1. Purpose
This GDPR Policy sets out the principles and internal measures that Asociația Clusterul de Excelență în Securitate Cibernetică (CYSCOE) applies to all processing of personal data carried out in the course of its activity: the website, correspondence, membership, working groups, events and projects. Details of the processing carried out through the website are given in the Privacy Policy.
2. Legal framework
- Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR);
- Law no. 190/2018 on measures implementing the GDPR;
- Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, as amended (cookies and electronic communications);
- the guidelines of the European Data Protection Board and the decisions of the Romanian supervisory authority (ANSPDCP).
3. Data controller
Asociația Clusterul de Excelență în Securitate Cibernetică (CYSCOE), Bd. Mareșal Alexandru Averescu nr. 8-10, et. 1, cam. 104, sector 1, 011455 București, Romania, [email protected]. Responsibility for compliance lies with the Board of Directors of the association.
4. Principles we apply
- Lawfulness, fairness and transparency: every processing activity has a legal basis and is described in plain language.
- Purpose limitation: data is used only for the purposes for which it was collected.
- Data minimisation: we collect only what we need; forms contain only the necessary fields.
- Accuracy: we correct inaccurate data as soon as we become aware of it.
- Storage limitation: we apply defined retention periods and delete data when they expire.
- Integrity and confidentiality: we protect data through security measures appropriate to the risk.
- Accountability: we document our processing and can demonstrate compliance.
5. Records and retention
CYSCOE keeps an internal record of its processing activities. The main retention periods are:
| Data | Retention |
|---|---|
| Server and security logs | up to 90 days, unless needed for an incident |
| Website statistics (Google Analytics, with consent) | at most 14 months |
| Contact form entries stored on the website | deleted at least once every 12 months |
| Correspondence | up to 3 years after the last exchange |
| Newsletter subscriptions | until unsubscription |
| Member records | duration of membership plus up to 3 years |
| Accounting documents | as required by accounting law |
| Consent choices (cookies) | 365 days |
6. Processors
We use service providers for hosting, content delivery and security, email, analytics and website maintenance. We choose providers that offer sufficient guarantees, we conclude data processing terms with them in accordance with Article 28 GDPR, and we review them when our needs change. Transfers outside the European Economic Area take place only on the basis of an adequacy decision (including the EU-U.S. Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.
7. Security measures
- HTTPS encryption for the entire website;
- web application firewall and limitation of abusive requests;
- administrative accounts limited to the persons who need them, with individual accounts;
- regular updates of the platform and plugins;
- backups and restore procedures;
- consent management for non-essential cookies;
- confidentiality obligations for members through the non-disclosure agreement signed on joining.
8. Data protection by design and by default
When we introduce a new tool, form or service, we assess what data it collects, whether it is necessary and how it can be limited. Non-essential cookies are disabled by default, and new forms collect only the fields required for their purpose. Where a processing activity is likely to result in a high risk, we carry out a data protection impact assessment in accordance with Article 35 GDPR.
9. Requests from data subjects
Requests to exercise GDPR rights are received at [email protected], recorded and answered within one month, extendable by two months for complex requests. Where there are reasonable doubts about the identity of the requester, we ask for the minimum information needed for verification.
10. Personal data breaches
Any suspected breach is analysed without delay. If the breach is likely to result in a risk to the rights and freedoms of the persons concerned, we notify ANSPDCP within 72 hours of becoming aware of it, and, where the risk is high, we inform the persons concerned. All breaches are documented internally, regardless of whether they are notified.
11. Data Protection Officer
CYSCOE has not appointed a Data Protection Officer, as its core activities do not involve large-scale regular and systematic monitoring or large-scale processing of special categories of data (Article 37 GDPR). We reassess this whenever our activity changes.
12. Special categories of data and children
We do not intentionally process special categories of personal data (Article 9 GDPR) or data about criminal convictions, and we ask you not to send such data through the website. Our activity is not addressed to children under 16.
13. Supervisory authority
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, sector 1, 010336 București, Romania, [email protected], www.dataprotection.ro.
14. Review
This policy is reviewed at least once a year and whenever processing changes. The Romanian version prevails in case of any discrepancy between language versions.
