privacy-policy

We continuously strive to ensure the confidentiality and security of your personal data.

The lawfulness, transparency and fairness of every processing operation are a priority for us. We therefore invite you to read this Privacy Policy carefully and in full.

Information About the Personal Data Controller

The controller processing personal data through the “Adoptă un Copac!”Website is ViitorPlus – Association for Sustainable Development(hereinafter referred to as “ViitorPlus”), with its registered office at 24 Rondă Street, attic, room 2, District 2, Bucharest, Tax Identification Number: 18654032, registered with the District 2 Court under No. 10134/14.10.2016.

The controller can be contacted by email at [email protected].

What Does “Processing” Mean Under Regulation (EU) 2016/679 (GDPR)?
svg
mailto:[email protected]

“Processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Data Collected by ViitorPlus, Depending on the Method and Purpose of the Communications Received

Accessing and browsing this Website is not conditional upon Users—the data subjects—providing personal data.

Providing personal data is necessary only when Users wish to make donations to ViitorPlus and financially support its afforestation activities.

Any collection and processing of personal data is carried out with the implied consent of the User who creates an account and/or subsequently communicates with, through or on the Platform.

Any User who does not agree with the processing methods described below is asked not to take any action that necessarily involves the prior collection and processing of their personal data.

Based on information voluntarily provided by the data subject, ViitorPlus collects the personal data required to register a User account.

The types of data processed depend on how the data subject chooses to use the Platform/application and on the manner and purpose for which they contact the controller:

Creating a User account, whether or not followed by communications with, on or through the Platform/application;
Requesting information of any kind, making one-off or recurring requests for offers, receiving offers, or submitting a CV for recruitment purposes;
Submitting requests, complaints or notifications concerning their personal data; providing feedback about services delivered through the Platform/application; reporting irregularities in communications made by other Users; or contacting ViitorPlus employees, representatives or partners regarding collaboration terms or other matters relevant to ViitorPlus and activity on the Platform.

ViitorPlus may also collect, without active input from the data subject, other data that does not uniquely identify them, including the time of the visit, the location from which the Website is accessed, the name and version of the internet browser, the operating system and other technical parameters provided by the browser used to access the Website. Such information will not be used to identify Website visitors and will not be made public except under the conditions described in this Privacy Policy.

1. When creating a User account by completing the registration form, the data subject provides: last name (required), first name (required), email address (required), telephone number (required), and date of birth (optional).
2. Through searches performed on the Platform and/or by selecting search criteria based on the relevance of the information available on the Platform to the User.
3. By sending messages of any kind or making telephone calls using the contact details available on the Platform/application, the data subject provides the contact information associated with their chosen communication method and, where applicable, other information such as gender, year of birth or age, insofar as this may be inferred from their name or email address. They may also provide any information included in the message itself.
  Providing a first and last name is optional, except when submitting a CV or making requests, complaints or notifications concerning personal data, as such communications require appropriate prior identification in accordance with this Privacy Policy.
4. By submitting a CV using the contact details provided, the data subject supplies the following information: first and last name, gender, age, telephone number (optional), email address (optional where the CV is submitted in physical form at the organisation’s registered office and a contact telephone number is provided), address (optional), the names of former employers and positions held, and educational background.
  Any information provided in addition to the data listed above is submitted solely at the data subject’s own initiative.
5. By enabling the marketing Cookies used by our Website in order to receive offers and information about new services, products, promotions and similar communications, including newsletters, the data subject provides the information specified in the Cookie Policy available on the Website. In this case, please consult the Cookie Policy.
6. When submitting requests, complaints or notifications concerning their personal data, either directly or through an authorised representative, the data subject provides their first and last name, the contact details associated with the chosen communication method, or alternative contact details if they wish to receive updates regarding the request, complaint or notification through a different channel from the one originally used to contact the controller.
  The data subject may also provide other information that can be inferred from their first name or email address, as well as an additional identifying attribute. Where an authorised representative acts on their behalf, proof of the representative’s authority and the representative’s identification details may also be required, solely under the conditions described below in the section “Requests, Complaints and Notifications Concerning Personal Data – Management, Resolution, Communication and Cooperation.”

No data associated with a User account, including the User’s first name, last name or username used for communications made on, to or through the Platform, will be made public or accessible to other Platform Users. Any exception to this Privacy Policy will apply only in the cases and under the conditions provided by law.

Purpose of Data Collection and Processing:

To respect and ensure the effective exercise of all rights and legitimate interests of data subjects;
To ensure the optimal operation of the Platform in accordance with its purposes, as described in the Terms and Conditions available on this Platform/application, and, within objectively reasonable limits, to ensure the accuracy and relevance of all information and data available on the Platform/application;
To manage and resolve any requests, notifications, complaints or proposals received through the contact forms or the communication addresses provided, including responding according to their nature and fulfilling the controller’s obligations under the GDPR, national data protection legislation and the requirements of the supervisory authority;
To communicate our service offerings, provide information about the locations where we operate, initiate partnerships in areas related to the purposes of the Platform/application, and increase the visibility of campaigns and promotions organised by ViitorPlus;
To continuously improve our products and services, partnerships of all kinds, and our security and privacy measures and policies;
To fill vacant positions and recruit volunteers and partners of any kind.

Specifically:

Data provided by the data subject in accordance with points 1 and 2 referred to above is used to establish a minimum level of authenticity for contributions of any kind made to the Platform. The data will be associated with a unique User account and may facilitate:
Responding to the User’s requests or notifications of any kind;
Preventing content prohibited by law or by the Terms and Conditions from being added to the Platform/application, including by restricting the access of Users who do not act honestly and in good faith, moderating their communications on, to or through the Platform, and taking other similar measures;
Allowing Users to share their own activity on the Platform or relevant Platform content through other websites, online platforms or applications.
Processing this data may also help prevent criminal offences or actions that could harm or otherwise infringe the rights and legitimate interests of ViitorPlus, Platform/application Users or third parties. This includes, for example, the dissemination of false and defamatory statements concerning a competitor operating in a field related to the purposes of the Platform.

