Casa Italia Iasi Casa Italia Iași — In Communitate Virtus

Privacy Policy

Privacy Asociația Casa Italia Iași Consolidated text — Regulation (EU) 2016/679 (GDPR) — website, membership and association activities

Version: 3.0 Effective from: 22 September 2026

This document is the single, official text of the Casa Italia Iași Privacy Policy, published on casaitaliaiasi.eu. It replaces and consolidates the previous website Privacy Policy (version 1.0, May 2026) and the Privacy Notice attached to the membership application forms (version 2.1). Every membership form, communication or initiative of the Association expressly refers to the number of this version: any update entails a new version number and a new date.

This Policy describes, in a single and complete way, how the Association Casa Italia Iași processes the personal data of people who visit the official website, contact the Association, apply for membership — in any category provided for by the Statute, including Associate Member (Socio Aggregato) and Temporary (Occasional) Member —, are already members, take part in activities, events and cultural initiatives, make donations or use the Association’s online services. It is the only reference text for any activity of Casa Italia Iași.

1. Data controller The Association is a non-profit legal entity under Romanian law, established and operating under Government Ordinance no. 26/2000 on associations and foundations, and processes personal data in compliance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018 on measures implementing Regulation (EU) 2016/679, as well as other applicable Romanian and European Union law. The controller of personal data is Asociația Casa Italia Iași, with registered office at Str. Sf. Lazăr 66A, etaj 2, biroul 1, Gabriel Business Center, 700049 Iași, Romania, tax ID (CIF) 54519270, registered with the Iași Court of First Instance (Judecătoria Iași) under file no. 5405/245/2026. For information on the processing of personal data and to exercise your rights you can write to info@casaitaliaiasi.eu or use the contact form on casaitaliaiasi.eu.

2. Scope and data subjects This Policy applies to people who: visit the Association’s website; contact the Association, including via the contact form or requests for information; apply for membership in any category provided for by the Statute, including Associate Member and Temporary (Occasional) Member; are already members; make donations; take part in the activities, events and cultural initiatives of Casa Italia Iași, including by subscribing to the newsletter or to the WhatsApp update groups.

3. Types of data collected The website and services of Casa Italia Iași may collect the following categories of data:

a) Browsing data, acquired automatically by the website’s IT systems (IP address, date and time of the visit, browser and device type, pages visited), used for the security and proper functioning of the website. Website usage statistics are collected only through statistical cookies and only with consent (letter f);

b) Data provided voluntarily through the website, electronic or paper forms, e-mail, telephone, WhatsApp and direct contact with the Association: first name, surname, e-mail address, telephone number, preferred language, content of requests and digital identifiers, including the WhatsApp account identifier made available by the service;

c) For members and participants in activities: membership card number, application and date of admission, membership category (including Associate Member and Temporary/Occasional Member), status and validity of membership, any fees paid, event registrations and requests to access agreements and discounts;

d) For donations: the data needed to manage and record them administratively;

e) Choices regarding communications, records of consents and withdrawals, and the technical data needed for the functioning and security of the website and the database;

f) Technical cookies needed for the website to function and, only with consent given through the cookie banner, statistical cookies (Google Analytics). The website does not use marketing or profiling cookies. Details are set out in the Cookie Policy published on the website.

We collect only the data that are relevant and necessary for the specific activity. You are not asked to provide health information, identity documents or other additional data through the general form, except in the case of a specific, justified request accompanied by the relevant information.

4. Purposes of processing and legal bases Data are processed for the following purposes:

a) Website browsing and security, on the basis of the Controller’s legitimate interest (Art. 6(1)(f) GDPR);

b) Membership application and membership relationship: examining the application, managing membership and the membership card in any member category (including Associate Member and Temporary/Occasional Member), exercising the rights and fulfilling the obligations connected with membership, including the necessary administrative and organisational communications (confirmations, notices of meetings, notices about membership and any fees due). Legal basis: performance of the membership relationship or of steps requested to establish it (Art. 6(1)(b) GDPR);

c) Activities and benefits requested: managing event registrations, donations, requests for assistance and access to agreements and discounts. Legal basis: Art. 6(1)(b) GDPR;

