Privacy Policy

Executive Summary

This policy explains how Open Fields Foundation collects, uses, stores, and protects the personal data of visitors, donors, sponsors, volunteers, and event participants. All processing complies with Regulation (EU) 2016/679 (GDPR), Law 190/2018, and Law 506/2004 on the confidentiality of electronic communications.

Date: [November 07, 2025]  Version: [2]

1. Data Collected (Donors, Sponsors, Volunteers, Participants)

Open Fields Foundation collects only the data strictly necessary for its legitimate and nonprofit purposes.

Category of Individuals | Types of Data Collected | Main Purpose

Donors | name, email, phone, donated amount, transaction date | donation processing and confirmation

Sponsors | company name, tax ID, address, legal representative, sponsorship amount | sponsorship contract execution

Volunteers | first and last name, email, phone, age, preferred activity | volunteer activity management

Project Beneficiaries | name, age, locality, social situation (if applicable) | implementation of educational and social programs

Event Participants | name, email, ticket payment, contact details | registration and event management

Automatically collected technical data includes: IP address, device type, operating system, and functional cookies, in accordance with the Cookie Policy.

2. Purposes and Legal Bases

Open Fields Foundation processes data only for specific, legitimate, and transparent purposes.

Purpose | Legal Basis

Processing donations and sponsorships | contract execution or consent

Issuing fiscal documents | legal obligation (Fiscal Code)

Communication with volunteers and participants | legitimate interest

Sending news and invitations | explicit consent

Compliance with legal obligations and reporting to authorities | legal obligation

Consent can be withdrawn at any time without affecting the legality of prior processing.

3. Data Retention Periods

Data are stored only for the period necessary to fulfill the purpose for which they were collected:

Data Type | Retention Period

Donations and sponsorships data | 10 years (according to accounting legislation)

Volunteer data | 3 years from the last activity

Event participant data | 1 year from event completion

Newsletter data | until consent withdrawal

Technical logs | 12 months

After expiration, data are deleted or anonymized.

4. Recipients and Data Processors

Data may be shared only with Open Fields Foundation’s contractual partners, strictly for declared purposes:

  • Banca Transilvania (payment processing via iPay) – Banca Transilvania S.A., CUI RO5022670, headquartered in Cluj-Napoca, 30–36 Calea Dorobanților Street, Romania, registered with the Trade Register under no. J12/4155/1993.
  • Google Ireland Limited (Google Analytics and Ads, if enabled)
  • Hosting service provider: Hosterion SRL, CUI RO16104008, 21 Gării Street, Building C, 1st Floor.

All partners act as data processors and comply with Article 28 of the GDPR.

5. Data Transfers Outside the EEA

If technical providers process data outside the European Economic Area, such transfers are based on the European Commission’s approved Standard Contractual Clauses.

6. Data Subject Rights

Individuals whose data are processed may exercise the following rights:

  • access to their data,
  • rectification,
  • erasure (‘right to be forgotten’),
  • restriction of processing,
  • data portability,
  • objection to processing,
  • withdrawal of consent.

Requests should be sent to: [andreea@openfields.ro]. The Foundation will respond within 30 calendar days.

7. Data of Minors

Open Fields Foundation does not intentionally collect data from minors under 16 years old without the consent of a parent or legal guardian. If such processing is identified, the data will be deleted immediately.

8. Profiling and Automated Decisions

Open Fields Foundation does not perform automated decision-making processes that produce legal effects on data subjects. Anonymous statistical analyses (e.g., Google Analytics) are used only to improve user experience.

9. Data Protection Officer (DPO) Contact

The Data Protection Officer (DPO) of Open Fields Foundation is responsible for managing all requests regarding data processing.

Name: DAVID ANDREEA HELENA

Email: andreea@openfields.ro

Mailing Address: Cluj-Napoca, Cluj County, 19 Mihai Românul Street

Annexes (GDPR Request Forms)

  • Data access request form.
  • Data deletion request form.
  • Consent withdrawal form.
  • Link to the National Supervisory Authority for Personal Data Processing: https://www.dataprotection.ro.