Privacy Policy

I. INTRODUCTION

Asociația Convey takes the protection of personal data seriously. This Privacy Policy explains what information we collect about you, why we need it, how we keep it safe and what rights you have over it. It applies to everyone who visits our website, contacts us, applies to or takes part in our projects, or works with us as a partner, staff member or volunteer.

I.1. Key Terms

- GDPR: Regulation (EU) 2016/679, the European Union's General Data Protection Regulation. It sets the rules for how organisations may use information about people and gives individuals rights over their own data.

- Personal data: any information that identifies you or could be used to identify you, such as your name, email address, phone number, date of birth or a photo of you.

- Processing: anything done with personal data, including collecting, storing, using, sharing and deleting it.

- Data controller: the organisation that decides why and how personal data is processed. For the data described in this policy, that is Asociația Convey.

- Lawful basis: the legal ground under the GDPR that allows a specific use of personal data.

II. WHO WE ARE

II.1. Data Controller

Asociația Convey is a Romanian non-profit association that runs youth exchanges, training courses and local activities, mainly within the Erasmus+ programme.

- Organisation: Asociația Convey

- Registered address: Str. Sulfinei, Nr. 12, Oraș Fundulea, Jud. Călărași, Romania

- Fiscal code (CUI): 52318938

- Email: matei@asociatiaconvey.eu

- Website: www.asociatiaconvey.eu

Wherever this policy says "we", "us" or "our", it means Asociația Convey.

II.2. Our Commitment

Everyone who works or volunteers with us and handles personal data is bound by a duty of confidentiality. We use technical and organisational measures to make sure your information is handled lawfully and securely.

III. WHAT DATA WE COLLECT

III.1. Information You Give Us

We collect only what we genuinely need. Depending on how you interact with us, this may include:

- Contact details: name, email address, phone number, country and city of residence.

- Application details: date of birth, gender, motivation, previous experience, language skills and any social media profiles you choose to share.

- Wellbeing and safety information: dietary needs, allergies, relevant medical information and emergency contacts, so we can look after you during an activity.

- Parent or guardian details: for participants under 18, the name and contact details of a parent or guardian, together with their written consent.

- Inclusion information: details you choose to share about obstacles to participation, so we can offer extra support.

- Travel and reimbursement details: tickets, invoices and the bank details needed to reimburse your travel costs.

- Feedback and evaluations: your answers to evaluation forms and surveys.

- Photos and videos: images and recordings taken during our activities.

III.2. How We Collect It

We receive this information through online application and contact forms, by email or phone, through social media messages, and in person during our activities. Our website also uses Google Analytics, which places cookies, to count visits and see which pages are viewed most. It gives us statistics only, not your name or contact details.

III.3. Sensitive Information

Health information is a special category of data under the GDPR. We ask for it only when it is necessary for your safety, keep it to a minimum, and share it only with the people who need it to look after you, such as group leaders or the person responsible for first aid.

IV. WHY WE USE YOUR DATA

IV.1. Purposes

We use personal data to:

- Answer your questions and send you the information you ask for.

- Assess applications and select participants, staff and partners.

- Organise activities, including travel, accommodation, meals and insurance.

- Keep participants safe and respond to emergencies.

- Meet the administrative and reporting requirements of the Erasmus+ programme.

- Monitor equal access, gender balance and inclusion in our projects.

- Share the results of our projects and promote non-formal learning, using photos and testimonials only with consent.

- Send newsletters and updates, only if you have signed up for them.

IV.2. Lawful Basis

We rely on the following legal grounds:

- Consent: for example, for newsletters, for publishing photos of you, and for optional information you choose to share. You can withdraw your consent at any time.

- Contract: when you apply to or take part in one of our projects, we need certain data to organise your participation.

- Legal obligation: when Romanian law or Erasmus+ rules require us to keep or report certain information.

- Vital interests: in an emergency, we may share health information with medical staff to protect your life or health.

- Legitimate interests: for running the association, such as keeping basic records of past participants and improving our activities, as long as this does not override your rights.

V. PHOTOS AND VIDEOS

We often document our activities with photos and videos and may publish them on our website, on social media and in project reports and newsletters. We never use them for commercial purposes. We ask for your consent before publishing material in which you can be identified, and for participants under 18 we ask a parent or guardian. If you would like a photo or video of you removed, contact us and we will take it down from the channels we control.

VI. WHO WE SHARE YOUR DATA WITH

VI.1. Recipients

We never sell or rent your data. We share it only when it is needed to run a project, and only with:

- The Erasmus+ authorities: the Romanian National Agency (ANPCDEFP) and the European Commission, through the official Erasmus+ reporting tools.

- Project partners: partner organisations involved in the same project, for example to coordinate travel and group leaders.

- Service providers: accommodation venues, transport companies and insurers, who receive only what they need to provide their service.

- Authorities and emergency services: when the law requires it, or when someone's health is at risk.

VI.2. Transfers Outside the EU

Most of our partners are based in the European Union or the European Economic Area. If a project involves a partner outside these areas, we share only what is necessary and apply the safeguards required by the GDPR.

VII. HOW WE PROTECT AND STORE YOUR DATA

VII.1. Security

We protect personal data against loss, misuse and unauthorised access with appropriate technical and organisational measures, such as password-protected accounts and limited access. Only team members who need the information for their work can see it.

VII.2. How Long We Keep It

We keep personal data only for as long as we need it. Erasmus+ project documents must be archived for several years after a project ends, generally up to five years after the final payment, so that the National Agency and the European Commission can carry out checks. After that, we delete or anonymise the data. Newsletter data is kept until you unsubscribe.

VIII. YOUR RIGHTS

VIII.1. Your Rights Under the GDPR

You have the right to:

- Access: ask whether we hold data about you and receive a copy of it.

- Rectification: have incorrect or incomplete data corrected.

- Erasure: ask us to delete your data when we no longer need it or when you withdraw consent, unless the law requires us to keep it.

- Restriction: ask us to limit how we use your data in certain situations.

- Portability: receive your data in a common format, or have it sent to another organisation.

- Objection: object to processing that is based on our legitimate interests.

- Withdrawal of consent: withdraw your consent at any time, without affecting anything done before.

- Complaint: lodge a complaint with the Romanian data protection authority, ANSPDCP (www.dataprotection.ro).

VIII.2. How to Exercise Your Rights

Write to us at matei@asociatiaconvey.eu. We may ask you to confirm your identity, and we will reply within one month.

IX. YOUNG PEOPLE UNDER 16

If you are under 16, we need the consent of a parent or guardian before processing your data, except where the law allows otherwise. For all participants under 18, a signed parental consent form is required before taking part in an activity.

X. LINKS TO OTHER WEBSITES

Our website links to other sites, such as Instagram, YouTube and partner websites. We are not responsible for how those sites handle personal data, so please read their own privacy policies.

XI. CHANGES AND CONTACT

We may update this Privacy Policy from time to time; the date of the latest version is shown below. For any questions about this policy or your personal data, contact us at matei@asociatiaconvey.eu or by post at Str. Sulfinei, Nr. 12, Oraș Fundulea, Jud. Călărași, Romania.

The full text of the GDPR is available on EUR-Lex: https://eur-lex.europa.eu/eli/reg/2016/679/oj

Last updated: October 2026