The data provided in accordance with points 3 and 4 above will be used to respond to the request submitted, schedule a pre-employment interview, or establish a working relationship under a Volunteer Agreement through:

Contacting the data subject by email or, where appropriate, by telephone;
If the only contact detail provided by the data subject is their postal address, through written correspondence;
If the only contact detail provided is a telephone number and the request is complex, requiring extensive communication that cannot reasonably be provided by telephone, ViitorPlus may ask the applicant to provide an email address. Providing an email address remains entirely optional, and declining to do so will not prevent ViitorPlus from providing any information that can reasonably be communicated by telephone.

The data provided by the data subject in accordance with point 5 above will be processed for the purposes and under the conditions detailed in the Cookie Policy available on this Platform/application.

The data provided by the data subject in accordance with point 6 above will be used to verify their identity appropriately and reasonably, carry out the necessary checks, adopt appropriate measures, and provide the data subject with a response or relevant information under the conditions described in the section “Requests, Complaints and Notifications Concerning Personal Data – Management, Resolution, Communication and Cooperation” of this document.

If negative feedback is submitted by an individual, ViitorPlus will make every reasonable effort to investigate the matter, remedy the situation where appropriate, and provide the data subject with an adequate response.
The processing required to provide such a response is based on the controller’s legitimate interest in ensuring the optimal operation of the Platform/application, collaborating effectively with its clients and potential clients through the Platform/application, maintaining its reputation and public image, and verifying that its employees, representatives and volunteers acting on behalf of the association comply in their relationships with third parties with applicable laws, the controller’s internal regulations, its personal data policies, and generally accepted standards of morality and proper conduct.

At reasonable intervals—generally every six months—or at other times determined by specific circumstances, including but not limited to the introduction of new services, the recruitment of new staff or volunteers, or events related to the Platform/application that indicate a need for feedback, the controller may invite Users to provide feedback on any aspect of the products or services offered and how they are delivered, as well as to submit suggestions for improving those services.

Legal Bases for Data Processing by the Controller

ViitorPlus processes personal data provided through the “Adoptă un Copac!” Platform for the following purposes and on the following legal grounds:

On the basis of the User’s implied and unequivocal consent to create a User account, perform searches within the application/Platform, or make communications of any kind on, to or through it;
On the basis of the User’s express consent, for marketing purposes, including the delivery of periodic updates and email notifications;
On the basis of the controller’s legitimate interest in presenting its products and services, including online; responding to requests of any kind submitted by data subjects; and maintaining its reputation and public image. This interest is subject to the overriding interests of the Platform/application’s end users to receive accurate information and benefit from high-quality products and services;
On the basis of the controller’s legal obligations arising from the nature of its online activities, its field of activity and the GDPR.

Duration of Processing

Personal data collected through the Platform/application and processed by ViitorPlus or its partners is retained for a specific period, depending on the purpose for which it was collected:

Data associated with the User account, search history, and information collected about the User’s preferences regarding the relevance of content available on the Platform/application: until the User account is deleted;
Data collected by the controller without active input from the data subject: for three years from the date of collection;
Data collected through communications sent by data subjects using the contact details provided on the Website or through the application: for five years from the date of collection;
Data contained in CVs submitted for recruitment purposes: for one year from the date of collection. By exception, the CVs of successful candidates will be included in their personnel files and retained for the performance of the employment agreement. Following termination of the employment relationship, regardless of the reason, they will be retained for 75 years, in accordance with the retention period established by Law No. 16/1996 on the National Archives, as republished.
Data contained in CVs submitted with a view to concluding a Volunteer Agreement: for one year from the date of receipt, unless such an agreement is concluded. In that case, the data will be retained for the entire duration of the agreement and for three years following its termination, regardless of the reason;
Data processed for marketing purposes on the basis of consent: until the data subject withdraws their consent.
Data contained in documents that enable the controller to demonstrate to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) how requests, complaints or notifications submitted by the data subject, either personally or through an authorised representative, were handled, how consent was obtained, and other related matters, will be retained for at least three years, regardless of any other retention period established for the processing. Such data will be retained solely to allow the controller to demonstrate to ANSPDCP that the processing was carried out lawfully and that the data subject’s rights were respected.

Rights of the Data Subject, Methods of Exercise, and ViitorPlus Measures and Safeguards

Every data subject has the following rights in relation to the personal data controller:

The right of access means the data subject’s right to obtain confirmation from ViitorPlus as to whether or not personal data concerning them is being processed. Where such data is being processed, the data subject may obtain access to the personal data and information about how it is processed.
The right to data portability means the right to receive personal data in a structured, commonly used and machine-readable format and to have that data transmitted directly to another controller, where technically feasible.
The right to object means the data subject’s right to object to the processing of personal data where the processing is necessary for the performance of a task carried out in the public interest or is based on the controller’s legitimate interests. Where personal data is processed for direct marketing purposes, the data subject has the right to object to such processing at any time.
The right to rectification means the right to have inaccurate personal data corrected without undue delay. The rectification will be communicated to every recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort on the part of ViitorPlus.
The right to erasure (“the right to be forgotten”) means the data subject’s right to request the deletion of their personal data without undue delay where one of the following grounds applies:
The data is no longer necessary for the purposes for which it was collected or processed;
The data subject withdraws their consent and there is no other legal ground for the processing;
The data subject objects to the processing and there are no overriding legitimate grounds for continuing it;
The personal data has been processed unlawfully;
The personal data must be erased to comply with a legal obligation;
The personal data was collected in connection with the provision of information society services.
The right to restriction of processing may be exercised in any of the following circumstances:
The data subject contests the accuracy of the personal data processed by ViitorPlus, for a period enabling the controller to verify its accuracy;
The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
ViitorPlus no longer requires the personal data for processing purposes, but the data subject needs it for the establishment, exercise or defence of legal claims;
The data subject has objected to the processing, pending verification of whether ViitorPlus’s legitimate grounds override those of the data subject.
The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing

If a data subject considers that their rights under Regulation (EU) 2016/679 have been infringed, they may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

The contact details of ANSPDCP are as follows:

Address: 28–30 General Gheorghe Magheru Boulevard, District 1, Bucharest, postal code 010336;
Telephone: +40 318 059 211 / +40 318 059 212;
Fax: +40 318 059 602;
Email: [email protected];

Website: www.dataprotection.ro

By completing the forms available on the “Adoptă un Copac!” Platform, each User or, where applicable, client understands and agrees that the controller and its partners may process their personal data for the purposes stated in this Privacy Policy, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), and Law No. 190/2018 on measures for implementing Regulation (EU) 2016/679.

