PRIVACY POLICY
Last updated: June 10, 2026
Narada Association
Introduction
At the Narada Association, the protection of your data is important to us. We are committed to being fully transparent about how we collect, use, and protect your personal data, and to implementing mechanisms, procedures, and policies that ensure the confidentiality, integrity, and security of your data throughout its entire lifecycle. The information below explains how your data may be collected and processed by the Narada Association, as well as your rights regarding this data.
Your personal data is collected and processed by the NARADA Association, acting as the Data Controller (hereinafter “NARADA”), with its registered office at 23–27 Iovita Street, 6th floor, apt. 24, Sector 5, Bucharest, and its mailing address: Bucharest, 9B Fabrica de Glucoza Street, Staircase CB, 1st Floor, apt. 102, intercom 007, Sector 2, with tax identification number 42157184, as well as in the Register of Associations and Foundations under no. 28945/A/2019, represented by Matei Camelia-Raluca, in her capacity as Executive Director.
About Our Privacy Policy
This Privacy Policy describes how the Narada Association collects, uses, and protects personal data when: (i) you participate, in any capacity (as a collaborator, volunteer, donor, or beneficiary), in an event, activity, or campaign organized by or in collaboration with Narada; (ii) you visit the narada.ro website; (iii) you use the Nari AI assistant; or (iv) you contact us by any means.
The purpose of this procedure is to provide information regarding the processing of personal data, in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation “GDPR”).
Compliance with data processing principles:
In its processing of personal data, NARADA always adheres to the following principles:
All data is processed lawfully, fairly, and transparently with respect to the data subject (“lawfulness, fairness, and transparency”);
Personal data is collected for specific, explicit, and legitimate purposes and is not further processed in a manner incompatible with those purposes (“purpose limitation”);
All personal data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed (“data minimization”);
Your data is accurate, and, where necessary, we update it and take all necessary measures to ensure that any inaccurate personal data is erased or rectified without delay, taking into account the purposes for which it is processed (“accuracy”);
Your personal data is not retained for longer than necessary (“storage limitations”);
Appropriate security measures for the processing of your personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by taking appropriate technical or organizational measures (“integrity and confidentiality”);
The processing is carried out in accordance with your rights as a data subject.
What data do we process?
The personal data we will process about you consists of data obtained directly from you, which you voluntarily provide to us when you participate in or confirm your participation in activities, events, or campaigns organized by or in collaboration with the Narada Association, as well as technical data collected from all users of the website. This includes the following categories of data:
• First and Last Name
• Mailing address
• Email address
• Phone number
• IBAN, first and last name of the account holder
• Home address
• Your image in the photos from the event/activity/campaign.
• Your voice in audio or audiovisual recordings featuring you
• Other personal data derived from the specific subject matter of the sponsorship agreement.
Sensitive personal data: We will not collect or process sensitive personal data about you (for example: information regarding your racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life, or sexual orientation), unless such sensitive personal data is relevant to a specific purpose for which we process personal data, such as your participation in special events, or if you have separately provided us with your explicit consent.
The Association does not knowingly collect personally identifiable information from individuals under the age of 16, either on its websites or in written form. If a parent or guardian becomes aware that their child has provided personal information to Narada, they must immediately notify Narada. If Narada discovers that a person under the age of 16 has provided personal data, it will immediately delete this information from its servers, unless the parent or guardian gives explicit consent for the Association to process the child’s personal data for the specified purposes.
If NARADA processes personal data of minors, it will ensure that it obtains the consent of the minor’s legal representative or guardian, when such consent is required.
We use cookies to improve your browsing experience on our websites. Cookies are small files stored on a user’s computer; they contain a small amount of data specific to a particular user and the website being visited. You can find more details in our Cookie Policy.
When can we collect data?
We may collect personal data when:
1. You are participating in or have expressed an interest in participating in an event organized by, in collaboration with, or for the Narada Association;
2. Contact us for more information (by email, phone, or in person);
3. Visit the Narada Association’s website: www.narada.ro and provide your personal information;
4. Make a donation to NARADA;
5. If you participate in public events (charity events, presentations, campaigns, activities, etc.), we may collect photos, videos, or audio recordings that may be posted on the Narada.ro website or on Narada’s Facebook page or other social media pages;
6. For the purpose of entering into or performing a contract;
7. Subscribe to newsletters or other ways of receiving information;
8. You contact us through various channels to request information about our programs or to submit requests for assistance;
9. In the event that we disclose such data to third-party service providers or our partners (lawyers, consultants, accountants, etc.), provided there is a legal basis for doing so;
10. You send us various comments and requests via social media.
Why do we process this data?
