on our part who have access to or tasks related to organising beneficiaries / participants, whether they are members of the association concerned, of its Board of Directors, volunteers, employees, as well as any other person with whom we collaborate, take particular care to protect personal data relating to natural persons.
1.6 We emphasise that we have these obligations under the GDPR automatically, by operation of law, for an unlimited period, so that it is not necessary to assume express contractual obligations towards you or other persons on this subject, although such obligations are also provided as clauses in the contracts we conclude with other entities such as beneficiaries, funders, various sponsors, suppliers or other contractual partners.
1.7 We declare that, in this respect, we comply with all legal provisions on the protection of personal data in our capacity as controllers or joint controllers of personal data and we implement appropriate technical measures (such as IT security, physical security of our association's premises and communications), legal measures (specific clauses in contracts with suppliers and other entities) and organisational measures (training and vetting of persons, limiting access rights to what is objectively necessary, regulating the way personal data is handled, etc.) designed to ensure the protection of all operations relating directly or indirectly to personal data, in order to prevent unauthorised or unlawful processing, as well as accidental or unlawful loss or destruction of data, regardless of their form and storage medium.
1.8 We confirm that we process personal data in compliance with the principles laid down in Art. 5 of the GDPR, namely: processing characterised by lawfulness, fairness and transparency; with collection only for specified, explicit and legitimate purposes, and only of data that is adequate, relevant and limited to what is necessary, accurate and kept up to date; promptly attributable to the data subject; processing with appropriate technical and organisational measures to guarantee the rights and freedoms of the data subject, ensuring integrity and confidentiality, and all on the basis of accountability.
2. Categories of data subjects
In the context of the DIH4Society 2.0 project, the Digital Innovation Hub for a smarter, safer and more sustainable society, we process, among others, personal data of natural persons who:
- are employees, volunteers or members of the management or control bodies of our association or of our partners or providers / subcontractors within the DIH4Society 2.0 project;
- are employees, staff, directors, business partners and collaborators of SMEs or persons otherwise affiliated with the company benefiting from the services we provide under the DIH4Society 2.0 project.
3. Categories of data processed
Identification data, including surname and first name, citizenship, domicile, personal numeric code (implicitly also the date of birth and thus the age) as well as contact data (email address, telephone);
Photo and video image as well as voice during the activities of the project in which the person takes part;
Data from the identity document and the appearance and characters of the person's handwritten signature;
The place and moment / time interval in which the data subject was present at the place where they interacted with the person representing CLUJ IT in activities of the DIH4Society 2.0 project, because this is personally observed by CLUJ IT staff and possibly also incidentally captured in the photo and video materials produced;
Duties, roles and professional knowledge of which the person representing CLUJ IT becomes aware in activities of the DIH4Society 2.0 project if they interact with the data subject;
Although it does not request or wish to, the controller may also come into possession of other information such as ethnic origin, data on the beneficiary's health at a given moment, data on other persons with whom they live or incidents during the activities observed by CLUJ IT representatives, the religious denomination or philosophical or political beliefs of the beneficiaries or their relatives if they hold informal / non-professional discussions during interactions;
4 Purposes of processing
The purpose is the proper organisation and running of the DIH4Society 2.0 project, which implicitly includes the elements in the project description, which can be read at https://dih4society.ro; as well as indirect or implicit aspects, such as:
- keeping internal records and making available / communicating documents and statistical (anonymised) reports to authorities, partners and funders;
- publicising the activities of the DIH4Society 2.0 project through public communication (on social media and on the funders' website) of anonymised photo and video images that illustrate the running of the activities and implicitly publicly present images in which some persons working for the beneficiary may be recognised by those who know them – the organisers do not “tag” or add captions or other indications regarding the identity of the persons appearing in the images, nor do they publish the nominal list of the persons who were working within / on behalf of the beneficiary company;
- recovering any damage caused by data subjects in the activities of the project;
- fulfilling the legal obligations to keep various records on the beneficiaries of the organising association.
- verifying eligibility for state aid, concluding and performing the contract, reporting to MIPE – AM PoCIDIF and ADR – OIPSI, including through MySMIS2021 and RegAS, to the European Commission, as well as publishing the list of beneficiaries (Art. 49 para. (3) of Regulation (EU) 2021/1060)
5. Duration of processing
5.1 Personal data will be processed only for the period for which the type of processing concerned is justified, in accordance with the GDPR, a period that is specific to each category of personal data and depends on the purpose and basis of the processing.
5.2 The specific duration is set in accordance with the legal and regulatory requirements on keeping specific records. This duration includes the duration of the specific consultancy or related activities of the DIH4Society 2.0 project itself but also that which precedes it, starting from the beneficiary's registration and continuing after the completion of the activities for at least the limitation period – as a rule three years – for any claims arising from civil legal acts or facts or legal rules or the alleged commission / suffering of acts classified by law as contraventions or offences, which one of the parties, the third parties involved or the competent public authorities could raise.
5.3 By exception, the documents relating to the granting of state aid (the request for services, the statements on own responsibility, the contract, the documents for verifying eligibility and for receiving the services) and the personal data contained therein are kept for at least 10 years from the date of granting the last aid under the Scheme (Art. 18 of the State Aid and De Minimis Aid Scheme), or for the period provided for in Art. 82 of Regulation (EU) 2021/1060 and Art. 31 of GEO No 133/2021, whichever of these periods expires last.
6. Fate of the data when processing ends
6.1 We periodically review the data collected, analysing to what extent keeping it is still necessary for the purposes mentioned above and for your interests, ceasing the processing of data for which keeping is no longer required.