When processing personal data, ViitorPlus and any of its partners will act lawfully, fairly and transparently, in compliance with all principles established by applicable legislation. Personal data will be processed for specified, explicit and legitimate purposes.
The processing will be adequate, relevant and limited to what is necessary for the purposes for which the data was collected. Personal data will be retained only for as long as necessary to fulfil those purposes and will be processed in a manner that ensures its appropriate security and integrity.

ViitorPlus will not transfer data collected through the Website outside Romania. Access to this data may be granted to the external IT service provider and to any other external service providers engaged to ensure the optimal operation and security of the Platform/application or for marketing purposes.

__________________________________________________________________________________

To ensure the lawful processing of personal data, ViitorPlus assumes responsibility for implementing appropriate technical and organisational measures to protect personal data against unauthorised access, use, alteration or destruction, in accordance with applicable national and international data protection legislation.

Printre aceste măsuri de securitate se numără (fără a se limita la) – securizarea spațiilor de stocare fizice/digitale a datelor (chei, parole, alerte de securitate, notificări de accesare sistem, antivirus), limitarea accesului la date strict la persoanele cu atribuții specifice în raport de scopul prelucrării, informarea, responsabilizarea și îndrumarea adecvată a angajaților, partenerilor, colaboratorilor cărora li se permite accesul la date, stabilirea unor atribuții specifice în contractele și fișele de post ale angajaților, încheierea unor Acorduri de confidențialitate cu colaboratorii externi/departamentele externalizate/furnizorii de servicii și orice alte persoane cărora li se permite accesul la date sau li se transferă date, asigurarea nedivulgarii niciunei date aferente contului de utilizator la momentul la care un utilizator face orice tip de comunicare către/prin platformă/aplicație și verificarea prealabilă a comunicărilor către/prin platformă/aplicație pentru a asigura că acestea nu divulga date personale. Utilizatorul care transmite conținutul supus cenzurării din prisma GDPR, nu poate opune față de ViitorPlus libertatea sa de expresie. Orice utilizator înțelege și acceptă că orice situație litigioasa care sta la baza divulgării în conținutul comunicărilor sale a unor date cu catacter pesonal trebuie făcută de autoritățile competente.

ViitorPlus will not disclose personal data collected through the methods described above, except to authorised employees, ViitorPlus processors or ViitorPlus partners who require access to the data in order to process it on ViitorPlus’s behalf, including for the provision of services, ensuring that data subjects receive complete and accurate information, and sending marketing communications.

Personal data may also be disclosed where such disclosure is required by law or results from a lawful request issued by a competent authority and addressed to ViitorPlus and/or its partners, collaborators or employees.
Requests, Complaints and Notifications Concerning Personal Data and Security Breaches – Management, Resolution, Communication and Cooperation

Any requests, complaints or notifications concerning personal data must be submitted to the controller in writing, using one of the contact methods available on the Website. The data subject must also provide a contact address to which the response and any related updates can be sent in writing.
The same procedure will apply to any subsequent requests or communications concerning a previously submitted request, complaint or notification.

When submitting any request, complaint or notification, the applicant must provide appropriate proof of identity. This is necessary to prevent any breach of data confidentiality, the adoption of measures at the request of unauthorised or ineligible persons, or any risk to or infringement of the rights and legitimate interests of the data subjects whose personal data is concerned.

Where a request is submitted through an authorised representative, ViitorPlus will also appropriately verify the representative’s identity and authority to act, including, where necessary, directly with the data subject.

Requests submitted by telephone, or requests for which the data subject’s telephone number is the only available contact detail, will not be considered until they are submitted in writing under the conditions described above. Likewise, where the circumstances of a request give the controller reasonable grounds to question the applicant’s identity or the lawfulness of the request, the controller may suspend its resolution until reasonable additional information or documentation is provided to verify the applicant’s identity and/or authority to act.

These requirements arise from our legal obligation and legitimate interest in demonstrating that we respect your rights under the GDPR and all applicable data protection legislation.

Every request will be resolved within 30 days of receipt.

The response and any related communications will be sent in writing to the data subject or their authorised representative using the same method through which the controller received the request. For example, a request submitted by email will receive a response by email, while a request submitted by post will receive a response by post. The response may also be sent through another written communication method expressly and reasonably requested by the data subject or their authorised representative.

A personal data breach is a breach of personal data security, such as unauthorised processing carried out through any of the operations included in the definition of processing above.

In the event of a personal data breach, the controller will notify ANSPDCP without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

Where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller will also inform the affected data subject appropriately, in accordance with the law and without undue delay.

By exception, the data subject will not be informed of a personal data breach where:

a) Appropriate technical and organisational protection measures have been implemented regarding the personal data affected by the breach, rendering the data unintelligible to any person who is not authorised to access it;

b) The controller has taken subsequent measures ensuring that the high risk to the rights and freedoms of the affected data subjects is no longer likely to materialise;

c) Informing the data subject would involve disproportionate effort. In this case, a public announcement will be made through the controller’s Website and, where appropriate, through another method considered necessary by ANSPDCP or capable of informing the affected data subjects in an equally effective manner.

Before and during the resolution of any request, complaint or notification, as well as in the event of any personal data breach, the controller’s relationship with the data subject and the Supervisory Authority will be characterised by transparency and a willingness to cooperate.

