GDPR — your rights

Clean Water Foundation complies with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR), which applies across the European Union.

This page summarises your rights and how, concretely, to exercise them. Details of what data we collect and why are in the Privacy policy.

The controller

Clean Water Foundation Calea Clujului 192, Oradea, Bihor County, Romania Email: office@cleanwaterfoundation.ngo

The principles we follow

• Data minimisation — we ask only for what we need in order to reply.
• Purpose limitation — we use data only for the purpose you gave it to us for.
• Storage limitation — we do not keep data longer than necessary.
• Integrity and confidentiality — access is restricted and traffic is encrypted.
• Transparency — every processing operation is described publicly, on this site.

Your rights

Right of access (art. 15)

You may ask for confirmation that we process data about you, and for a copy of it.

Right to rectification (art. 16)

If the data we hold is inaccurate or incomplete, we correct it.

Right to erasure (art. 17)

You may request deletion of your data. We delete it, except where the law requires us to keep it — for instance accounting records relating to a donation or sponsorship.

Right to restriction of processing (art. 18)

You may ask us to suspend processing temporarily, for example while the accuracy of the data is verified.

Right to data portability (art. 20)

You may receive your data in a structured, commonly used, machine-readable format.

Right to object (art. 21)

You may object to processing based on our legitimate interest. We stop, unless we demonstrate compelling legitimate grounds.

Right not to be subject to automated decisions (art. 22)

We make no automated decisions and carry out no profiling based on your data. This right is therefore not affected in any way.

How to exercise your rights

Send an email to office@cleanwaterfoundation.ngo with your request. We reply within 30 days, free of charge. If a request is manifestly unfounded or excessive, we will tell you before charging any fee.

To protect data against unauthorised access, we may ask for additional information to confirm your identity.

Right to lodge a complaint

If you consider that the processing of your data infringes the GDPR, you may contact the supervisory authority:

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania www.dataprotection.ro

You also have the right to bring the matter before the courts.

Transfers outside the European Economic Area

The site is hosted by Cloudflare, Inc. and the foundation’s e-mail by Google (Google Workspace); both providers also process data in the United States. The transfers rest on the EU-US Data Privacy Framework, under which Cloudflare and Google LLC are certified, and additionally on the European Commission’s Standard Contractual Clauses (Decision 2021/914), in line with Chapter V of the GDPR.

Full details in the Privacy policy. We make no other transfers outside the EEA.

Personal data breaches

In the unlikely event of a security breach that could create a risk to your rights, we notify the ANSPDCP within 72 hours and inform you directly where the risk is high.