Privacy policy

This policy explains what personal data we process in connection with cleanwaterfoundation.ngo and with the donations we receive, for what purpose, on what legal basis, and what rights you have under Regulation (EU) 2016/679 (GDPR).

The controller’s identification details are shown in the box at the top of this page. For any request concerning your personal data, write to office@cleanwaterfoundation.ngo.

What we process

1. Messages sent through the contact form

We collect only what you fill in: your name, email address, subject and message (required), plus your phone number and company name (optional).

2. Donations by bank transfer

When you donate by bank transfer, we receive the data that accompanies the payment from the bank: the account holder’s name, the payer IBAN, the amount and the payment details. We cannot avoid receiving this data — it is part of the banking operation itself.

3. Donations through PayPal

The PayPal button is a plain link. We do not process the payment and we never see your card details. When you follow it you leave our site, and PayPal becomes an independent controller for your data under its own privacy policy. From PayPal we subsequently receive only the payment confirmation and the donor’s name.

4. Technical data

The site is static and has no database of its own. We create no user accounts, build no behavioural profiles, and use no traffic analytics. As any web server does, the hosting provider records standard technical logs (IP address, request time) needed to operate and secure the service.

We do not sell, rent or exchange personal data with third parties for marketing purposes.

Legal basis and purpose

Purpose	Legal basis (GDPR art. 6)
Replying to your message and any follow-up correspondence	Legitimate interest — para. 1 (f)
Preparing and performing a sponsorship contract	Pre-contractual measures and contract performance — para. 1 (b)
Recording donations in our accounts and issuing the related documents	Legal obligation — para. 1 (c)
Keeping the site secure and operational (server logs)	Legitimate interest — para. 1 (f)

How long we keep data

• Contact form messages: at most 24 months from the last communication.
• Documents relating to donations and sponsorships: for the period required by Romanian accounting and tax law (Accounting Act no. 82/1991 and the tax rules in force). These periods are mandatory — we cannot delete these documents on request.
• Server technical logs: per the hosting provider’s policy, typically a few weeks.

Who else has access

The data is also processed by the providers who run our infrastructure, strictly to deliver the service and under data processing agreements:

• Cloudflare, Inc. (United States) — hosts the site and receives the messages sent through the contact form, which it then forwards by e-mail;
• Google (Google Workspace) — hosts the foundation’s mailboxes, including the one that sends and receives the form messages;
• the bank where we hold our accounts, for donations by bank transfer;
• our accountant / accounting firm, to record donations and sponsorships.

PayPal is not our provider but an independent controller, with its own privacy policy.

We may also disclose data to public authorities where the law requires us to.

Transfers outside the European Economic Area

Two of our providers also process data in the United States:

• Cloudflare, Inc. — hosts the site, receives the contact form messages and keeps the server’s technical logs;
• Google — through Google Workspace, the foundation’s e-mail service.

These transfers rest on two complementary legal bases:

• the EU-US Data Privacy Framework — Cloudflare and Google LLC are certified under this mechanism, recognised by the European Commission’s adequacy decision of 10 July 2023;
• the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, included in both providers’ data processing agreements.

Having both is deliberate: if the adequacy decision were ever invalidated, the transfers would remain covered by the Standard Contractual Clauses.

Our relationship with each provider is governed by its Data Processing Agreement, under which it acts solely as a processor, on our instructions.

We make no other transfers outside the European Economic Area.

Third-party services embedded in the site

• Google Maps — the Contact page has a Google map that does not load by itself. It appears only after you press “Load the map”, or if you chose “Accept all” in the consent banner. Only then does Google receive your IP address and may set its own cookies; until then nothing is sent to Google.
• WhatsApp — the button is a plain link. Nothing is sent until you follow it.
• PayPal — a link to PayPal’s donation page, active only when clicked.

The site does not use Google Analytics, advertising pixels, remarketing networks or fonts loaded from external servers. Fonts are hosted by our own site, so your IP address does not reach Google just by opening a page.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. Details and how to exercise them are on the GDPR — your rights page.

To exercise your rights, write to office@cleanwaterfoundation.ngo. We reply within 30 days, free of charge.

If you believe we have infringed your rights, you may contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro — or the courts.

Security

The site is served exclusively over HTTPS. Being static, there is no public database that could be compromised. Access to received messages and to donation records is limited to those people in the foundation who need it to do their work.

Minors

The site is not directed at people under 16 and we do not knowingly collect data from them. If you learn that a minor has sent us personal data, write to us and we will delete it.

Changes to this policy

We may update this policy when the way the site works, or the services we use, changes. The date of the last update is shown at the top of the page.