Changes to the Privacy Policy

If these privacy rules need to be amended, ViitorPlus will publish the relevant changes to ensure that complete and accurate information is provided about the data collected and how it is used.

Version published in June 2020

“Adoptă un Copac” Programme

Version 1.0 – Last updated: 9 November 2025

Chapter I – Introduction and Identity of the Controller

ViitorPlus respects the privacy and personal data of everyone who interacts with the “Adoptă un Copac” programme, whether through the www.adoptauncopac.ro Website or by participating in volunteering activities, donations, sponsorships or field events.

Through this Privacy Policy, we explain how we collect, use, store and protect personal data, as well as the rights available to each data subject. This document is based on the principles established by Regulation (EU) 2016/679 on the protection of natural persons concerning the processing of personal data (GDPR) and Law No. 190/2018 on measures for its implementation in Romania.
The Privacy Policy complements the Internal GDPR Procedures Manual – Adoptă un Copac and reflects ViitorPlus’s commitment to ensuring
transparency, lawfulness and accountability in all activities involving personal data.

1.1. Who We Are

The data controller responsible for processing personal data collected through the “Adoptă un Copac” programme is:

ViitorPlus – Association for Sustainable Development

Registered in the Register of Associations and Foundations maintained by the District 2 Court, case file No. 26749/300/2022.

Tax Identification Number: RO18654032 Registered office: 24 Ronda Street, attic, room 2, District 2, Bucharest

Correspondence address:

22–24 Calea Șerban Vodă, District 4, Bucharest, postal code 040201
General email address: [email protected]
Data protection email address: [email protected]
Websites:www.viitorplus.ro /www.adoptauncopac.ro
Legal representative: Teia Ciulacu, President

1.2. Scope

This Policy applies to all categories of natural persons whose data may be collected, stored or used by ViitorPlus through the “Adoptă un Copac” programme, including:

Volunteers and participants in seedling planting and maintenance activities or environmental education initiatives;

Donors and sponsors;

Collaborators, temporary employees and day labourers;

Institutional partners and their representatives;

Visitors to the www.adoptauncopac.ro Website or the social media pages associated with the programme.

1.3. Purpose of the Policy

The purpose of this Policy is to provide all data subjects with clear and complete information regarding:

The types of personal data collected;

The purposes and legal grounds for processing;

The data retention periods;

The rights of data subjects and how they may exercise them;

The categories of recipients and the measures used to protect the data;

The use of photographs and video materials produced as part of the project.

This Policy is for informational purposes and does not amend the rights or obligations established through volunteer agreements, employment contracts or other documents concluded with data subjects.

1.4. Our Data Processing Principles

ViitorPlus applies the following principles to all personal data processing activities:

Lawfulness, fairness and transparency – all processing activities are based on a clear legal ground and are communicated openly to data subjects.
Purpose limitation – personal data is used exclusively for the purposes defined in this Policy.
Data minimisation – we collect only the information that is strictly necessary.
Accuracy – we ensure that personal data is accurate and kept up to date.
Storage limitation – we retain personal data only for as long as necessary.
Integrity and confidentiality – we implement appropriate security measures to protect personal data.
Accountability – we demonstrate compliance with GDPR principles by documenting all processing activities.

1.5. How to Contact Us

For any questions, clarifications or requests concerning the processing of personal data, you may contact the designated Data Protection Officer at:

[email protected]or by post at:
ViitorPlus – Association for Sustainable Development
For the attention of the Data Protection Officer (DPO)
22–24 Calea Șerban Vodă, District 4, Bucharest, postal code 040201

We are committed to responding to all requests within the statutory period of 30 days.

Chapter II – What Data We Collect and for What Purposes

ViitorPlus collects and processes personal data only to the extent necessary to carry out the activities of the “Adoptă un Copac” programme.

Personal data may be collected directly from the data subject through the www.adoptauncopac.ro online Platform, during field events, through electronic correspondence, contracts or participation forms.

2.1. Categories of Data Subjects

https://www.adoptauncopac.ro/

This Policy applies to all categories of natural persons whose data may be processed by ViitorPlus, including:

Volunteers and participants in planting activities, environmental education initiatives or related activities;

Individual donors and sponsors;

Representatives of partner legal entities;

Collaborators, temporary employees and day labourers;

Website visitors and Users of the online Platform.

2.2. Types of Personal Data Collected

Depending on the nature of the relationship with ViitorPlus, the following categories of personal data may be collected:

a) Volunteers and participants:

Identification data: first and last name, Personal Numerical Code (CNP), identity card series and number;

Contact details: address, email address and telephone number;

Photographs and/or video recordings captured during activities;

Affiliated institution, location and age, where relevant;

Dietary preferences for logistical purposes, such as allergies or special dietary requirements;

Signature, participation date and confirmation of consent.

b) Individual donors and sponsors:

First and last name, email address and postal address, for issuing symbolic certificates;

Transaction data: amount, date, payment method and partial IBAN;

The donor’s or sponsor’s image, name or logo, where they have chosen to be mentioned publicly;

Messages or dedications voluntarily included in the donation form.

c) Partners and collaborators:

Representatives’ contact details: name, position, email address and telephone number;

Signatures and identification data included in contracts;

Other data provided for the purpose of managing the partnership.

d) Permanent and temporary employees and day labourers:

Identification data: first and last name, Personal Numerical Code (CNP), address, identity card series and number;

Contact details, signature and banking information, where applicable;

Photographs and video recordings where their activities involve participation in public events;

Information concerning the work performed and the duration of the collaboration.

e) Visitors to the online Platform:

IP addresses, session identifiers, Cookie preferences, and device and browser types;

Information voluntarily provided through contact forms, newsletter subscriptions or the creation of a Website account.