d) General requests and replies to the user’s communications, on the basis of the legitimate interest in handling the contacts received (Art. 6(1)(f) GDPR);

e) Legal obligations: accounting, tax and other obligations applicable to the Association (Art. 6(1)(c) GDPR); for accounting documents, Accounting Law no. 82/1991 applies in particular;

f) Optional communications: with your consent, we send you the Casa Italia updates service by SMS, e-mail and WhatsApp (information and invitations about the Association’s activities and events, charitable initiatives, fundraising and donation requests, information on agreements and benefits reserved for members). Legal basis: Art. 6(1)(a) GDPR; for commercial electronic communications, Article 12 of Law no. 506/2004 also applies;

g) Website usage statistics through Google Analytics, to understand in aggregate form how the website is used and to improve it. The data are linked to pseudonymous identifiers and are processed only with consent (Art. 6(1)(a) GDPR and Art. 4 of Law no. 506/2004), which can be withdrawn at any time via the “Cookie preferences” link at the bottom of every page of the website;

h) Marketing and profiling: not currently carried out. If introduced, they will take place only with consent given through the cookie banner and after this Policy has been updated;

i) Security and protection of rights: protecting the website and the database and handling any disputes, on the basis of the legitimate interest in the security and protection of the Association’s rights (Art. 6(1)(f) GDPR). We also keep the records needed to document compliance with data protection obligations.

The legal bases above are applied in accordance with Regulation (EU) 2016/679 (GDPR) and, for national implementation, with Law no. 190/2018 on measures implementing Regulation (EU) 2016/679.

5. Processing methods Personal data are processed with electronic and manual means, using appropriate technical and organisational measures to ensure security, integrity and confidentiality and to protect the data against unauthorised access, loss and misuse.

6. Necessary data, communications to members and optional consent Mandatory fields are indicated in the relevant form. Failure to provide the data that are actually necessary may prevent the handling of the membership application or of the activity requested. Other data are optional. Communications necessary for the membership relationship do not depend on consent to optional communications. They may be sent by e-mail, SMS and WhatsApp, using the contact details provided and the available channels, according to the needs of the communication and in line with the procedures set out in the Statute. Consent to the optional updates is freely given: you may refuse or withdraw it without this preventing the examination of the membership application, causing the loss of membership or excluding the activities requested.

7. Data retention General requests for information are kept for a maximum of 12 months after they are closed. Members’ operational data are kept for the duration of the membership relationship. When it ends, data no longer needed are deleted, keeping separately only the documentation required by legal obligations or needed to protect rights. Data relating to events and checks for agreements are kept until the activity ends and then for a maximum of 12 months, except for documentation subject to the obligations below. Contact details used for optional communications are used until consent is withdrawn or the service ends, with periodic checks on their relevance. Mandatory accounting records and supporting documents are kept for ten years, calculated according to the term laid down in Article 25 of Accounting Law no. 82/1991. Payroll records follow the specific term laid down in the same provision, currently five years in the cases specified by law. Records of consents, residual documentation of terminated relationships and technical data are kept for a maximum of 24 months after the relationship ends or consent is withdrawn, unless different terms are imposed by legal obligations; backups are rotated periodically, with data no longer needed deleted within 90 days. Minimal information on withdrawals is kept separately to avoid unwanted messages, without any promotional reuse. In the event of a dispute, only the necessary data may be kept until it is resolved and the resulting obligations are fulfilled. Retention periods must be defined by category and purpose, not by keeping the entire archive indiscriminately. Cookies are kept for the periods indicated in the website’s Cookie Policy.

8. Database, authorised persons, providers and disclosure of data Data are kept in a restricted-access database connected to the Association’s website, as well as in the systems and archives needed to manage its activities. Access is granted to authorised members of the Association responsible for answering requests, according to their respective roles. Appropriate technical and organisational measures are adopted to protect the data against unauthorised access, loss and misuse. Within the limits of their activities, data may be received or processed by hosting, maintenance and database management providers, e-mail, SMS and WhatsApp services, providers used for events and payments, and administrative, accounting and legal advisers. Providers acting on behalf of the Association are engaged as processors where the conditions are met. Entities that independently determine the purposes and means of their own processing act as independent controllers. Data may be disclosed to public bodies or authorities only where required by law. Data are never sold, disseminated or disclosed to unauthorised parties: the archive of contacts and members is not public.

