WWF – ROMANIA PRIVACY POLICY – version date June 2019

At ASOCIAȚIA WWF ROMÂNIA (hereinafter: “WWF ROMÂNIA”) we rely on the support of individuals like you to carry out our vital conservation work. That is why we want to be completely transparent about why we need the personal data we request when you engage with us and how we will use them.

As you browse our website and whenever you communicate with us, we collect, process and eventually transfer data. Collecting these data helps to make our communications more effective and to achieve our goals. The more data we have, the more efficiently we are able to operate and the more funds we can direct into conservation. In this privacy policy we explain why and how we process your personal data.

We take protecting your privacy very seriously and will always take all reasonable steps within our power to make sure your information is safe.

This privacy policy applies to all personal information we collect or process about you.

‘Personal information’ is information, or a combination of pieces of information, that could reasonably allow you to be identified.

We may update this policy from time to time without notice to you, so please check it regularly on our website at: http://www.wwf.ro/confidentialitate/

Whenever necessary, we are happy to help you with your questions. In this respect, you can contact our Supporter Care team by email at: privacy@wwf.ro.

1. WHO WE ARE

ASOCIAȚIA WWF ROMÂNIA, FILIALA MARAMUREȘ, with its offices in Baia Mare, Maramures County, Unirii bld, no 12A, ap 86, postal code: 430272, having sole registration number 26734647, is part of the WWF global network which operates in over 100 countries around the world. All country offices work collaboratively with a common mission of creating a future where people and nature thrive. We are known as ASOCIAȚIA WWF ROMÂNIA, FILIALA MARAMUREȘ to distinguish ourselves from our sister organizations from other countries. This privacy policy relates to the data which is obtained and processed by ASOCIAȚIA WWF ROMÂNIA, FILIALA MARAMUREȘ only.

ASOCIAȚIA WWF ROMÂNIA, FILIALA MARAMUREȘ is an NGO registered under Romanian law. In this policy, whenever you see the words ‘we’, ‘us’ or ‘our’, it refers to this organization which is a Data Controller.

2. WHY WE COLLECT INFORMATION

We generally process personal data for our supporter administration, fundraising programs and to inform about actions and campaigns. We do not provide personal data to third parties for commercial purposes.

FOR A FUTURE WHERE PEOPLE AND NATURE THRIVE

To build a future where people live in harmony with nature we need to have effective communications and fundraising activity. By understanding more about how people use the information we provide, we can improve how we communicate the most important messages that you need to hear.

TO DELIVER IMPORTANT INFORMATION ABOUT WHAT YOU CAN DO FOR YOUR PLANET AND HOW YOUR SUPPORT HELPS

We can broadcast information on TV, in the news and on our websites and in our social media, but if we can talk to you directly or deliver it straight to your doorstep or to your inbox, we know for sure that you will know exactly what you can do to help and what results we have achieved with your support.

TO SAVE MONEY

We never do anything without carefully considering how much it costs. Collecting information about you and what grabs your attention allows us to work out the most efficient way to do things so that more funds can be directed into saving nature/ conservation.

3. WHEN WE COLLECT DATA, WHAT DATA WE COLLECT, HOW WE COLLECT IT AND WHAT WE USE IT FOR

We collect personal data every time you interact with us. The type and quantity of information we collect and how we use it depends on why you are providing it.

3.a. WHEN WE COLLECT DATA

There are many instances in which we may collect information about you. For example, we collect data when you:

• Become a supporter of WWF Romania

• Participate in an event of WWF Romania, participate in an event or volunteer with us

• Make a donation to us

• Buy any of our gifts

• Subscribe to our e-newsletters or request information from us

• Sign a petition or become involved with one of our campaigns

• Visit one of our websites or social media pages via tools such as cookies and online identifiers, including if you make comments on our message boards or discussion forums

• Apply for a job or consultancy with us

• Contact us or become involved with us in any other way than as stated above.
  