2.3. Purposes of Personal Data Processing

ViitorPlus processes personal data for legitimate, clearly defined purposes that are communicated transparently to data subjects. The main purposes are:

Organising and carrying out activities under the “Adoptă un Copac” programme – registering participants, managing volunteers, communicating logistical information, confirming attendance and coordinating field activities.
Managing donations and sponsorships – processing payments, issuing fiscal and administrative documents, sending confirmations and symbolic certificates, and complying with legal financial reporting obligations.
Communication and information – sending information about events, campaigns, results, educational activities or opportunities to get involved, exclusively to individuals who have provided their consent.
Promoting the project, its results and the partners involved – using photographs and video materials produced during programme activities to illustrate its impact and promote it through the media, ViitorPlus’s official Websites and pages, and the social media pages of partners, donors or sponsors.

Photographs and video materials may be used in public reports, awareness campaigns, educational presentations, leaflets, brochures or press releases.

In all cases, the principles of proportionality and respect for the dignity of the data subject will be observed.

Compliance with legal obligations – maintaining accounting records, preparing financial reports, and complying with legislation governing volunteering, temporary employment contracts and taxation.
Internal analysis and programme improvement – evaluating participation, preparing internal statistics using aggregated or anonymised data, and planning future campaigns.

2.4. Legal Basis for Processing

Depending on the purpose of the processing, personal data is processed on one or more of the legal grounds provided by Regulation (EU) 2016/679:

Article 6(1)(a) – the data subject’s consent, including for the use of their image, newsletter subscriptions and direct communications;

Article 6(1)(b) – the performance of a contract or a volunteering, employment or collaboration relationship;

Article 6(1)(c) – compliance with a legal obligation, such as accounting and tax reporting or the maintenance of official records;

Article 6(1)(f) – the controller’s legitimate interests, including promoting public activities, managing relationships with partners and maintaining the transparency of the project.

In all cases, ViitorPlus ensures that the fundamental rights and freedoms of the data subject take precedence over any legitimate interest invoked.

2.5. Photographs, Video Materials and the Consent of Data Subjects

Photographs and video materials may be produced during activities carried out under the “Adoptă un Copac” programme for the purpose of documenting, reporting on and promoting the project’s results. These materials are used exclusively for legitimate purposes, including:

.. Promoting the programme and ViitorPlus’s activities through its own channels, including its Website, social media pages, public reports and presentations;

Sharing the project’s results and impact through partners, sponsors, donors or volunteers;

Providing visual reports to funding entities in connection with partnerships and sponsorship agreements.

Photographs and video materials are processed and published only with the data subject’s explicit consent, provided by signing a dedicated form in accordance with the annexes to the GDPR Procedures Manual.

For minors, visual materials may be collected and used only with the written consent of a parent or legal guardian. ViitorPlus undertakes to comply with the enhanced protection principles established by the GDPR for this category of data subjects.

2.6. Indirect Collection and Publicly Available Data

In certain cases, personal data may be collected indirectly, for example through partners, sponsors or educational institutions registering groups of participants. In such situations, ViitorPlus ensures that:

There is a valid legal basis for transferring the data;

Data subjects are informed before participating;

The data is used exclusively for the stated purposes.

Chapter III – Who We Share Data With and How We Protect It

ViitorPlus takes the confidentiality of personal data extremely seriously and ensures that any transfer of or access to such data takes place securely and is governed by written commitments to comply with data protection legislation.

Personal data collected through the “Adoptă un Copac” programme may be shared with third parties exclusively for the legitimate purposes described in this Policy and within the limits established by law.

3.1. Categories of Recipients

ViitorPlus may share or make certain personal data available to the following categories of recipients, strictly limited to what is necessary:

a) Programme Partners and Sponsors

Companies, foundations, public institutions or other organisations that provide financial or logistical support to the “Adoptă un Copac” programme;

For the purpose of promoting the project’s results, publishing reports and carrying out joint activities;

Personal data is shared only under a contract or partnership agreement containing confidentiality and data protection clauses.

b) Service Providers and Processors

IT service providers, including web hosting, database management and Platform maintenance providers;

Payment and financial service providers, such as Netopia, EuPlatesc or other authorised processors. ViitorPlus does not store payment card data;

Providers of communication, email marketing, logistics, courier, accounting or legal consultancy services;

In all cases, the relationship is governed by a Data Processing Agreement (DPA), in accordance with Article 28 of the GDPR, clearly defining the responsibilities of each party.

c) Public Authorities and Supervisory Bodies

Where there is a legal reporting obligation, including towards tax authorities, the National Agency for Fiscal Administration (ANAF), the Ministry of Environment, the Territorial Labour Inspectorate or ANSPDCP;

The data shared is strictly limited to what is necessary to fulfil the relevant legal obligation.

d) The General Public

Only photographs, video materials or testimonials used to inform the public about and promote the activities of the “Adoptă un Copac” programme;

Publication takes place exclusively with the data subject’s prior, documented consent and in accordance with the principles of proportionality and respect for human dignity.

3.2. Rules Governing the Sharing of Data with Partners and Sponsors

Personal data may be shared with programme partners and sponsors only where:

It is strictly necessary for reporting on the project’s results, activities or impact;

The purpose of the processing is compatible with the purpose for which the data was originally collected;

The partners comply with GDPR requirements and have implemented appropriate technical and organisational measures;

ViitorPlus has entered into a confidentiality agreement with them or included a specific data protection clause in the relevant contract.

Photographs and video materials may be used by sponsors or donors exclusively for the joint promotion of the programme, provided that the data subjects have given their written consent.

3.3. International Data Transfers

ViitorPlus does not currently transfer personal data to countries outside the European Economic Area (EEA).

of IT platforms that store data outside the EEA—ViitorPlus will ensure that appropriate safeguards are in place in accordance with Article 46 of the GDPR, including:

Standard Contractual Clauses approved by the European Commission;

European Commission adequacy decisions concerning the relevant country;

Additional technical measures, such as encryption, pseudonymisation and access restrictions.

Data subjects will be informed in advance, and transfers will take place only where strictly necessary for the stated purpose.

3.4. Security Measures

ViitorPlus implements appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access, alteration or disclosure.

