| EVENT | ORGANIZER | LOCATION | DATE |
| International Student Week in Timișoara | Liga Studenților din Facultatea de Automatică și Calculatoare (Liga AC) | Timișoara | 22.07.2024 - 31.07.2024 |
1. Introduction
1.1 Privacy of personal data represents one of the main concerns for the Organizer. As such, we aspire to provide the highest standards of privacy and transparency for the personal data we’re processing in our current activity.
1.2 Since for conducting our business we are required to process a series of personal data, especially in relation to the specifics of our line of action, we wish to provide assurances that the processing will take place in compliance with the principles of transparency and security of personal data. This privacy policy is meant to help you understand what data we’re collecting, why we’re collecting it and what we’re doing with it.
2. Who are we?
2.1 The organizing entity of the ISWinT Festival Edition 2023 is Liga Studenților din Facultatea de Automatică și Calculatoare (hereinafter referred to as „Liga AC”), established in Timișoara, Timiș county, Romania, blvd. Vasile Pârvan, no. 2, room A021, registered with the register of associations and foundations under the registration number 540/A/2000, VAT number: 7267553 who acts as operator of personal data collected through the www.iswint.ro website (the "website”), and the ISWinT App, the online and on-site check on system, the means of video monitoring and photo and video image capture within the Festival by persons authorized by Liga AC.
2.2 The operator is required to manage safely and solely for specified purposes, the personal data that the users of the website are providing.
3. What kind of data is processed, the purpose of processing and the storage period for and the legal basis for processing for each category of data?
| 3.1 | WHAT KIND OF DATA IS PROCESSED | THE PURPOSE OF PROCESSING | STORAGE PERIOD | LEGAL BASIS FOR PROCESSING |
| 3.1.1 | First name, last name and the e-mail address and set of cryptographic hash values (generated by applying the HMACSHA256 encryption algorithm) related to the password set by the users so that they can log into their accounts. |
For the purpose of creating and accessing an account on the iswint.ro website or in the ISWinT App. | We will store this data as long as you have an account on the ISWinT website / App. You may request to us, at any time, to delete certain information or to close the account and we will respond to these requests, subject to storing certain information, including after closing the account, in situations where the applicable law or our legitimate interests require it. ease take note of the fact that as long as there is no request to delete this data, it will be deleted within 3 years counting from the last use of the account. |
a) Art. 6 (1) par. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; b) Art. 6 (a) par. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party; |
| 3.1.2 | Last name, first name, residency address, date of birth, number and issuing authority of the passport, scanned copy of the passport and scanned copy of the student ID. | For the purpose of creating the letters of invitation required for the visa application and verifying the identity and student status in accordance with internal stipulations. | 60 days from the end of the Festival |
a) Art. 6 (1) lit. b - b) Art. 6 (a) lit. f |
| 3.1.3 | Last name, first name, email and telephone number. | For the purpose of promoting ISWinT and its partners, as well as conducting surveys to improve the quality of the services we provide. | Until withdrawal of consent. | Art. 6 (1) (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; |
| 3.1.4 | Photographs or footage taken during the Event. |
For journalistic, informational, artistic, commercial purposes, for marketing and promotional purposes of the event, ISWinT products and services or related products and services, in its own name by ISWinT or by any partner or sponsor of the ISWinT Festival. Images or videos can also be used to make NFTs (Non-fungible tokens) and trading them on the relevant market. |
Indefinitely. |
a) Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
|
| 3.1.5 | Information regarding any medical problems or disabilities, emergency contact first and last name as well as the phone number, data regarding clothing or footwear, culinary preferences, gender, sexual orientation, race, nationality. | For the purpose of ensuring access and services to which the participant is entitled based on the individual circumstances. | 20 days after the end of the Festival |
a) Art. 6 (1) lit. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; b) Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party; |
| 3.1.6 | First name, last name, residence address, ID card, signature, passport number. | For the purpose of filling the lodging contract. | 40 days after the end of the Festival. |
a) Art. 6 (1) lit. b - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; b) Art. 6 (a) lit. f processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party; |
3.2 In addition to the aforementioned purposes, Liga AC may process the personal data collected for the following purposes:
- a. For the fulfillment of the obligations that incube on us, as a result of the services provided (e.g. accounting, fiscal, audit, etc.), these are always compatible with the main purposes, for which the data was collected.