3.b. WHAT DATA WE COLLECT

The type and quantity of data we collect and how we use it depends on and is restricted to why you are providing it. The data we may collect from the different sorts of interactions may include, but is not limited to:

• Your name, address, telephone number, and/or email address, along with your preferences as to how we should contact you in the future

• Financial information which you give to us, such as credit card number

• Information you enter onto our website

• Records of your donation history and correspondence and campaign actions taken with us

• Images, photographs or video if you take part in an event with us

• Details of your visit to the website, including technical information such as the IP address you use to access the website, your browser type and version

• Any other details in which you give us including your reasons for supporting us.

We might also obtain personal data about individuals who may be interested in giving major gifts to organizations like ours. In these limited cases only, in addition to information you give us directly, we may also collect information about you from publicly available sources.

Note: If you’re adopting an animal or buying membership as a gift for someone else, we’ll need their name and address to send their pack and updates to, but we won’t contact them about anything else unless they ask us to.

The only instance in which we might collect sensitive categories of information is if you apply for a job with us. In this case, we may collect information about your race or ethnicity, religious beliefs or sexual orientation. This information will only be used for equal opportunities monitoring and for the employment related purposes. We may collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. You will be provided with specific data protection information when the information is requested so you are aware of how your data will be collected, used and stored.

3.c. HOW WE COLLECT DATA ABOUT YOU

We use different methods to collect data from and about you including through:

Direct Interaction

We get information directly from you, for example when you subscribe to our e-newsletters. For information about when we may collect data about you, see above under WHEN WE COLLECT DATA.

Automated technologies or interactions

If you enter your details onto one of our online forms, and you don’t ‘send’ or ‘submit’ the form, we may contact you via email to see if we can help with any problems you may be experiencing with the form or our websites.

Similarly, if you receive an email, open it, don’t open it, select a link, browse our website, we collect this information so we can see which stories are popular and which aren’t.

When we’re seeing what people do online like this, we’re using cookies. If you don’t want cookies, you can set your browser to notify you when you receive one, then choose to decline it. Please read our Cookie Policy for more information.

Please note that if you disable or refuse cookies, then some parts of our websites may become inaccessible or not function properly.

Name	Provider	Type	Expiry	Description
__cfduid	natura2000mm.ro	HTTP	29 days	Used by the content network, Cloudflare, to identify trusted web
pll_language	natura2000mm.ro	HTTP	1 year	This cookie is used to determine the preferred language of the visitor and sets the language accordingly on the website, if possible.
_ga	natura2000mm.ro	HTTP	2 years	Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
_gat	natura2000mm.ro	HTTP	1 day	Used by Google Analytics to throttle request rate
_gid	natura2000mm.ro	HTTP	1 day	Registers a unique ID that is used to generate statistical data on how the visitor uses the website.

Social Media

We may obtain your personal information through your use of social media such as Facebook, Twitter or LinkedIn, depending on your settings or the privacy policies of these social media services. To change your settings on these services, please refer to their privacy policies which will tell you how to do this.

Desktop Research

We may use desk research, profiling and screening techniques to analyze your personal information to create a profile of your interests and preferences so that we can contact you with information relevant to you, to be prepared when we meet you or to help us find others like you who might like to show their support. We do this because it allows us to make appropriate and relevant approaches and to target our resources more effectively, which donors consistently tell us is a key priority for them. We may make use of additional information about you, including geo-demographic information and measures of affluence, when it is available from third party sources. We may on occasion use third party suppliers to undertake these activities on our behalf and provide them with your information to the extent required.

Such information is compiled using publicly available data about you, for example addresses, listed Directorships, social media posts, newspaper articles or typical earnings in a given industry. This helps us understand the background of the people who do or may support us and helps us to make appropriate requests for gifts to supporters and/or leave us a gift in their will. Collating this publicly available information helps us better understand your motivations and preferences enabling us to deliver a more targeted and relevant donor experience. Additionally, it enables us to raise more funds, sooner, and more cost-effectively than we otherwise would.

