The main personal data controller in relation to participants in REM Transylvania 2027 is the Rotaract Cetățuie Cluj-Napoca Association, with its registered office at 22 Viilor Street, Block 6D, staircase 1, 4th floor, flat 9, Cluj County, with company registration number 37765401, hereinafter referred to as the ‘Controller’ or ‘Main Organiser’. The official website of the Event is https://remcluj2027.com.

The Event is organised by the Operator in partnership with the other Rotaract clubs in Cluj-Napoca, namely the Rotaract Cluj-Napoca Association, the Rotaract Visio Cluj-Napoca Association, the Rotaract Club Cluj-Napoca Samus Association, the Rotaract Cluj-Napoca Gemina Association, the Rotaract Club Cluj-Napoca Hoia Association and the Rotaract Cluj-Napoca Opera Association. Depending on their specific role in the organisation, these entities may act as personal data controllers or data processors, with access to data being limited to what is necessary for the organisation, administration, promotion and documentation of the Event.

For the optional Pre-REM and Post-REM events, the independent organisers are the Rotaract Club Satu Mare Association and the Rotaract Club Sibiu Association, respectively. Should you purchase packages relating to these events, the necessary data will be forwarded to the relevant organiser for the purpose of organising and delivering the services associated with the respective event.

If you are simply visiting the website, we may process technical data, such as your IP address, online identifiers, information about your device, browser, operating system, the pages you visit and cookies, in accordance with our Cookie Policy.

If you use the contact form, send us an email or request information about the Event, we may process the data necessary to reply to you, namely your surname, first name, email address, telephone number and the content of your message.

If you purchase a participation package for REM Transylvania 2027 and, where applicable, for Pre-REM and/or Post-REM, we process the following personal data:

• surname and first name;
• date of birth;
• email address;
• telephone number;
• address;
• Rotary Member ID;
• the club and district to which you belong;
• the package or packages selected, including options relating to REM, Pre-REM and Post-REM;
• registration and payment status, transaction details, without the Operator storing your full bank card details;
• photographs, video recordings, images and/or voice recordings, to the extent that you participate in the Event’s activities or in promotional, documentary or communication materials.

Data is collected directly from you via the website, registration forms, communications sent to the organisers, or through your physical participation in the Event’s activities. In certain situations, the data may be confirmed or supplemented via Rotaract structures, Rotaract Europe or the club/district indicated by the Participant, strictly for the purpose of validating eligibility and organising the Event.

Photographs and video recordings are not used for automated biometric identification, profiling or automated identity verification, but for the promotion of the Event.

Data is processed for the following main purposes:

• to manage the website, registration forms and communications received;
• validating registration and, where applicable, Rotaract/Rotary membership or affiliation with the specified club and district;
• processing participation packages, confirming payments and managing the relationship with participants, including by sending communications to them;
• organising the Event, including check-in, access, accommodation, transport, meals, and educational, cultural, social and networking activities;
• issuing supporting documents, maintaining accounting, tax and administrative records, and fulfilling legal obligations;
• ensuring the safety of participants, managing access to the Event venues and resolving incidents or complaints.

Photographs and/or video recordings will be taken during the Event in which participants may appear incidentally or directly, for the purpose of documenting and promoting the Event. The data processed in this context may include a person’s image and voice (biometric data in the broad sense), without being used for automated identification or profiling. This data is processed for the following purposes:

• to promote the Event and Rotaract activities;
• publishing photos and videos on the website, social media and other communication channels;
• creating presentation materials and archiving the activity.

The legal bases for processing are, as applicable: Article 6(1)(a) of the GDPR, for processing based on consent; Article 6(1)(b) of the GDPR, for the performance of the contractual relationship arising from registration for the Event and the purchase of packages; Article 6(1)(c) of the GDPR, for the fulfilment of legal obligations relating to tax, accounting, administrative or security matters; Article 6(1)(f) of the GDPR, for the Controller’s legitimate interest in documenting and safeguarding the Event, managing the relationship with participants, and defending its legitimate rights and interests.

To the extent that you participate in the REM Transylvania 2027 event, your image and/or voice may be captured in photographs and/or video recordings made during the event, for the purpose of promoting the activities and projects organised by Rotaract, including through publication on the website, social media or other communication channels. You have the right to object to the processing or to request the deletion of any material in which you appear, insofar as this is possible, by sending a request to the contact address provided. In the case of group photographs, the legal basis for processing is set out in Article 6(1)(f) of the GDPR, namely the controller’s legitimate interest in documenting and promoting the event. In the case of participants who have registered on the website https://remcluj2027.com or of individual materials in which the person is clearly identifiable as the main subject (such as interviews or portrait photographs), the legal basis for processing is also set out in Article 6(1)(a) of the GDPR, namely the data subject’s consent.