6.2 At the end of the processing period, the information and the document in question incorporating the personal data is destroyed or anonymised, as the case may be.
7. Legal basis for processing
7.1 The legal basis for the processing of your personal data that we carry out is, as a rule, that of concluding and performing the contract (Art. 6(1)(b) GDPR) – participation in the DIH4Society 2.0 project as a person within or affiliated in any way with the beneficiary to which we provide services in this project being legally classifiable as a contract, even if it does not involve financial obligations for the beneficiary and even less for its staff.
7.2 For verifying eligibility for state aid, reporting to MIPE – AM PoCIDIF and ADR – OIPSI, registration in MySMIS2021 and RegAS, keeping documents and publishing the information provided for by law, the legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR), in conjunction with Regulation (EU) 2021/1060, GEO No 77/2014 and GEO No 133/2021. In other situations, the legal basis may be the legitimate interest of the organisers (Art. 6(1)(f) GDPR).
7.3 Only exceptionally do we process personal data on the basis of consent (Art. 6(1)(a) GDPR) – photographs or images in which the data subject is in the foreground or an important subject of the image, or audio recordings of them or transcripts or reproductions of text written or expressed by them, in which case their express consent will be requested.
8. Recipients
8.1 We disclose the personal data we hold, directly or indirectly, to persons other than those concerned, but exclusively in the interest of the data subjects, in the legitimate interest of the association, of the institution in which the data subject works / with which they are affiliated in any way, or in cases expressly provided for by law, such as reporting required by public funders and certain authorities, or providers who implicitly come into possession of the data but have confidentiality obligations.
8.2 Thus, personal data of beneficiaries reaches the staff of CLUJ IT and collaborators or persons in the management and control bodies of CLUJ IT or of the partners working in the DIH4Society 2.0 project. It also implicitly comes to the knowledge of the organisers' IT and communications (ICT) service providers, such as network administration and IT service providers, Internet connection and fixed and mobile telephone service providers, and the operators of IT platforms used by the organisers online or offline.
8.3 Such services and digital platforms may be LinkedIn, Facebook, Instagram, Whatsapp, WordPress, MailChimp, Zoom, Google Workspace, Microsoft Office, Vodafone – with their owners – the companies Meta Platforms Inc, Alphabet Inc / Google Inc, Microsoft Corporation and others, including their subsidiaries through which they hold the various online services mentioned above.
8.4 With these providers mentioned in Art. 8.2 and 8.3, the organisers either have appropriate negotiated confidentiality contractual clauses, or the processing of personal data is carried out by those large providers in accordance with their internal policy published on their own websites, which acts as an adhesion contract that complies with the GDPR requirements because either they keep the data of persons resident in the European Union only on servers in the EU or in countries for which the European Commission has issued decisions recognising an equivalent level of protection, or those companies, mostly headquartered outside the EU, have ensured, formally at least, compliance with the GDPR requirements by adhering to “standard contractual clauses” or “binding corporate rules” or special bilateral instruments (such as the one between the EU and the US) approved by the European Commission and by the European Data Protection Board (EDPB), respectively.
8.5 We specify that the personal data probably collected by these platforms is not accessible to the organisers or to entities authorised by them as personal data, but only possibly in aggregated and anonymised format, the organisers not using intrusive software to analyse connections to the websites used in the DIH4Society 2.0 project, such as collecting IP addresses or other data about the general online behaviour of the person connecting.
8.6 We note that to the public, through social media, we disseminate only anonymised or approximate data that does not allow the exact identification of the data subjects. To funders and the competent authorities (MIPE – AM PoCIDIF, ADR – OIPSI, the Competition Council – through RegAS, the European Commission, audit and control bodies) we transmit the data necessary for verifying eligibility, monitoring and reporting state aid, and the data of the beneficiary undertaking and of the aid granted may be published in accordance with Art. 49 para. (3) of Regulation (EU) 2021/1060 and state aid legislation.
9. Rights of data subjects
9.1 We remind the persons concerned by processing carried out by us, including the mere storage, of their personal data that, by operation of law, they benefit from a series of rights, which include the right to be informed (to know whether we process their data) and the right of access (to that data and to information such as the categories of data, the source, the purpose, the legal basis, the recipients / categories of recipients, the processing period, the actual rights they have in relation to the data / processing), the right to object (to processing based on public interest or the legitimate interest of the controller), the right to rectification (correction and completion of erroneous / inaccurate or incomplete data), and, under certain conditions, also the right to data portability, the right to temporary restriction of processing and even the right to erasure of data (a right limited in relation to the legitimate interest of the association).
9.2 The exercise of these rights is carried out in accordance with the organiser's internal GDPR procedures, part of / assimilated to their Internal Regulations.
9.3 Any requests related to the GDPR and the rights it confers on data subjects shall be addressed to the e-mail address: gdpr@clujit.ro, placing the acronym “GDPR” at the beginning of the “subject” field of the e-mail.
10. Special clarifications
10.1 We do not subject personal data to automated processing nor do we use it to create profiles, much less for automated decision-making concerning a natural person. We do not process personal data for secondary purposes incompatible with the purposes for which we collected it, nor do we transfer it to third parties either for direct marketing or for any other such purpose.
10.2 We use procedures, equipment, software and other technical and organisational means to store data under appropriate security conditions and we strictly respect confidentiality, disclosing personal data only for the pursuit of your interests or the fulfilment of specific legal obligations.
10.3 If we do not resolve a request sent in accordance with point 9.3 to your satisfaction, you are entitled to contact the competent state authority (ANSPDCP www.dataprotection.ro), as well as the courts directly.
text version October 2026