3.d. WHAT WE USE THE DATA FOR

We will mainly use the data we collect for a number of different processing activities which includes:

• Provide you with the services, products or information you have requested

• Keeping you up to date with the work you are supporting and the latest conservations news

• Keeping a record of your relationship with us

• Administering your donation

• Asking for financial and non-financial support

• Manage your communication preferences, including marketing preferences

• Understanding how we can improve our services, products or information

• Carrying out our obligations arising from any contracts entered into by you and us

• Sending you tailored communications and displaying relevant adverts which we think will be of interest to you

• Sending you marketing materials including on fundraising, campaigning and events

• Inviting you to events and to take part in campaigns and support our advocacy work

• Analyzing our database for statistical purposes, and to better communicate with you about things we think will be of interest. Note that this is on a generic rather than an individual level to ensure that our communications are cost effective

• In limited circumstances, analyzing the personal information we collect about you and using publicly available information to better understand your interests, preferences and level of potential donations so that we can contact you more effectively and be better prepared in special circumstances when we may meet with you.

4. OUR LEGAL BASIS FOR PROCESSING DATA

All of our use of personal data is in accordance with the law. The law requires us to only process data where we have a valid legal basis for doing so. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you, such as providing you with the service you have requested (for example: adoption updates or membership magazines, and to contact you about these in order to administer your request).

• Where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests (as described below).

• Where we need to comply with a legal or regulatory obligation.

• Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation to sending email or text message direct marketing communications about fundraising, campaigns and events.

ASOCIAȚIA WWF ROMÂNIA, FILIALA MARAMUREȘ legitimate interests include administering its activity, sending you marketing materials, and understanding our supporters. A summary of each of these and some examples of how we may use your data in these ways on the basis of it being within our legitimate interests to do so are set out below:

1. Administration of our activity. As an NGO, our mission is to conserve the natural world for future where people and nature thrive. In order to deliver against these charitable purposes, we need to undertake certain processing activities. Some of these will be to govern our NGO, and some will be for operational administration reasons.

Specific examples of processing activities under this legitimate interest include:

• Recording your communication and marketing preferences and maintaining suppression files so we don’t contact you when you have asked us not to

• Keeping a record of who our supporters are, your relationship with us, and your order and donation history

• Reviewing our database of supporters across the organization for historical, scientific and statistical purposes

• Operational administration such as:

• Management and planning purposes

• Thanking you for your support

• Keeping you up to date with the work you are supporting and the latest conservation news

• Financial management and controls such as:

• Processing supplier invoices

• Administering grants for our programmatic work

• Taking steps to prevent fraud, knowing our donors, and taking steps to ensure there is no misuse of services or money laundering.

2. To contact you (by e-mail, post and/or phone). Contact with our supporters is vital to the way we operate – when you join WWF, you are joining a worldwide movement and showing your support for environmental issues. We want to keep in touch with you and, along with telling you how your support is helping and what we have achieved together, we also want to keep you up to date with the numerous activities you can get involved with. We believe it is in our legitimate interest to send you such materials by e-mail and/or post and to speak to you by phone, unless you have told us you prefer us not to. In order to achieve our mission, we need people like you to support us and to gather your support we need to be able to contact you.

Specific examples of processing activities under this legitimate interest include:

• sending marketing materials (as detailed below), including:

• Asking for financial and non-financial support

• Inviting you to take part in campaigns and support our advocacy work

• Inviting you to events, by e-mail

• Providing you information, if you have previously taken part in campaigns, and have not opted out of receiving such information.

3. Understanding our supporters. It is important that we understand our supporters. If we don’t understand you, then we cannot communicate with you in a meaningful way, and in a way which will be engaging and interesting. If we understand you, then we are better able to direct communications to you which you will be interested in. This helps us safeguard your donations and ensure value for money across our communication activities. In order to understand our supporters better, we undertake a number of processing activities including analysis, research, profiling and customizing your experience as detailed in this policy.