These measures include, without limitation:

Secure authentication for access to databases and internal systems;

Complex password policies and regular password changes;

Data encryption and anonymisation where possible;

Physical and digital access controls for documents and equipment;

The use of up-to-date antivirus and firewall solutions;

Regular data protection training for staff and collaborators;

.. Applying the “need-to-know” principle, under which access is granted only to individuals who require the data to perform their duties;

Monitoring and documenting security incidents in accordance with the internal GDPR procedure.

3.5. Confidentiality and the Responsibilities of Employees and Collaborators

All employees, collaborators, volunteers and partners involved in personal data processing have signed confidentiality declarations and receive training on their obligations under the GDPR.

They undertake to:

Use personal data only for the purposes for which it was provided;

Not copy, transfer or disclose information to third parties without authorisation;

Immediately report any security incident or suspected personal data breach;

Comply with all internal data protection procedures adopted by ViitorPlus.

3.6. Exceptional Circumstances

ViitorPlus does not sell, rent or transfer personal data to third parties for commercial purposes.

Personal data may be disclosed only in exceptional circumstances, including:

Official requests lawfully submitted by competent authorities;

Situations where disclosure is necessary to defend a legitimate right or interest of ViitorPlus, for example in the context of legal proceedings;

Cases where the data subject has provided explicit consent to such disclosure.

3.7. Traceability and Access Control

To ensure the traceability of processing activities, all access to, alterations of and transfers of personal data are documented internally.

ViitorPlus maintains a Record of Processing Activities and a GDPR Incident Register. These records are updated regularly and transparently reflect how personal data is managed within the “Adoptă un Copac” programme.

Chapter IV – How Long We Retain Personal Data and How We Manage Archiving

ViitorPlus retains personal data only for the period necessary to fulfil the purposes for which it was collected, in accordance with the retention periods established by applicable legislation and its internal data retention and archiving policies.

The retention period varies depending on the type of data, the purpose of the processing and the applicable legal basis.

4.1. Storage Limitation Principle

Personal data is retained only for as long as necessary to fulfil the stated purposes or comply with legal requirements. Once the retention period expires, the data is erased, destroyed or anonymised in accordance with the internal data lifecycle management procedure.

Specifically, ViitorPlus applies the following general rules:

Regularly assessing whether retaining the data remains necessary;

Controlled archiving of physical and digital documents;

Anonymising data where the purpose of the processing can be fulfilled without identifying the individual;

Securely destroying documents containing personal data.

4.2. Applicable Retention Periods

Type of Data / Activity Category of Data Subjects Retention Period Notes Data Concerning Volunteers and Participants Volunteers, activity participants, educators and coordinators Three years from the completion of the activity The period covers reporting requirements, internal archiving and project continuity. Data Concerning Donations and Sponsorships Individual donors, sponsors and partners 10 years In accordance with applicable accounting and tax legislation. Data Concerning Collaborators and Day Labourers Individuals engaged under temporary employment contracts 10 years In accordance with applicable employment and tax regulations. Data Contained in Reports, Partnerships and Official Correspondence
Institutional partners and contracting entities Five years from the end of the partnership For subsequent audits and verifications. Photographs, Video Materials and Promotional Content Volunteers, donors, sponsors and participants Indefinitely, for archiving, promotional and public reporting purposes Only with the data subject’s consent; used exclusively for legitimate-interest purposes and institutional promotion. Until Consent Is Withdrawn Users may unsubscribe at any time. Technical Data Collected Through the Website, Including Cookies and Analytics Data Website visitors 6–24 months, depending on the Cookie settings
Full details are available in the Cookie Policy.

Datele de contact pentru comunicare și newsletter

Persoane care au oferit consimțământul

4.3. Archiving and Protecting Stored Data

Personal data is archived securely in both physical and digital formats:

Physical documents are stored in secure areas accessible only to authorised personnel;

Electronic documents are stored on secure servers protected by passwords and role-based access controls;

Internal archives are audited regularly by the GDPR Officer in accordance with ViitorPlus’s compliance schedule.

Access to archived data is permitted only in justified circumstances, such as audits, accounting checks or legal requests, and requires internal approval.

4.4. Data Destruction and Anonymisation Procedure

Upon expiry of the retention period, ViitorPlus applies the following measures:

Identifying data that is no longer required and preparing a formal disposal record;
Physically destroying documents through a specialised service provider or controlled internal methods, such as shredding;
Permanently deleting digital files and backup copies containing personal data;
Anonymising data that may be retained for statistical, educational or aggregated reporting purposes, without identifying individuals;
Documenting the process in the internal GDPR register to ensure traceability.

4.5. Data Used for Promotional and Public Reporting Purposes

Photographs, video materials, public statements and other visual content associated with the “Adoptă un Copac” programme may be retained and used over the long term for archiving, communication and transparency purposes, provided that the data subjects have given their consent.

ViitorPlus undertakes to use these materials exclusively for purposes related to:

Promoting environmental projects and environmental education initiatives;

Reporting activities and results to sponsors, donors and the public;

Documenting the history of the “Adoptă un Copac” programme.

If a person withdraws their consent, ViitorPlus will stop using the relevant materials in future communications and, where reasonably possible, remove or replace previously published content.

4.6. Review and Updating of Retention Periods

Retention periods may be reviewed periodically in response to legislative changes, operational requirements or the nature of the projects being implemented. Any changes to these periods will be documented in the Record of Processing Activities and, where appropriate, communicated by updating this publicly available Policy.

5.1. Right to Information and Access

Every data subject has the right to receive transparent and intelligible information about how their personal data is collected, used and stored.

The data subject may request:

Confirmation as to whether ViitorPlus processes their personal data;

A copy of the personal data being processed;

Information about the purposes of the processing, the categories of personal data concerned, the recipients, the retention period and the source of the data where it was not obtained directly from the data subject.

A request may be submitted at any time by email to [email protected].

