Privacy policy

1. Personal Data Controller:

The Association for Victims of Sexual Crimes, as the Data Controller, stores the personal data of the data subjects in good faith, in accordance with applicable legislation, fully respecting the principles of data processing for legitimate purposes, according to Article 5 of the EU General Data Protection Regulation (GDPR) and internal regulatory acts adopted for the implementation of the GDPR.

Personal Data:

Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or one or more specific elements that are unique to their physical, physiological, genetic, mental, economic, cultural, or social identity (such as age, gender, education level, etc.), as well as sensitive information such as religious, union, or ethnic affiliation, political opinions, biometric data, or information regarding physical or mental health. During interactions with representatives of the Association for Victims of Sexual Crimes, the following personal information provided will be processed both online and offline (in written form): name and surname, personal identification number, date and place of birth, some demographic characteristics (age, gender, education level, occupation, and ethnicity), image, signature, medical data, data from psychological evaluation reports/expert opinions, as well as various nonverbal responses/behaviors observed during interaction with the association's representatives.

Processing of personal data means any operation or set of operations performed on personal data or on sets of personal data, with or without the use of automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or making available by any other means, alignment or combination, restriction, deletion, or destruction.

The data subject is the natural person seeking support from the Association for Victims of Sexual Crimes, as well as employees, volunteers, contractors/consultants, website users, and research subjects.

Third parties are represented by any natural person or legal entity, public authority, which under the direct authority of the controller or the processor, are authorized to process personal data. In this case, third parties are represented by companies offering various services, such as but not limited to: hosting and maintenance of the association’s website, professional document archiving services.

Recipient can be any natural or legal person, public authority, agency, or other body to whom/which personal data is disclosed. In this case, the information obtained as a result of interaction with the data subject is disclosed to authorized persons as well as competent public authorities, and other empowered institutions upon request by the courts or criminal investigation bodies.

Consent means any freely given, specific, informed, and unambiguous indication of the data subject's wishes, by which they accept, by a statement or by a clear affirmative action, the processing of personal data communicated for the explicit purposes outlined below.

The act of contacting the Association, providing data about individuals and sensitive situations, requesting information and help represents a clear affirmative action expressing your consent for the Association to process your data to facilitate your access to justice. It is important to understand that once the Association is contacted in this regard, members directly involved with the case are legally obligated to further notify the responsible state authorities, and investigations may continue even if you change your mind and wish to withdraw the complaint or stop the proceedings.

2. Purpose of Personal Data Processing

All information will be collected and processed exclusively by the controller for the following purposes:

a) Supporting investigations into sexual offenses involving minor victims by all means;

b) Facilitating access to justice;

c) Conducting forensic interviews using standardized operational protocols and procedures focused on preventing the re-traumatization of the victim;

d) Providing appropriate psychological support for victims of sexual violence;

e) Research.

Processing sensitive data (such as information provided directly or indirectly by individuals who contact us or information derived from observing their behavior) involves certain privacy risks, such as unauthorized/accidental/unlawful disclosure. To minimize such a risk, information about minors can only be accessed by employees of the controller and other authorized, designated individuals who have undertaken confidentiality obligations regarding privacy and personal data. Also, to reduce such risks, the online and offline archive of professional documents is kept by an authorized person in secure, restricted-access conditions. The data controller guarantees that it processes your data under legitimate conditions, also implementing appropriate technical and organizational measures to ensure data integrity and confidentiality in accordance with Articles 25 and 32 of the GDPR.

Processing of information collected online and offline is performed in a non-automated manner to achieve the agreed purpose, without the intervention of any other person besides the specialist designated by the Association for Victims of Sexual Crimes.

Providing data is necessary to support you in the legal and psychological processes you seek to benefit from. If these personal data are not communicated to the Association, we cannot facilitate access to our resources.

3. Legal Grounds for Processing Personal Data:

Your personal data is processed by the Association for Victims of Sexual Crimes as follows:

• Based on consent, the data subject's information is provided to the Association, which reviews the situation and decides whether it should exercise its legal right and obligation to notify state authorities with specific responsibilities: police, prosecutor's office, etc.