Specific examples of processing activities under this legitimate interest include:

• Analyzing our database and seeing what has worked and what hasn’t. This helps us develop our products and services and helps inform our marketing strategy, so we only send you information that we think will be of interest to you, and so that we understand the effectiveness of the marketing we serve you

• Researching your interests – we want to utilize your donations in the most cost effective way, and so we don’t send blanket messages to the entirety of our database. Rather, we deliver content we think will be relevant to you and personalized when appropriate

• In limited circumstances, analyzing the personal information we collect about you and using publicly available information to better understand your interests, preferences and level of potential donations so that we can contact you more effectively

• Customizing your experience and displaying more relevant information (including adverts) to you.

If you would like more information on our uses of legitimate interests or to change our use of your personal data in this manner, please contact us.

5. WHAT WE COMMUNICATE WITH YOU ABOUT

5.a WHAT YOU HAVE REQUESTED

We communicate with you about what you have asked us to – to provide the service you have requested. For example, if you have signed up to a campaign, we will keep you in touch with our campaigns. We will keep you up to date with the latest conservation news and updates. If you adopted an animal, we will update you on your chosen species.

5.b MARKETING

In addition to conservation news and updates on our work, we may also contact you about fundraising, campaigning and events.

Fundraising – your support is vital to our work and without you we would not be able to continue our conservation efforts. We may ask you to make a donation, upgrade your support or change its type. We may also ask you to renew or restart your support or invite you to special supporter events.

Campaigns – we’d love to tell you about our campaigning activities so that you can get involved. This could be telling you about activities such as how to make greener lifestyle choices, signing a petition, contacting businesses or sharing campaign communications to influence for positive change for the environment.

Events – we’d love to tell you about the events organized by us, such as Earth Hour which we’d love you to get involved with.

The law distinguishes between the channels you choose to receive this information, and so we give you different options when we ask to use your data in this way.

We will always ask for your consent if we want to message you by email or text message, however we do not normally ask for consent to contact you by phone or write to you in other ways about any of the above activities (regarding fundraising, campaigning or events). This is because, as a NGO, each of these activities is fundamental to how we work, so we have a legitimate interest to contact you. When you give us your details we will tell you what we are going to do with them. You will always be given the opportunity to opt-out of receiving our marketing communications if you prefer not to.

You can unsubscribe at any time – see HOW TO CHANGE THE WAY WE CONTACT YOU for further information.

While we don’t usually ask, there are some instances where we may have expressly asked you for consent to receive telephone calls, letters and/or e-mails from us (for example, if you gave us your details through our fundraisers in person). If you have consented for us to contact you in these ways, we will continue to do so unless you tell us not to.

6. MARKETING PREFERENCES

We make it easy for you to tell us how you want us to communicate, in a way that suits you. Our communications have clear marketing preference questions and we include information on how to opt out when we send you marketing or fundraising materials, which in the case of emails, is by means of an unsubscribe link.

You can change your marketing preferences at any time by contacting us – see HOW TO CHANGE THE WAY WE CONTACT YOU.

Where you have previously provided us with your telephone number, please note that we may use that telephone number to call you.

You can of course change your preferences at any time if you wish to, as detailed above.

Please note that changing your marketing preferences will not affect the communications we send you where it constitutes the service you have requested – for example, if you have signed up to join us as a member then you tell us you do not wish to receive information on our fundraising, campaigns and events, you will still receive your membership updates.

7. WHO WE SHARE YOUR DATA WITH

7.a NOT TO THIRD PARTIES FOR THEIR MARKETING

We do not sell or share personal data to third parties so that they can market to you.

7.b SERVICE PROVIDERS / SUPPLIERS

As with other organizations, we do not undertake all of our processing activities ourselves and we may appoint suppliers to perform services on our behalf (e.g. payment processing). In order to do this we need to share your personal data with them so they can provide the relevant services to us. In such cases, we ensure that we have a contract with the supplier and as part of that agreement the supplier agrees to respect the security of your personal data and to treat it in accordance with the law. We only permit suppliers to process your personal data for specified purposes and in accordance with our instructions.

If you would like further information on our third party service providers/ suppliers, please contact us.

7.c INTERNATIONAL TRANSFERS

We may need to transfer your personal data to suppliers based in the USA or other countries outside of the European Economic Area (EEA) to allow them to perform services on our behalf (such as when you sign up for a petition to help safeguard the natural environment). In doing so, your data may be stored or otherwise processed outside of the EEA.

