GENERAL INFORMATION
The Civil Society Development Foundation (CSDF), headquartered at 21 Nerva Traian Boulevard, Sector 3, Bucharest, registered with the Sector 2 Court under Decision no. 111 of 21 December 1994, with tax code RO14476331, acts as the owner and administrator of the website www.elvetiaromania.ro, and as a “data controller” as defined under national law and the General Data Protection Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC, which entered into force on 25 May 2018.
CSDF respects the right to privacy of users visiting our websites and ensures the lawful processing and protection of personal data for all individuals who provide such data to CSDF during the course of its activities. This document aims to inform you about the processing of your personal data when accessing the www.elvetiaromania.ro website, and more broadly, about the processing of personal data by CSDF within the Civic Engagement Programme.
FUNDING – BENEFICIARY NGOs
I. Processing of personal data for representatives of organisations applying online for funding
a) Categories of personal data processed
Through the website www.finantaripublice.CSDF.ro, where the Application Form is made available, a range of personal data is collected pertaining to contact persons, legal representatives, members of the Board of Directors, personnel of the applicant organisation involved in the project, as well as individuals within partner organisations or institutions collaborating with applicants for funding.
The personal data that may be collected includes, but is not limited to: full name, position, telephone number, email address, signature, CV, professional experience, and project role. For members of the Board of Directors, the following additional categories of data may also be collected: affiliation with an organisation/institution/company/political party.
b) Purpose and legal basis of processing
In order to establish the history of interaction with the applicant organisation, CSDF collects various types of personal data belonging to contact persons, Board members and staff of the applicant organisation.
CSDF has a legitimate interest in obtaining as much relevant information as possible about the applicant NGOs for the following reasons:
– To select the organisation that provides the highest guarantee of successfully implementing the funded project;
– To justify the selection to the funding authority – the Swiss Agency for Development and Cooperation.
II. Processing of personal data of individuals related to NGOs applying for funding, for the purpose of evaluating the prior relationship with the respective NGO
a) Categories of personal data processed
Personal data belonging to representatives, contact persons, Board members, and project staff from the applicant organisation is collected by CSDF in order to evaluate the previous relationship with the respective NGO. This may include, but is not limited to: full name, position, telephone number, email address, signature, CV, professional experience, and project role.
b) Purpose and legal basis of processing
To establish the interaction history with the applicant NGO, CSDF collects a set of personal data from the organisation’s representatives, contact persons and Board members. CSDF has a legitimate interest in verifying how past collaborations with the applying organisation were carried out (where such interactions exist). By analysing this history, CSDF can determine whether the NGO in question offers sufficient guarantees for appropriately implementing the funded projects for which they are applying.
III. Processing of personal data of representatives of NGOs benefiting from project funding, for the purpose of establishing the representative’s track record
a) Categories of personal data processed
Personal data belonging to project funding recipients (i.e. organisational representatives) is collected by CSDF in order to assess the past interactions of the representative with CSDF, whether in their own name or on behalf of other organisations previously represented. This may include: full name, position, telephone number, email address, signature, CV, professional experience, and project role.
b) Purpose and legal basis of processing
To assess the representative’s interaction history with CSDF, personal data is collected and analysed in the context of both past and present organisational representation. The legitimate interest of CSDF lies in its need to evaluate consistency and accountability in project implementation across its partnerships.
IV. Processing of personal data in relation to organisations designated as winners for specific projects
a) Categories of personal data processed
To evidence the activities undertaken for implementing projects that have received funding, organisations submit specific documentation to CSDF, such as technical-financial reports and supporting documents. These personal data may be transmitted by post/courier/personal delivery/electronically. A variety of data subjects may be involved: project beneficiaries (target groups), external experts, project implementation teams, and members of the Board of Directors of the implementing organisation.
Personal data may include: full name, job title, national identification number, salary (full or partial), address, bank account details, copies of employment and payment-related documentation (e.g. employment contracts, copyright agreements, service contracts, payslips, payment orders, expert fees, invoices, receipts, contracts with service providers involved in the events), and any other documents requested by CSDF.
b) Purpose and legal basis of processing
CSDF has a legitimate interest in monitoring the actual implementation of funded projects. It is essential for CSDF to verify whether the project is or was carried out in accordance with the details initially provided during the funding application.