Your personal data is collected only for legitimate reasons and in accordance with applicable law:
To provide you with information about and/or to identify you for an event in which you have expressed an interest in participating (e.g., campaigns, charity events) and for marketing purposes, depending on the options you have selected.
Specifically, your personal data is processed by the Narada Association as follows:
To contact you, confirm your attendance, and register your participation in campaigns, initiatives, or events organized by the Narada Association (failure to provide your data will make it impossible for you to participate).
To carry out information, communication, and promotional activities for the Narada Association (in accordance with Article 6(1)(a) of the GDPR). This consent may be withdrawn at any time by sending an email to contact@narada.ro.
In order to process your payments/donations.
To track the progress of the case, if you are the final beneficiary of the event.
So that we can share the results of the campaign/event on social media and with our partners in organizing them.
To comply with our legal obligations regarding archiving, security, reporting, record-keeping, and other obligations imposed on us by law.
Management of our communications and IT (information technology) systems. Management of our communications systems, management of our IT security, conducting security audits of our IT networks, submitting reports to the relevant authorities, and troubleshooting system errors.
On what legal basis do we process personal data?
We must have a legal basis for processing personal data. This is known as “the lawfulness of processing.”
In some cases, we will ask for your consent, such as when communicating with you (for example, when we or you wish to participate in certain campaigns, contests, or for marketing purposes) or when we process sensitive data. In these cases, we will separately request your written consent in a transparent manner when you provide your personal data. You may subsequently withdraw your consent at any time by emailing contact@narada.ro or by clicking the unsubscribe link included in the messages you receive from us.
However, the withdrawal of consent will not affect the lawfulness of any processing that took place prior to the withdrawal.
In other cases, we will not ask for your consent to process your personal data, but will rely on other legal grounds provided for in the European General Data Protection Regulation. In all cases, we will prioritize the protection of your legal rights over any interests of the Association.
In certain situations, we may base our marketing activities on our legitimate interest in promoting and developing our projects and social campaigns. Whenever we use information about you for a legitimate interest of ours, we take care to ensure that your fundamental rights and freedoms are not adversely affected. However, you may request at any time, through the means described above, that we stop processing your personal data for marketing purposes, and we will comply with your request.
To elaborate on the above, we may process your personal data for the following purposes and on the following legal grounds:
• to enter into or perform a contract we have entered into with you (applicable in particular to business partners, recipients of sponsorships, and patrons);
• to provide our services (applicable particularly in the case of our websites or apps);
• to comply with a legal obligation (for example, applicable accounting and tax laws when you win a prize in a contest or receive a sponsorship, regardless of its type);
• when it is necessary for our legitimate interests (or those of a third party) and for your interests (for example, to detect and prevent fraud or to ensure IT and network security), unless your fundamental rights override those interests;
• for various technical, administrative, and operational reasons, such as to ensure that content is presented in the most effective way for you and your computer; to improve our websites, including their functionality; to administer our websites;
• for internal operations, including for troubleshooting, data analysis, testing, statistical, and research purposes;
• to establish, exercise, or defend our rights in court if disputes arise that we cannot resolve amicably;
• to contact you (for example, to respond to a request, to keep you informed of changes or updates to our policies and practices, or to respond when you contact us)
• as part of our efforts to keep our websites secure, accurate, and up to date.
If we request personal data to comply with legal or contractual obligations, your provision of such personal data is mandatory. This means that if such personal data is not provided, we will not be able to manage our contractual relationship or fulfill our obligations. In all other cases, the provision of personal data is optional, and you are under no obligation to provide it.
Furthermore, based on our legitimate interest, we may process your personal data—such as identification details, contact information, and residential address—for the purpose of defending our association in the event of any claims you may bring against us, as well as for the exercise of any procedural rights that our activities entail or that arise from them.
How do we process the data?