In most cases, we do not transfer your personal data outside of the European Economic Area (EEA). However, as we are part of a global network, there are some instances in which we may share your data within our Network. These instances are limited and are mainly where one of our Network offices wants to refer a contact to another office who would be better placed to contact the individual or manage the relationship, for example, where they live or work in that country.

Whenever we transfer your personal data out of the EEA, we ensure it is afforded a similar degree of protection by ensuring that at least one of the following safeguards are in place:

• the country has been deemed to provide an adequate level of protection for personal data by the European Commission;

• a specific contract which is approved by the European Commission and gives personal data the same protection it has in EEA has been entered into with the respective third party; or

• where we use service providers based in the USA, it is accredited under the EU-US Privacy Shield which requires them to provide similar protection to personal data shared between Europe and the USA.

7.d SOCIAL MEDIA

Depending on your settings or the privacy policies for social media and messaging services like Facebook and Twitter, you might give us permission to access information from those accounts or services. For example, we occasionally participate in Facebook’s “Custom Audience” program which enables us to display ads to our existing or potential supporters via Facebook. We provide personal information such as your email address to Facebook to enable them to determine if you are a registered account holder with Facebook. Our adverts may then appear when you access Facebook and on your Facebook feed. Your data is sent in an encrypted format that is deleted by Facebook if it does not match with a Facebook account. For more information please read the Facebook Business page about Custom Audiences and Facebook’s Data Policy.

7.e WHERE REQUIRED

In other cases, we will not disclose any of your personal data except in accordance with this policy, or when we have your permission, or under special circumstances, such as when we believe in good faith that the law requires it or to protect the rights, property and safety of WWF, or others. This includes disclosing your details, if required, to the police, regulatory bodies or legal advisors.

8. HOW WE KEEP YOUR DATA SAFE

We have appropriate physical, technical and managerial controls in place to protect your personal details; for example, our online forms are always encrypted and our network is protected and routinely monitored.

Within our offices only those who have a business need to access your information and who are trained in handling data securely will have access to your information.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. Whilst we hope it will never happen, we have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are required to do so.

When we use external companies to collect or process personal data on our behalf we undertake due diligence on these companies before we work with them, and put a contract in place that sets out our expectations and requirements, including keeping and using your data securely.

Our website may, from time to time, contain links to third party websites. If you follow a link to any of these websites, please note that these websites will have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Despite all of our precautions however, no data transmission over the internet can be guaranteed to be 100% secure. So, whilst we strive to protect your personal information, we cannot guarantee the security of any information which you disclose to us and so wish to draw your attention that you do so at your own risk.

Where we have given you (or you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential, and we ask you not to share this with anyone.

9. KEEPING YOUR INFORMATION UP TO DATE

We really appreciate it if you let us know if your contact details or circumstances change.

10. HOW LONG WE KEEP YOUR DATA FOR

We will only keep your personal information for as long as is necessary for the purpose for which it is collected, which may include the purpose of satisfying any legal, accounting or reporting requirements. If you request that we stop sending you marketing materials we will keep a record of your contact details and the appropriate information to enable us to comply with your request not to be contacted by us.

10.a RETENTION OF YOUR DATA

In order to determine how long we keep your data, we look at the category of data and the reason we collected and have processed it. We look at whether that reason is ongoing and whether you are an active supporter or not. We consider you to be active if you have opened our mailings and have interacted with us in some way such as if you have corresponded with us, signed up for a petition, newsletter, or attended an event any time within the preceding two years.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve these purposes through other means, and the applicable legal requirements.

10.b WHAT HAPPENS WHEN WE ANONYMISE OR DELETE YOUR DATA

When we anonymize or delete your data, we will ensure that it is no longer identifiable to you. We may keep anonymized data for future analysis on aggregated statistical data so that we can understand our supporters better. This may be for research or statistical purposes, or for any other purpose, and we may use this information indefinitely without further notice to you.

11. HOW TO FIND OUT WHAT INFORMATION WE HAVE ABOUT YOU

You can request the details of the personal information we hold about you.