Categories of personal data processed
In order to demonstrate the activities undertaken for the implementation of the projects for which they receive or have received funding, organizations transmit a series of personal data to the CSDF, through specific documentation such as Technical and Financial Reports, supporting documents, etc. These personal data are transmitted either by post/mail/personal delivery/electronic. The data transmitted are intended for several categories of data subjects: project beneficiaries (target group), outsourced experts, project implementation team, members of the organization’s Board of Directors. These personal data can be: name, surname, function, personal numerical code, salary (full or partial), address, bank account, copies of supporting documents of employment and payment related to the expenses claimed for reimbursement (e.g. individual employment contracts, copyright contracts, service contracts, pay slips, payment orders, salaries and contributions, experts’ fees, invoices, receipts, contracts with service providers related to the events carried out within the projects), as well as other documents that may be requested by the CSDF.
Data retention period
The data retention period will follow the instructions of the funder – Swiss Agency for Development and Cooperation – and will be limited to the period necessary to retain data relevant for the purpose outlined in point b). Personal data shall be retained by CSDF for no longer than 10 years following the completion of the Civic Engagement Programme.
Funding – final beneficiaries of projects (target group)
a) Categories of personal data processed
The personal data that may be collected by the CSDF from the final beneficiaries of the projects may be: name, surname, studies, place of work, position, CNP, series and number of identity card, date and place of birth, citizenship, marital status, sex, age, home address, telephone number, e-mail address, data on education and studies, profession, bank account, professional experience, name and surname of family members, ethnicity, religion, medical history, disabilities, photo, etc.
b) Purposes and grounds for processing
The personal data belonging to the final beneficiaries of the projects are collected by the CSDF from intermediaries, an example of which are the NGOs receiving funding. The data is therefore collected and processed for the purpose of carrying out the funding projects. CSDF’s legitimate interest and the purpose of the processing is to verify how the projects are implemented by the intermediaries and whether the objective pursued is achieved.
c) Transfer of personal data
These personal data may be transferred within Romania and Switzerland. Additionally, they may be disclosed to the following categories: the funder – Swiss Agency for Development and Cooperation, for the purpose of cost justification in funded projects; accounting firms (copies of contracts appended to financial documents); external auditors, including statutory auditors; tax authorities; other public institutions; and consortium partners: Foundation for Partnership (REPF) – Romania and KEK CDC – Analysi…
d) Data retention period
For the scenario in point (i), the data will be retained for as long as the individual acts as the designated contact person for that provider. For the scenario in point (ii), data will be retained throughout the duration of the service contract between CSDF and the individual provider.
Service Providers
a) Categories of personal data processed
The personal data of contact persons within service providers collected by CSDF may include, but is not limited to: first name, surname, organisation name, position, telephone number, email address, and signature. The data subjects of this processing may include individuals participating in events (speakers), contact persons within catering, transport, accommodation providers, travel agencies, advertising agencies, and individuals whose signatures appear on official minutes.
b) Purposes and legal basis of processing
Personal data belonging to contact persons within service providers is collected by CSDF to conclude service procurement contracts and to ensure effective communication with these suppliers. These purposes fall within the overall scope of implementing the activities and projects of CSDF. The legal grounds for processing fall into two categories:
- Legitimate interest of CSDF, in the case of service providers who are legal entities, authorised natural persons, or individual enterprises.
- Performance of service provision contracts, in the case of service providers who are natural persons.
In the scenario described in point (I) above, CSDF has a legitimate interest in collecting the contact details of supplier contacts to communicate effectively with these suppliers, and these contact persons are employees of the suppliers.
In the scenario described in point (II) above, CSDF collects personal data of natural person service providers to perform the service provision contracts concluded with them and to communicate efficiently with these individuals.
c) Transfer of personal data
The aforementioned personal data between the controller (CSDF) and third parties may be transferred within Romania and Switzerland. Additionally, this personal data may be transferred to the following categories of persons: the funding body – the Swiss Agency for Development and Cooperation, for the justification of reimbursement of expenses incurred within projects implemented by CSDF; accounting firms (copies of contracts annexed to employment and payment supporting documents); external auditors, including statutory audits; tax authorities and other public authorities in the event of potential audits; as well as consortium partners: the Partnership Foundation (REPF) – Romania, and KEK CDC – Analysis Consulting Evaluation.
d) Data retention period
For the situation provided in point (I) above, data retention shall last as long as the individual whose personal data is processed by CSDF remains the contact person for the respective supplier. For the situation described in point (II) above, data retention shall last for the duration of the execution of the service provision contract with the service provider who is a natural person whose personal data CSDF has processed.