5.2. Right to Rectification

Data subjects may request the correction of inaccurate personal data or the completion of incomplete data by submitting a written request to the same contact address.

ViitorPlus will update the data as soon as reasonably possible, ensuring that the information retained is accurate and up to date.

5.3. Right to Erasure (“Right to Be Forgotten”)

Data subjects have the right to request the erasure of their personal data where:

The data is no longer necessary for the purposes for which it was collected;

The data subject withdraws their consent and there is no other legal basis for the processing;

The data subject objects to the processing and there are no overriding legitimate grounds for continuing it;

The data has been processed unlawfully;

The data must be erased to comply with a legal obligation.

Where personal data has been made public, for example through images published on social media, ViitorPlus will take reasonable steps to remove the content where technically feasible.

5.4. Right to Restriction of Processing

Data subjects may request the restriction of personal data processing in the following circumstances:

The accuracy of the data is contested, for the period required to verify it;

The processing is unlawful, but the data subject opposes the erasure of the data;

The data is no longer required for the original purpose, but the data subject needs it for the establishment, exercise or defence of legal claims;

The data subject has objected to the processing, and verification of whether the controller’s legitimate grounds override those of the data subject is pending.

During the restriction period, the data will be used only with the data subject’s explicit consent or for the establishment, exercise or defence of legal claims.

5.5. Right to Object

The data subject has the right to object at any time to the processing of their personal data based on the controller’s legitimate interests, including processing for promotional, public communication or direct marketing purposes.

Where the data subject objects, ViitorPlus will stop processing the data unless compelling legitimate grounds justify continuing the processing.

5.6. Right to Data Portability

Atunci când prelucrarea se bazează pe consimțământ sau pe executarea unui contract, persoana vizată poate solicita transmiterea datelor sale într-un format structurat, utilizat în mod curent și care poate fi citit automat.

Datele pot fi furnizate direct persoanei vizate sau, la cererea acesteia, pot fi transferate unui alt operator, dacă acest lucru este fezabil din punct de vedere tehnic.

5.7. Dreptul de retragere a consimțământului

Persoana vizată are dreptul de a-și retrage consimțământul în orice moment, fără a afecta legalitatea prelucrării efectuate anterior retragerii.

Consent may be withdrawn by:

Sending an email to [email protected];

Completing the standard withdrawal form, which may be requested by email as part of the Data Subject Rights Request Form;

Using the unsubscribe option for newsletters and electronic communications.

Following withdrawal, the personal data will no longer be used for the purpose for which consent was originally provided.

5.8. Right to Lodge a Complaint

Where a data subject considers that their rights have been infringed, they may lodge a complaint with:

The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
28–30 General Gheorghe Magheru Boulevard, District 1, Bucharest, Romania
Postal code: 010336
Email: [email protected]
Website: www.dataprotection.ro

The data subject may also bring legal proceedings in accordance with Article 79 of the GDPR.

5.9. Procedure for Exercising Data Subject Rights

ViitorPlus has established an internal procedure for managing requests from data subjects in accordance with the GDPR Procedures Manual. The main stages are:

Registering the request – the request is recorded in the internal GDPR Request Register.
Verifying the applicant’s identity – reasonable proof of identity may be requested to protect personal data.
Assessing the request – the right being exercised and the applicable legal basis are reviewed.
Responding to the data subject – the decision is communicated within no more than 30 days, with the possibility of a further 30-day extension in complex cases.
Documenting the resolution – all requests and responses are retained for record-keeping and internal audit purposes.

If a request is refused, the data subject will receive a clear explanation and information about their right to lodge a complaint with the Supervisory Authority.

5.10. Exceptions and Limitations

Certain requests may be refused where:

The data is required to comply with a legal obligation;

Erasure or restriction would prevent ViitorPlus from fulfilling its contractual or legal obligations;

There is an overriding public interest, such as archiving photographs and video materials documenting publicly funded activities.

In such cases, the data subject will be informed of the reasons for the refusal and will have the right to challenge the decision.

Chapter VI – Cookies and Similar Technologies

The www.adoptauncopac.ro website uses cookies and similar technologies to ensure the optimal operation of the Platform, analyse how it is used and improve the visitor experience.

Through these tools, ViitorPlus does not collect information that can directly identify an individual, but only technical data necessary for the proper operation of the Website and the assessment of its performance.

6.1. What Are Cookies?

Cookies are small files consisting of letters and numbers that are stored on a user’s device (computer, telephone, tablet, etc.) when they visit a website.

These files allow the Website to remember information about the user’s visit—such as language preferences, pages visited, session duration or selected options—so that the browsing experience is more efficient and personalised.

6.2. Purposes for Which Cookies Are Used

Cookies and similar technologies are used for:

● ensuring the proper operation of the Website and its online forms;

● improving performance and analysing website traffic;

● remembering browsing preferences;

● promoting Adoptă un Copac activities and campaigns online, in accordance with the law and only with users’ consent.

6.3. User Consent

When users first access the Website, they are informed about the use of cookies through a dedicated banner and may choose:

● to accept all cookies;

● to reject non-essential cookies; or

● to customise their preferences.

Consent may be modified or withdrawn at any time by accessing the settings panel on the Website.

6.4. Dedicated Cookie Policy

For complete information about the types of cookies used, their purposes and duration, and how cookie preferences can be managed, please consult the dedicated document:

👉 Cookie Policy – Adoptă un Copac

This policy supplements this Privacy Policy and forms an integral part of ViitorPlus’s general data protection framework.

Chapter VII – Data Security and Protection Measures

ViitorPlus applies appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised disclosure or unlawful access.

The measures adopted are proportionate to the nature of the data processed and the associated risks and are based on the principles of confidentiality, integrity, availability and resilience, in accordance with Article 32 of Regulation (EU) 2016/679 (GDPR).

7.1. General Security Principles

Within the Adoptă un Copac programme, ViitorPlus seeks to:

● prevent unauthorised access to personal data;

● ensure that data is accurate and kept up to date;

● protect data against accidental loss or destruction;

● ensure operational continuity in the event of an incident;

● document and ensure the traceability of all processing activities.