- b. To the extent that the data subject has given their consent for the processing of their personal data for one or more specific purposes;
- c. For any other purpose auxiliary to the above, or for any other purpose for which we have been provided with personal data, in compliance with the relevant legislation.
3.3 In the situations in which we will use your data for purposes other than those mentioned in this Policy, we undertake to obtain your consent, unless we have a legal obligation or have a different legal basis for processing the data.
3.4 In order to gain access, as Organizers of the event, we might have the obligation to verify the documents required by the state authorities. This data shall be neither processed, nor stored, but only verified at the location in order to ensure access to the Festival.
4. How are we collecting your personal data?
4.1 We are collecting your personal data either directly from you, e.g. when you’re creating an account on our website/App, you’re sending us an e-mail at contact@iswint.ro or contact@ligaac.ro , in which you’re requesting us an offer / information, and you’re giving your consent for communication of commercial messages, etc.
4.2 We collect your personal data automatically, when you use our services from the website or the ISWinT application, we collect information through cookies and by logging your activity. For more information on the use of cookies, please refer to Art. 6 of this Policy.
4.3 If you choose to provide us with the personal data of others, such as emergency contact information, you are responsible for how you obtained these data and that you have a legal basis for processing them. We cannot be held liable for the violation of the rights of the respective persons.
5. How are we storing the personal data?
5.1 The personal data you're providing as a user of our website / App is stored in our servers.
6. COOKIES
6.1 The website contains cookies (very small files ISWinT is sending to the computers of website users or to other access devices).
6.2 There are two types of these cookies:
- Functionality cookies: These types of cookies improve the users' website navigation experience and allow them to benefit from various features;
- Performance Cookies: These types of cookies are used to measure and analyze how ISWInT customers are using the Website. These cookies can continually improve the functionality of the website and the user experience.
6.3 Accessing the website implies the agreement of the users regarding placing these types of cookies on their device and accessing them on their next visit to the site.
6.4 Information on deleting and controlling cookies is available at www.aboutcookies.org. Deleting or blocking the cookies may prevent access to certain areas or features of the site.
7. To whom we’re disclosing your personal data?
7.1 For fulfilling the processing purposes, Liga AC may disclose your personal data to partners, third parties or entities supporting Liga AC in the conduct of their business, or to central / local public authorities, in the following cases listed as examples:
- To our service providers and contractual partners, for example: marketing and advertising service providers; to our partner in charge of ensuring access to the ISWinT Festival venue; to IT service provider; to courier services, payment services, banking services, etc. This data will be provided to the extent necessary and only on the basis of a confidentiality agreement from the contractual partners, which guarantees that this data is kept safe and that its processing is done according to the legislation in force;
- To the accountants, auditors, lawyers, insurers or other such external advisers Operator might employ. This data will be provided to the extent necessary and only on the basis of a confidentiality agreement from the contractual partners, which guarantees that this data is kept safe and that its processing is done according to the legislation in force;
- Authorities, institutions and public bodies, if there is a legal request from them or to the extent that there is a legal obligation from us;
- The operator will be able to disclose this data whenever the law requires it, or in the case in which this action is necessary to allow the exercise of the rights provided by the law and / or to be able to take legal action against any illegal activity;
- Your personal data may be transferred to third countries, based on the contractual relationships we have with our partners (both affiliates and other entities in the European Union) in order to compile statistics and other types of reports;
8. How long do we store your personal information?
8.1 As a matter of principle, Liga AC will process your personal information only to the extent necessary to achieve the processing purposes mentioned above. Please note that for most processing purposes, data about the Participants at the festival will be deleted within 20 days from the end of the Festival, unless the Participant has an account on our website or has given us the consent to retain the data in order to be contacted for certain, clearly defined, purposes. For further details about our Data Retention Policy for certain specific data processing please review column 3 of the Table in Art. 3.
9. Your rights related to personal data processing:
9.1 If you have consented to processing activities, you may withdraw this consent at any time. This withdrawal will only take effect for the future and will not affect the legality of the processing prior to its withdrawal.