D. EVENTS
Processing of personal data of individuals registering on CSDF websites to participate in CSDF-organised events
a) Categories of personal data processed
User registration on the website for the purpose of event participation involves processing the following categories of personal data: full name, job title, telephone number, email address of the contact person, and the name of the organisation/company/public institution on whose behalf the registration is made. The data subjects may be contact persons within organisations/companies/public institutions or private individuals registering on the website.
b) Purpose and legal basis of processing
CSDF collects and processes the personal data of contact persons and individuals registering on the website in order to organise and manage participation in events.
c) Transfer of personal data
These personal data may be transferred within Romania and Switzerland. Additionally, they may be disclosed to: the funder – Swiss Agency for Development and Cooperation, the company responsible for website maintenance, and consortium partners: Foundation for Partnership (REPF) – Romania and KEK CDC – Analysis Consulting Evaluation.
d) Data retention period
The data retention period will comply with the instructions of the funder – the Swiss Agency for Development and Cooperation – and shall not exceed the period necessary for the purposes described under point b). Personal data shall be retained by CSDF for no longer than 10 years from the end of the Civic Engagement Programme.
II. Processing of personal data of: final beneficiaries of projects implemented by CSDF, contact persons from service providers (legal entities), and collaborators (natural persons) for the purpose of organising events by CSDF
a) Categories of personal data processed
The personal data processed by CSDF may include: full name, email address, image, signature, telephone number, medical data (e.g. disabilities), date of birth, national identification number, name of spouse/children, job title, organisation name, ID series and number, residential address, place of birth, CV data. The data subjects may be: project beneficiaries, contact persons within service provider organisations, or external collaborators.
b) Purpose and legal basis of processing
CSDF collects and processes personal data of the above-mentioned data subjects for the purpose of organising events that support its ongoing projects. CSDF has a legitimate interest in processing such data to organise events that promote its funding programme, disseminate funding opportunities, and encourage knowledge and best practice exchange among organisations.
c) Transfer of personal data
These personal data may be transferred within Romania and Switzerland. Additionally, they may be shared with: the funder – Swiss Agency for Development and Cooperation, the website maintenance provider, travel agencies, hotels, airlines, media and advertising agencies, journalists, and consortium partners: Foundation for Partnership (REPF) – Romania and KEK CDC – Analysis Consulting Evaluation.
d) Data retention period
The data retention period will comply with the instructions of the funder – the Swiss Agency for Development and Cooperation – and shall be limited to the duration necessary for the purposes described in point b). Personal data shall be retained by CSDF for no longer than 10 years following the end of the Civic Engagement Programme.
LEGAL OBLIGATIONS FOR KNOW YOUR CUSTOMER (KYC) WHEN ESTABLISHING BUSINESS RELATIONSHIPS
a) Categories of personal data processed
Personal data that may be processed by CSDF includes: full name, date of birth, nationality, country of residence, photograph, etc.
b) Purpose and legal basis of processing
CSDF processes the personal data of the above-mentioned individuals in order to comply with the “Know Your Customer” (KYC) procedures, in accordance with applicable legal provisions on the prevention and sanctioning of money laundering and terrorist financing. CSDF is legally required to conduct customer due diligence when establishing business relationships, to ensure compliance with legal requirements in these areas.
This includes identifying the beneficial owner of a legal entity and verifying that the natural person representing the legal entity is authorised to act on its behalf. These procedures apply in particular to NGOs designated as grant recipients and are carried out during the pre-contracting stage, prior to signing the grant agreement.
c) Transfer of personal data
These personal data may be transferred to third parties authorised by CSDF, including the funder – Swiss Agency for Development and Cooperation, evaluators and/or auditors in the context of audits, tax authorities, other public authorities in the event of inspections, and consortium partners: Foundation for Partnership (REPF) – Romania and KEK CDC – Analysis Consulting Evaluation.
d) Data retention period
Personal data will be retained in accordance with the applicable legal requirements and the instructions of the funder – Swiss Agency for Development and Cooperation.
F. PUBLICATION OF ARTICLES AND INTERVIEWS ON THE WEBSITE
a) Categories of personal data processed
The website features articles, interviews, or personal stories about employees, beneficiaries, or supporters of NGOs. Personal data that may be processed by CSDF includes: full name, job title, information about disabilities, health status, education, and professional training. In general, a wide range of personal data may be included in these articles, such as personal or professional background, preferences, experiences, etc.
b) Purpose and legal basis of processing
CSDF collects and processes the personal data of the mentioned individuals in order to publish articles and interviews about them on various websites managed by CSDF.
c) Transfer of personal data
These personal data may be transferred primarily within Romania and Switzerland. However, as the articles are made publicly accessible, any individual or legal entity may access the published personal data. CSDF is responsible only for the original content published on its websites and shall not be held liable for any republication or third-party use of that content.