Security measures are reviewed periodically and adapted in line with technological developments and the nature of the activities carried out.

7.2. Technical Measures Applied

To protect electronic data, ViitorPlus uses:

● secure servers with unique authentication credentials and controlled access;

● encryption of communications and data transfers through secure protocols (HTTPS, SSL/TLS);

● up-to-date antivirus, firewall and anti-malware solutions;

● regular backups stored in separate environments;

● access to databases restricted according to employees’ roles and responsibilities;

● monitoring traffic and access activity to identify unauthorised access attempts.

Access to data is granted only to authorised persons, based on the “need-to-know” principle (only to those who require the data to perform their duties).

7.3. Organisational Measures Applied

At organisational level, ViitorPlus has implemented clear internal procedures regarding:

● the management of physical documents containing personal data (restricted access, secure storage and controlled destruction);

● defining the responsibilities of each person who processes personal data;

● the signing of confidentiality declarations by employees, collaborators and volunteers;

● restricting the copying, transmission or reproduction of documents containing personal data;

● the control and tracking of documents (registration numbers, archiving and retention periods);

● providing regular staff training on GDPR requirements and data security;

● periodically verifying compliance with internal measures through scheduled GDPR audits.

7.4. Data Protection During Field Activities

The following measures apply to field activities, including planting activities, educational campaigns and public events:

● participants’ data is collected only through standardised forms approved by the DPO;

● the forms are managed and archived by designated personnel and subsequently destroyed in accordance with the established retention periods;

● photo and video materials are produced and used only with the data subject’s prior consent;

● any device used to collect data or images, including telephones, tablets and cameras, is password-protected and used exclusively for official activities;

● data is not transmitted through insecure means, such as public Wi-Fi networks or unauthorised applications.

7.5. Confidentiality Obligations of Staff and Collaborators

All persons involved in data processing, including employees, collaborators, volunteers and partners, are required to:

● maintain the confidentiality of the information to which they have access;

● use the data exclusively for the purposes defined by ViitorPlus;

● immediately report any incident or suspected personal data breach;

● participate in regular data protection training.

A breach of these obligations may result in disciplinary, civil or criminal liability, in accordance with applicable law.

7.6. Management of Security Incidents

ViitorPlus has established an internal Security Incident Management Procedure, applicable whenever there is a suspected loss, unauthorised access or disclosure of personal data.

The main stages are:

Identifying and reporting the incident – anyone who becomes aware of an incident must immediately report it to the Data Protection Officer (DPO).
Assessing the impact – the nature of the incident, the data affected, its extent and the risks to data subjects are determined.
Containing and mitigating the effects – immediate measures are taken to stop the incident and prevent its recurrence.
Notifying the supervisory authority – if the incident has a significant impact on the rights and freedoms of data subjects, the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) is notified within 72 hours of becoming aware of it.
Informing the data subjects when the incident is likely to result in a high risk.
Fully documenting the incident and the measures taken in the internal GDPR Incident Register.

7.7. Auditing and Review

Data security is reviewed periodically through:

● internal GDPR audits conducted by the designated officer;

● annual reviews of the procedures and technical measures applied;

● regular testing of IT systems and backup mechanisms;

● updates to privacy policies and related documents in response to legislative changes or developments in the digital infrastructure.

7.8. ViitorPlus’s Responsibility

As the data controller, ViitorPlus assumes full responsibility for compliance with data protection legislation, documenting processing activities and maintaining a high level of security within the Adoptă un Copac programme.

The designated Data Protection Officer (DPO) coordinates the implementation and monitoring of these measures, providing ongoing support to the team and collaborators involved.

Chapter VIII – International Data Transfers and Cross-Border Data Sharing

ViitorPlus does not currently transfer personal data outside the European Economic Area (EEA). All activities carried out under the Adoptă un Copac programme take place in Romania, and the data is stored on secure servers located within the European Union.

8.1. Circumstances in Which International Transfers May Occur

Certain technical services used to manage the Website, communicate by email or analyse traffic—such as Google, Meta, Mailchimp and cloud platforms—may involve processing data outside the EEA. In such cases, transfers are made only to providers that offer appropriate safeguards in accordance with Article 46 of the GDPR.

8.2. Safeguards Applied

ViitorPlus ensures that every provider involved in such transfers:

● complies with the Standard Contractual Clauses approved by the European Commission;

● implements additional technical safeguards, including encryption and access controls;

● does not use the data for purposes other than those established by contract;

● maintains a level of protection equivalent to that applicable within the European Union.

8.3. Informing Data Subjects

If a transfer to a third country becomes necessary, data subjects will be informed in advance, and the transfer will take place only on the basis of consent or another clear legal basis provided for under the GDPR.

Chapter IX – Policy Updates and Contact Details

9.1. Policy Updates

ViitorPlus reserves the right to amend and update this Privacy Policy whenever necessary due to legislative changes, technological developments or changes within the Adoptă un Copac programme.

Any update will be published on thewww.adoptauncopac.ro website in the section dedicated to data privacy. The date of the latest update will be stated at the beginning of the document, and previous versions may be provided upon request.

ViitorPlus recommends that all users and partners review this Policy periodically to remain informed about how personal data is protected.

9.2. Contact Details

For any questions, notifications or requests concerning the protection of personal data, please contact us:

ViitorPlus – Association for Sustainable Development
Registered in the Register of Associations and Foundations maintained by the Bucharest District 2 Court, case file no. 26749/300/2022.

Tax Identification Number: RO18654032
Registered office: 24 Ronda Street, attic, room 2, District 2, Bucharest, Romania

Correspondence address:

22–24 Calea Șerban Vodă, District 4, Bucharest, postal code 040201
General email: [email protected]
Data protection email: [email protected]
Websites: www.viitorplus.ro / www.adoptauncopac.ro

9.3. Date of the Latest Update

Version 1.0 – Updated on 9 November 2025