9. Agreements and verification of membership status When you ask to use an agreement or a discount, we may confirm your entitlement to the benefit to the partner concerned, disclosing only the data needed for the check, such as first name, surname, member code and validity of membership. The check is limited to what is necessary to provide the requested benefit, within the purposes described in section 4. The partner and the method of verification are made known before any disclosure. We do not transmit the full list of members to partners in advance. Consent to the Casa Italia updates does not authorise the disclosure of your contact details for partners to run their own promotional campaigns. The partner provides its own privacy notice for any further processing carried out under its responsibility.

10. Providers and international data transfers The website is hosted by Aruba S.p.A., a provider based in Italy, on servers located in the European Union. The members’ database and the Association’s electronic archives are kept on restricted-access systems located in Romania and in Italy. Paper documentation is kept at the Casa Italia Iași office. We also use Aruba S.p.A. for e-mail. This processing takes place within the European Economic Area (EEA).

Some services are provided by third parties that may also process data outside the EEA:

  • Google (Google Analytics for website statistics and embedded YouTube content);
  • Meta Platforms (Facebook and Instagram content embedded in the website and the WhatsApp Business service, used in its standard application).

For transfers to the United States, the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework applies for providers certified under it, or else the Standard Contractual Clauses approved by the Commission. On the website, Google and Meta services are activated only with consent given through the cookie banner. The Association does not currently use SMS communications. For more information, please refer to each provider’s privacy policy or write to info@casaitaliaiasi.eu.

11. Data subject rights and stopping communications As a data subject, you may at any time exercise the rights provided for in Articles 15-22 GDPR: access to your data, rectification or updating, erasure (right to be forgotten), restriction of processing, objection, data portability and withdrawal of consent, without affecting the lawfulness of prior processing. You may also object to processing based on legitimate interest on grounds relating to your particular situation, and object at any time to processing for direct marketing. You may withdraw your consent to optional communications at any time, including for only one of the SMS, e-mail or WhatsApp channels, without having to give reasons, by using the unsubscribe method indicated in the messages or by writing to info@casaitaliaiasi.eu or using the contact form on the website. Withdrawal does not affect the lawfulness of prior processing and does not prevent communications necessary for the membership relationship or a requested activity. Requests are normally answered within one month, subject to the justified extensions allowed by the GDPR. Erasure does not cover data that must be kept for legal obligations or other applicable legitimate reasons. The exercise of rights and complaint procedures are governed, in addition to the GDPR, by Law no. 190/2018 on measures implementing Regulation (EU) 2016/679. You may lodge a complaint with the competent supervisory authority, in particular the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

12. Minors The website’s general services and contact forms are not intended for minors under 16, the threshold set by Article 7 of Law no. 190/2018 for consent to information society services: any data sent by a minor through the website will be deleted immediately. Any activities, initiatives or events of the Association involving minors, or requiring special categories of data, are accompanied by the necessary information and conditions, including the consent of the holder of parental responsibility, in compliance with applicable law.

13. Cookies, WhatsApp groups and further processing The use of cookies is described in the Cookie Policy published on the website. Consent to cookies is given through the banner and can be changed at any time via the “Cookie preferences” link at the bottom of every page. Consent to communications does not replace any consent required for cookies. Subscribing to WhatsApp updates does not mean being automatically added to groups in which contact details are visible to other participants. The consent described in this Policy does not include promotional profiling, publication of photographs or donors’ names, or direct marketing by partners. Within the processing described here, no decisions based solely on automated processing producing legal or similarly significant effects on individuals are taken.

14. Updates to this Policy This Policy may be updated over time. The most recent version is always published on this page of the casaitaliaiasi.eu website and is the only official, verifiable version. Every membership form or official communication of Casa Italia Iași refers to the number and date of this version: any update entails a new version number and a new date. Significant changes are communicated to data subjects in an appropriate manner.