We collect and process data in accordance with the following requirements:
1. In a fair, lawful, and transparent manner;
2. For specific, explicit, and legitimate purposes;
3. Only data that is adequate, relevant, and limited to the purposes for which it is processed (“data minimization”);
4. Only accurate and up-to-date information;
5. By keeping them in a form that does not allow for the identification of the data subjects for longer than is necessary for the purposes of the processing;
6. Processed in accordance with the data subject’s rights and in a manner that ensures appropriate security and protection against unauthorized or unlawful processing and against loss.
How long do we process the data?
Personal data processed by Narada is retained for a reasonable period of time in relation to the purpose of the processing, so as not to exceed the period necessary for processing and, in no case, for more than 10 years from the date of collection.
Payment data will be stored for a period of 10 years, in accordance with Law No. 82/1991 on accounting.
If you withdraw your consent, your personal data will no longer be used; however, this will not affect the use of your data prior to the withdrawal of your consent.
We make every effort to ensure that your data is kept secure. To store your data electronically, we use servers specialized in electronic archiving.
We strive to use reasonable organizational, technical, and administrative measures to protect personal data within the Narada Association.
Whenever possible, data that is no longer useful to us is anonymized so that individuals can no longer be identified. If this cannot be fully achieved, we use pseudo-anonymization to limit the risks associated with the processing of personal data.
Where do we process the data?
The data is processed within the European Union using secure internal servers.
Narada undertakes to process the collected data solely in accordance with the stated purposes and not to disclose, sell, rent, license, or otherwise transfer it without authorization the database containing information regarding the data subjects to any third party not involved in fulfilling the stated purposes, except in cases where the transfer/access/viewing, etc., is requested by the competent authorities, in the cases provided for by the regulations in force.
Who else can access the data?
In order to fulfill the purpose of data processing, Narada may provide limited access to your data to potential partners, third-party individuals or legal entities that support the Narada Association in achieving its objectives or in implementing and conducting the campaigns/actions/events in which you have chosen to participate or in which you have expressed an interest in participating, or to public/local authorities. (for commercial marketing communications, under the conditions and within the limits imposed by law, when the disclosure of personal data is required by law, etc.)
Whenever we carry out such a transfer, we ensure that there is a solid justification, that only the data strictly necessary to achieve the intended purpose is disclosed, and that the recipient guarantees a high level of protection for personal data.
Transfer of data to third countries
The data we process at the Narada Association will not be transferred to or stored on servers located in third countries. To the extent that certain technical service providers process data outside the EEA, such transfers are carried out exclusively with appropriate safeguards in accordance with Articles 44–49 of the GDPR.
What are your rights?
Under current law, your rights are:
Right of access: You may at any time request confirmation from the Narada Association that we are processing your personal data, as well as information regarding the specifics of the processing, such as the purpose, the categories of data processed, and the existence of the right to rectification, erasure, or restriction of processing. This right allows you to obtain a copy of the processed personal data free of charge.
Right to rectification: You may request that we correct any inaccurate personal data or, where necessary, complete any incomplete data. We may attempt to verify the accuracy of the data before correcting it.
Right to erasure: You may request the erasure of your personal data when:
a) they are no longer necessary for the purposes for which we collected and processed them;
b) you have withdrawn your consent to the processing of your personal data, and we can no longer process it on other legal grounds;
(c) personal data is processed in violation of the law;
d) personal data must be deleted in accordance with applicable law;
Withdrawal of consent: You may withdraw your consent at any time regarding the processing of personal data processed on the basis of consent.
We are not required to comply with your request to delete your personal data if the processing of your personal data is necessary:
- to comply with a legal obligation; or
- to establish, exercise, or defend a right in court.
Right to object: You may object at any time to the processing of your data for marketing purposes, as well as to processing based on the legitimate interests of the Narada Association, on grounds relating to your particular situation;
Right to restriction of processing: You may request that the processing of your data be restricted when you contest the accuracy of the data while the accuracy of the data in question is being verified, as well as in other situations provided for in Article 18 of the GDPR.
We may continue to use your personal data following a request for restriction if:
- we have your consent; or
- to establish, exercise, or defend a right in court; or
- to protect the rights of Narada or of another individual or legal entity.
Right to data portability: You may request, in accordance with the law, that we provide your personal data in a structured, commonly used, and machine-readable format. If you make such a request, we may transmit your personal data to another entity, provided that this is technically feasible.