These personal data may also be disclosed to: the general public accessing the articles/interviews, the website maintenance company, and consortium partners: Foundation for Partnership (REPF) – Romania and KEK CDC – Analysis Consulting Evaluation.
d) Data retention period
The data retention period shall follow the instructions of the funder – the Swiss Agency for Development and Cooperation – and will be limited to the period necessary for the purposes outlined under point b). Personal data will be retained by CSDF for no longer than 10 years following the conclusion of the Civic Engagement Programme.
FEEDBACK QUESTIONNAIRES
a) Categories of personal data processed
Personal data that may be processed by CSDF includes: full name, place of work, job position within the organisation, nationality, gender, phone number, email address, profession, professional experience, and dietary preferences (e.g. vegetarian, specific dietary regimes), etc.
b) Purpose and legal basis of processing
CSDF processes the personal data of the following categories of individuals to obtain their feedback regarding the projects/events organised:
(i) Representatives of applicant organisations,
(ii) Individuals collaborating with or involved in CSDF projects,
(iii) Members/supporters of non-governmental organisations,
(iv) Private individuals generally interested in topics addressed by CSDF through its activities.
c) Transfer of personal data
These personal data may be transferred within Romania and Switzerland. They may also be shared with the following categories: the funder – Swiss Agency for Development and Cooperation, evaluators and/or auditors during audits, tax authorities, other public authorities in the case of inspections, and consortium partners: Foundation for Partnership (REPF) – Romania and KEK CDC – Analysis Consulting Evaluation.
d) Data retention period
The data retention period shall follow the instructions of the funder – Swiss Agency for Development and Cooperation – and will be limited to the duration necessary for the purposes outlined in point b). Personal data will be retained by CSDF for no longer than 10 years from the conclusion of the Civic Engagement Programme.
VOLUNTEERS
a) Categories of personal data processed
Personal data that may be processed by CSDF includes: full name, email address, national identification number (CNP), ID series and number, home address, mobile phone number, as well as other personal data revealed through correspondence or publicly available platforms such as Facebook – including education, workplace, professional qualifications, interests, and involvement in other volunteer projects.
b) Purpose and legal basis of processing
CSDF processes the personal data of volunteers for the following purposes: to assess potential volunteers for future collaboration, and for the conclusion and execution of volunteer agreements.
c) Transfer of personal data
These personal data may be transferred within Romania and Switzerland. They may also be disclosed to: the funder – Swiss Agency for Development and Cooperation, external auditors (including statutory auditors), banks, tax authorities, other public authorities in the event of audits, IT service providers, and consortium partners: Foundation for Partnership (REPF) – Romania and KEK CDC – Analysis Consulting Evaluation.
d) Data retention period
The data retention period shall follow the instructions of the funder – Swiss Agency for Development and Cooperation – and will be limited to the duration necessary for the purposes described under point b). Personal data will be retained by CSDF for no longer than 10 years from the conclusion of the Civic Engagement Programme.
The Civil Society Development Foundation undertakes the obligation to obtain the consent of individuals whose personal data will be processed in all situations where it is provided with sensitive personal information. In accordance with applicable legislation, the following categories of personal data are considered sensitive: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed solely for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a person’s sex life or sexual orientation.
Data subjects’ rights with regard to personal data processing:
- Right of access: You have the right to request from CSDF information regarding the processing of your personal data.
- Right to rectification: You have the right to request that CSDF correct any inaccurate personal data concerning you.
- Right to erasure: You have the right to request the deletion of your personal data by CSDF in certain situations, such as: the personal data are no longer necessary in relation to the purposes for which they were collected, or you have withdrawn your consent for their processing by CSDF.
- Right to restriction of processing: You have the right to request that CSDF restrict the processing of your personal data in specific cases, such as where you contest the accuracy of the personal data processed by CSDF, or where the processing is not lawful.
- Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, except in cases where there are legal provisions to the contrary.
- Right to data portability: You have the right to request that CSDF transmit your personal data, processed by CSDF, to you or to another entity designated to process your personal data.
CSDF may be contacted regarding the above by e-mail at: bianca.oprea@CSDF.ro. Additionally, for any complaints or concerns, you may contact the National Supervisory Authority for Personal Data Processing.