• To fulfill a legal obligation, according to Article 6(1)(c), such as drafting documents on behalf of and/or for the Beneficiary, submitting requests/documents to courts/institutions/authorities/organizations and individuals/legal entities in Romania as a legal representative; fulfilling fiscal obligations and settlements with funders;

• For protecting the vital interests of the data subject, under Article 6(1)(d), in the event of alerting competent authorities in cases of abuse involving vulnerable persons or minors;

• To fulfill a public interest task: investigating sexual offenses involving victims, implementing a sexual abuse notification system through social networks, national monitoring of forms of sexual violence, tracking recidivism among sexual offenders;

• In the legitimate interest of the Controller, under Article 6(1)(f) of the GDPR, for internal documentation necessary for specific services, video surveillance of the premises to ensure the security of goods and people, processing of personal data for the purpose of representing the organization before the courts and public authorities, respectively exercising its legitimate rights of defense.

4. Data Retention Period:

Personal data will be retained in a form that allows the identification of data subjects, both online and offline, in accordance with legal conditions and provisions, for an indefinite period, given that under Article 153 of the Criminal Code, the statute of limitations does not remove criminal liability for offenses specified in Articles 218-220 (rape, sexual assault).

Video surveillance data for security purposes will be stored for 30 calendar days, in line with applicable legislation.

Results of psychological assessments/evaluations/expert opinions may be retained in anonymized form indefinitely, solely for archival purposes, scientific research, or statistical purposes.

5. Authorized Persons / Recipients / Associated Processor:

Your personal data may be processed by the following persons, strictly in accordance with data protection laws:

Service providers such as, but not limited to, IT service and system providers, contractual partners (lawyers, psychologists, consultants, accountants who are bound by confidentiality obligations regarding the transmitted data), judicial system partners of the Association (police officers, prosecutors, judges, psychologists, doctors) who are bound by their own professional codes of confidentiality, and informed by similar notes as this one about specific obligations in accordance with the GDPR. If the authorized persons subcontract part of the activities involving the processing of personal data, the subcontractors will be subject to the same obligations regarding the implementation of security, technical, and organizational measures provided by the GDPR for data protection, as well as the internal normative acts approved for GDPR implementation.

6. Transfer of Personal Data:

If personal data processing is carried out via electronic communication services (email), your data may be transferred to entities outside the EU that have the necessary authorizations to process data under security conditions recognized and/or accepted at the EU level (for example, entities with Privacy Shield certifications that can be made available to interested persons or entities).

7. Your Rights Regarding Personal Data:

We would also like to inform you that, according to Articles 12-22 of the GDPR and the internal normative acts approved for implementing the EU General Regulation, you have the following rights:

• the right to be informed and to access your personal data;

• the right to rectify your data;

• the right to be forgotten / the right to data erasure;

• the right to restrict processing;

• the right to data portability;

• the right to object to the processing of your data, in the case of personal data processed under Article 6 paragraph 1) letter e) or f), including profiling based on these provisions, either for performing a task carried out in the public interest or in the exercise of official authority vested in the Controller, or for the legitimate interests pursued by the Controller;

• the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing or any competent courts.

Note! Please be aware that, in accordance with Article 17 paragraph (3) of Regulation 679/2016, the right to data erasure ("right to be forgotten") does not apply to the extent that processing is necessary:

• for compliance with a legal obligation requiring processing under EU or Member State law applicable to the Controller or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;

• for the establishment, exercise, or defense of legal claims.

You also have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent prior to withdrawal.

To exercise these rights, you can contact the Association for Victims of Sexual Crimes with a written, dated, and signed request sent to the registered office address in Constanța, str. Calafatului, no. 16, Constanța county, or by email at asociatiapentruvis@gmail.com.

Your request will be reviewed, and a response will be provided within 30 days of receiving it, in compliance with the GDPR and the internal normative acts approved for implementing the EU General Regulation.

We will make every effort to maintain a harmonious relationship with the data subjects, with the representatives of parental responsibility, with our collaborators, and with our partners. However, if you consider it necessary, you may lodge a complaint regarding the data processing activity by the Association with the competent supervisory authority, ANSPDCP, located at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest.

On certain occasions, the Association for Victims of Sexual Crimes may change its personal data processing policy to reflect changes in legislation, our data handling and use practices, website features, or technological processes. The updated version of this information notice will be made available on the Association’s website, which we recommend you visit periodically.

If you want to talk about sexual violence with a professional ready to help, send an email to: help@asistentavictime.ro