Rights regarding automated decisions: You will be provided with appropriate safeguards regarding automated decisions made about you. In particular, you will have the right to:
a) to express your opinion regarding that automated decision;
b) request a review of the decision based on human intervention;
c) to challenge the automated decision.
This right does not apply if the decision was reached through automated decision-making:
- is necessary for us to enter into or perform a contract with you or to issue tax documents to you;
- is authorized by law and there are adequate safeguards for your rights and freedoms; or
- is based on your explicit consent.
The right to file a complaint with the supervisory authority: You have the right to file a complaint with the data protection supervisory authority if you believe your rights have been violated:
National Authority for the Supervision of Personal Data Processing
28–30 General Gheorghe Magheru Boulevard, Sector 1, 010336 Bucharest, Romania
anspdcp@dataprotection.ro
Your right to control cookies on our website
When you visit our website for the first time, you will be asked to consent to the use of cookies. You can manage your preferences at any time through your browser settings. You can configure your browser to delete cookies from your hard drive, prevent new cookies from being placed, or receive alerts so that no cookies can be placed without your express consent. You can also configure your browser so that cookies are no longer saved automatically. Please note, however, that changing your cookie settings will affect your ability to access our services and Website, which require cookies to function fully. If your browser is configured to reject all types of cookies, you will no longer be able to access all of our services.
Security of processed personal data
The Narada Association has implemented the necessary technical measures to prevent and protect against accidental or malicious destruction, loss, damage, unauthorized disclosure, alteration, or access to your personal data. Furthermore, Narada Association representatives who have access to your personal data are committed to maintaining its confidentiality.
Data Processing in the NARI AI Assistant
Nari is an AI assistant available for free at www.narada.ro. When you use Nari, you are interacting with an artificial intelligence system. Nari is intended for educational and informational purposes only and is not a substitute for professional psychological, educational, or medical counseling.
When using the “NARI” AI assistant, Narada does not request and does not intend to collect personal data (such as name, address, contact information, location, medical records, etc.). We recommend that users refrain from providing any such information that could directly or indirectly identify them. Nari was designed so that its use does not require the provision of personal data: it is not necessary to create an account, log in, or provide identifying information.
We recommend that you avoid including in your conversations with Nari any information that could directly or indirectly identify you or others (for example: first and last names, addresses, phone numbers, email addresses, a child’s school and grade, or information about the physical or mental health of an identifiable person).
However, since communication with NARI takes place in an open format, it is possible that some users may voluntarily provide personal data. In such cases, this data will be retained for a limited period of up to 90 days, without being used to identify individuals, create profiles, for marketing purposes, or to be disclosed to third parties, except where required by law. The legal basis for processing is our legitimate interest (Art. 6(1)(f) GDPR) in operating and improving the service. Conversations are not linked to any identity and are not used to identify individuals, create profiles, or for marketing purposes. Upon expiration of the 90-day period, the conversations are deleted.
The data will not be used for marketing purposes and will not be shared with third parties, except where required by law. Users have the right to request the deletion of data accidentally shared in conversations with Nari by sending a request to contact@narada.ro.
If Nari is used by children under the age of 16, we recommend that it be used with the consent and, whenever possible, under the guidance of a parent or guardian. If a parent or guardian discovers that a child has provided personal data in conversations with Nari, please contact us at contact@narada.ro, and the data will be deleted as a matter of priority.
All rights set forth in this Privacy Policy (including the rights of access, rectification, erasure, objection, restriction, and data portability, as well as the security and confidentiality measures implemented by Narada) apply in full to the data provided during interactions with the NARI application.
To operate the AI assistant Nari, Narada works with service providers who, only in certain situations, process personal data in compliance with the provisions of Regulation (EU) 2016/679.
To exercise the rights described in this procedure, for any questions or further clarification regarding this matter, or to file a complaint, please contact us using the following contact information:
NARADA ASSOCIATION
Bucharest, 23–27 Iovita Street, 6th Floor, Apartment 24, District 5 / Bucharest, 9B Fabrica de Glucoza Street, Staircase CB, 1st Floor, Apartment 102, Intercom 007, District 2 (mailing address)
Email address: contact@narada.ro
We may update this Policy, and we will notify you of any changes by posting the new version on our websites listed above. Please review this Policy periodically for any changes.