9.2 To the extent that your consent is withdrawn, LIGA AC will prohibit the processing of your personal data and will take all actions to delete all records containing this data.
9.3 However, if processing is compulsory for the provision of services by Liga AC and this can be performed on the basis of other legal provisions, Liga AC will carry out such processing and will notify you in this regard.
9.4 In accordance with the data protection legislation, you have the following rights:
1) Right to information
This right provides the data subject with the ability to ask a company for information about what personal data (about him or her) is being processed and the rationale for such processing. For example, a customer may ask for the list of processors with whom his or her personal data is shared.
2) Right to access
This right provides the data subject with the ability to get access to his or her personal data that is being processed. This request provides the right for data subjects to see or view their own personal data, as well as to request copies of the personal data.
3) Right to rectification
This right provides the data subject with the ability to ask for modifications to his or her personal data in case the data subject believes that this personal data is not up to date or accurate.
4) Right to withdraw consent
This right provides the data subject with the ability to withdraw a previously given consent for processing of their personal data for a purpose. The request would then require the company to stop the processing of the personal data that was based on the consent provided earlier.
5) Right to object
This right provides the data subject with the ability to object to the processing of their personal data. Normally, this would be the same as the right to withdraw consent, if consent was appropriately requested and no processing other than legitimate purposes is being conducted. However, a specific scenario would be when a customer asks that his or her personal data should not be processed for certain purposes while a legal dispute is ongoing in court.
6) Right to object to automated processing
This right provides the data subject with the ability to object to a decision based on automated processing. Using this right, a customer may ask for his or her request (for instance, a loan request) to be reviewed manually, because he or she believes that automated processing of his or her loan may not consider the unique situation of the customer.
7) Right to be forgotten
Also known as right to erasure, this right provides the data subject with the ability to ask for the deletion of their data. This will generally apply to situations where a customer relationship has ended. It is important to note that this is not an absolute right, and depends on your retention schedule and retention period in line with other applicable laws.
8) Right for data portability
This right provides the data subject with the ability to ask for transfer of his or her personal data. As part of such request, the data subject may ask for his or her personal data to be provided back (to him or her) or transferred to another controller. When doing so, the personal data must be provided or transferred in a machine-readable electronic format.
9.5 If you wish to exercise the rights mentioned above, please contact the person responsible for the protection of personal data using the following contact details:
- E-mail: alexandru.braescu@ligaac.ro
- Address: Timișoara, Timiș county, Romania, blvd. Vasile Pârvan, no. 2, room A021
9.6 You can also file a complaint regarding the processing of your data with the National Authority for the Processing and Supervision of Personal Data (B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania, www.dataprotection.ro, anspdcp@dataprotection.ro).
10. Information security
10.1 We are working hard to protect our website, App and users, as well as all personal data collected in accordance with this Policy, from any unauthorized access or from the modification, unauthorized disclosure or destruction of the information we hold.
10.2 In this regard:
- a. Liga AC certifies that it meets the minimum requirements for the security of personal data, the data being processed in a way that provides protection against unauthorized or illegal processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures;
- b. The used data storage systems have implemented back-up mechanisms to ensure the redundancy of the stored data.
- c. We are regularly reviewing the practices for collecting, storing and processing information, including physical information, as well as security measures, to prevent unauthorized access to the systems.
- d. We are restricting the access of our employees and contractors to your personal information, and the contractual relations with these persons are subject to strict rules regarding contractual confidentiality obligations, including under the sanction of termination of contracts.
11. When does this Privacy Policy apply?
Our privacy policy applies to all services provided by Liga AC and excludes services that have separate privacy policies and do not contain the provisions of this privacy policy.
12. Amendments
12.1 Our privacy policy may change, but we promise not to reduce your rights under these changes without your explicit consent. We will publish any amendment to the privacy policy on our webpage, an amendment which will come into effect within one day and, if the changes are significant, we will provide more prominent notification (including, for some services, email notification of privacy policy changes). We will also store earlier versions of this Privacy Policy in the archive so that it can be reviewed by you at any time.
12.2 The latest update of this policy was made on the 4th of January 2024.
STILL HAVE QUESTIONS?
