Privacy policy

The controller is Fundația Cultural Umanitară SO.SI.SE.SA., tax ID (CIF) 10837549, registered office at Str. Drumul Gării nr. 21, Sector 6, Bucharest, Romania.

For any question about your data: office@sosisesa.ro, phone +40 762 570 086, or by post to Str. Thomas Masaryk nr. 1, sc. A, et. 1, Sector 2, Bucharest.

When you donate, we record the amount, currency, frequency (one-time or recurring), the cause and options you chose (such as covering the fee) and the payment identifier from the processor. You enter your name and email address on the Stripe or PayPal page; they stay with the processor, and the foundation sees them in its payment account. If you donate while signed in to the donor account, the donation is linked to your account. We use this data to record the donation, confirm your payment, manage monthly giving and keep the accounts.

Card and PayPal account details never reach us. Payments are processed by Stripe or PayPal on their own pages and systems.

You can give monthly without a donor account. The “Stop a monthly donation” page shows how to stop it: through Stripe, in your PayPal account or by writing to us; in that last case we reply to the address used to pay before stopping it.

If you dedicate a donation in memory or in honour of someone, we keep that person’s name and your short message, if any, to create the PDF card you download. We do not contact the person or their family and do not publish the name.

Legal basis: carrying out the donation you make (Art. 6(1)(b) GDPR) and the foundation’s accounting and tax obligations (Art. 6(1)(c)).

You sign in with your email address: we send you a link valid for 15 minutes, which works only in the browser you requested it from. We keep your email address as the account identifier. A session lasts at most 30 days or until you sign out.

The account shows only the donations linked to it: those made while you are signed in, and those made before signing in, in the same browser tab, that you choose to link to the account within 30 days of donating. We do not link a donation to the account just because it was paid with the same email address.

From the account you can change or stop monthly giving, book event tickets and join the Supporter circle. If you save a card for quick donations, its details stay with Stripe; we keep only a reference to the card and show you its type, last four digits and expiry date.

Legal basis: providing the service you requested (Art. 6(1)(b)).

The form needs your name, personal numeric code (CNP), address and signature. Your father’s initial, phone and email are optional. We use them only to file your request with ANAF and to contact you about it.

The data is encrypted on the server. Only designated administrators of the foundation can see it, and every access is logged. We send it to ANAF in the statement the foundation files by 25 May.

Legal basis: filing the request you entrust to us (Art. 6(1)(b)), under the Romanian Fiscal Code and the ANAF procedure approved by OPANAF 103/2025, which require this data (Art. 6(1)(c)).

Through the volunteering, goods donation, company partnership, Christmas letter and contact forms you send us your name, email, optionally your phone number, organisation and message. We use them to reply and agree the next steps with you.

Legal basis: steps you asked us to take (Art. 6(1)(b)) and our legitimate interest in answering requests (Art. 6(1)(f)).

If you subscribe to our newsletter, we keep your email address, chosen language and the dates you subscribed, confirmed and unsubscribed. We subscribe you only after you confirm from the email we send (the link is valid for 48 hours). Every message has an unsubscribe link.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing.

The assistant answers automatically, using an artificial intelligence model from OpenAI. Your question is sent to OpenAI in the United States together with the foundation’s public information. We do not save the conversation on our server, and requests are made with storage turned off.

Under OpenAI’s API policy, the data is not used to train models but may be kept by OpenAI for up to 30 days to prevent abuse. Please do not write personal details in the assistant; messages that appear to contain an email address or card number are not sent.

Legal basis: our legitimate interest in answering questions about the foundation quickly (Art. 6(1)(f)). Using the assistant is optional.

Forms are protected by Cloudflare Turnstile, which checks automatically that you are a person and not a program. To limit abuse, we count requests per IP address, which we transform irreversibly; these counters expire after at most one day.

The server that carries the website’s traffic keeps technical logs (time, page requested, response) for 30 days, with the IP address truncated and without cookies or browser identifiers.

Legal basis: our legitimate interest in protecting the website, donors and their data (Art. 6(1)(f)).

To know how many people reach the website’s pages we use Cloudflare Web Analytics. It uses no cookies and stores nothing in your browser. We only see totals: pages visited, country, device and browser type, the referring site and load times, without being able to identify you.

Legal basis: our legitimate interest in understanding which pages are used and improving the website (Art. 6(1)(f)).

Some providers process data in the United States. Transfers rely either on the European Commission’s decision on the EU-US Data Privacy Framework, for certified providers, or on the Commission’s standard contractual clauses included in the data processing agreements.

You have the right to know what data we hold about you and receive a copy, to ask for it to be corrected, erased, restricted or transferred, to object to processing based on legitimate interest and to withdraw consent at any time where processing relies on consent.

Write to office@sosisesa.ro. We reply within one month. Some data cannot be erased while the law requires us to keep it (for example the accounting records of donations).

If you believe your rights have been breached, you can complain to the Romanian data protection authority (ANSPDCP), www.dataprotection.ro.

When we change how we use data, we update this page and the date at the top.