If you want to access your information, please contact us at privacy@wwf.ro and send a description of the information you want to see and proof of your identity.

We may then need to ask you for further information in order to service your request, such as confirmation of your identity, or whether there is any specific data you would like or from a specific time period. We may send you a form in order to assist you in this.

We will respond to you within maximum one month of your legitimate request. You will not have to pay a fee to access your personal data; however, we reserve the right to charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. In case your request needs more time to answer, we will proper inform and explain the cause, providing the new deadline, which will not be longer (in total, with the additional 2 months of potential extensions) than 3 months as of your request being received by us.

12. HOW TO CHANGE THE WAY WE CONTACT YOU

If at any time you’d like us to change the way we contact you, please email us at privacy@wwf.ro, or follow the opt-out links on any marketing message sent to you.

If we’ve sent you something in the post that you don’t really want, just drop us a line to let us know. Our supporter care contact details will always be included in the pack.

13. WHAT TO DO IF YOU DON’T WANT US TO COLLECT DATA ABOUT YOU

If you don’t want us to collect information about you as you browse our website you’ll need to set your browser to notify you when you receive a cookie, then choose to decline it.

If you don’t want us to hold any personal details about you, it’s best just not to give them to us. If you want us to stop collecting information about you or processing that information then please let us know by contacting us at privacy@wwf.ro.

14. YOUR RIGHTS

Under data protection laws you have various rights over your personal data. If you would like to exercise any of these rights, then please contact us at privacy@wwf.ro.

You have the right to:

ACCESS YOUR PERSONAL DATA

You have the right to request access to your personal data, commonly known as a ‘subject access request’. This enables you to receive a copy of the personal data we hold about you.

REQUEST CORRECTION OF YOUR PERSONAL DATA

You can request that we correct the personal data we hold about you. This enables you to have an incomplete or inaccurate data we hold about you corrected.

REQUEST DELETION OF YOUR PERSONAL DATA

You have the right to ask us to erase your personal data in certain circumstances. Please note however that there may be circumstances where you ask us to erase your personal data but we are legally required or entitled to retain it.

OBJECT TO PROCESSING OF YOUR PERSONAL DATA OR REQUEST RESTRICTION

Where we are processing your data under the legitimate interest condition, then you may object to this processing, or request that the processing is restricted, if there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. Note that there may be circumstances where you object to, or ask us to restrict, our processing of your personal data but we are legally required or entitled to continue to processing your personal data and/or to refuse your request. In some cases, we may demonstrate that we have a compelling legitimate ground to process your information which override your rights and freedoms.

REQUEST TRANSFER OF YOUR PERSONAL DATA

In certain circumstances you are able to request a transfer of your data from one service provided to another, such as from one service provider to a competitor.

WITHDRAW CONSENT

Where we have asked you for consent to process your data, you may withdraw this consent at any time by contacting us at privacy@wwf.ro or at the specific contact details provided to you when your consent was obtained. Please note however that we may still be entitled to process your personal data if we have another legitimate reason (other than consent) for doing so.

COMPLAINTS

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy.

If you have a complaint, then please contact us at privacy@wwf.ro in the first instance and we hope to be able to resolve your complaint.

You also have the right to file a complaint with the data protection authority, which may be contacted at the following contact details:

Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal
Address: 28-30 G-ral. Gheorghe Magheru Blvd., District 1, postal code 010336, Bucharest, Romania
e-mail: anspdcp@dataprotection.ro
Phones: +40.318.059.211; +40.318.059.212
Facsimile: +40.318.059.602
Web: http://www.dataprotection.ro/

15. CHANGES TO THIS POLICY

This policy was last updated in June 2019.

We may amend or update this policy at any time to take account of any changes to data protection law or other legislation. When updates to the policy are made they will be posted on this page, so please check back here regularly.

16. CONTACT US

If you have any questions, please contact us using the details below:

Email: privacy@wwf.ro

Post: Baia Mare, Maramures County, Unirii bld, no 12A, ap 86, postal code: 430272