We undertake to use the data exclusively for the purposes mentioned above and not to pass this data on to third parties for marketing purposes without the data subject’s prior consent. We undertake to always seek your consent before using the information for any purpose other than that set out in this document. We process your personal data on the basis of your consent only if you have explicitly opted in to this – for the purpose of sending newsletters, services, updates, etc. Furthermore, data processing may also take place in order to comply with the legal obligations imposed upon us.

Personal data may be disclosed only to the extent necessary for the purposes set out above, to the following categories of recipients:

• Rotaract Europe, for the validation, coordination, reporting, communication and promotion of the Event within the European Rotaract network;
• Organising Partners, namely the Rotaract Cluj-Napoca Association, the Rotaract Visio Cluj-Napoca Association, the Rotaract Club Cluj-Napoca Samus Association, the Rotaract Cluj-Napoca Gemina Association, the Rotaract Club Cluj-Napoca Hoia Association and the Rotaract Cluj-Napoca Opera Association, to the extent necessary for the organisation and implementation of the Event’s activities;
• the Rotaract Club Satu Mare Association, in the case of participants purchasing Pre-REM packages;
• The Rotaract Club Sibiu Association, in the case of participants who purchase Post-REM packages;
• hotels, accommodation providers, restaurants, catering providers, transport/coach providers, trainers, speakers, providers of check-in services, security, photography/video, communications, IT services, website hosting, form platforms, email, cloud storage and payment processors;
• public authorities, courts, tax authorities, regulatory bodies, consultants, solicitors, accountants or auditors, where disclosure is necessary to comply with a legal obligation, resolve a dispute or defend the Controller’s rights.

The information you provide is not usually disclosed to third parties, with the exception of the partners we work with, such as courier companies or sponsors and partners offering race prizes, to whom we may pass on your personal data for the purpose of delivering prizes and/or gift boxes.

In the case of Pre-REM and Post-REM, the organisers of these events generally act as independent controllers for the activities they organise, and Participants must consult their own policies and rules, insofar as these are communicated.

If the personal information you have provided to us is incorrect or has changed – for example, if you have changed your telephone number, name or email address – or if you wish to delete any request you have made to us, or if you are aware that we hold incorrect information about you, please contact us by email at:remcluj@rotaract.ro to update or amend this information.

Insofar as you are merely a visitor to the website, cookie data is processed for the purpose of analysing how to improve our website, for a period not exceeding one year. You may delete cookie data at any time via your web browser settings.

Data used for registration for the Event will be retained for the period necessary to prepare, run and conclude REM Transylvania 2027, as well as thereafter, for a reasonable period required to manage reports, complaints, audits, project archiving and the protection of the Controller’s rights, but for no longer than one year from the date the data was provided.

Financial and accounting data, supporting documents and information relating to payments will be retained for the period required by the applicable tax and accounting legislation.

Photographs and video recordings may be retained for a reasonable period necessary for the promotion, documentation and archiving of the activity, whilst respecting the rights of data subjects.

If you have given your consent to the processing activities, you may withdraw that consent at any time. This withdrawal will only take effect for the future and will not affect the lawfulness of the processing prior to its withdrawal.

Withdrawal of consent does not apply where the processing of your data is based on a legal obligation incumbent upon us.

Should you withdraw your consent, we will cease processing your personal data and take all necessary steps to delete all records containing such data.

You may withdraw your consent by contacting us, either via the contact form or by sending an email to the address provided, specifying your surname, first name, email address and an explicit request to withdraw your consent. We may also contact you by telephone for confirmation or by other means to verify your request.

In accordance with the provisions of European Council Regulation 679/2016, you have the following rights:

• Right of access – the right to obtain from us, upon request and free of charge, confirmation as to whether or not your personal data is being processed by the Firm and the right to access such data, except where such requests are repetitive or made in bad faith;
• Right to information – the right to be informed of the identity of the controller, the purpose of the data processing, the recipients or categories of recipients of the data, the existence of the rights provided for by the GDPR and the conditions under which they may be exercised
• Right to rectification – you may request the rectification of inaccurate personal data.
• The right to erasure (‘the right to be forgotten’) – you may request the erasure of your data where its processing was unlawful or in other cases provided for by law;
• The right to restriction of processing – you may request that processing be restricted if you contest the accuracy of the data, as well as in other cases provided for by law;
• Right to object – the right to object, at any time, on reasonable and legitimate grounds, to the processing of your data, except where there are legal provisions to the contrary;
• Right to data portability – you may, under certain conditions, receive the personal data you have provided to us in a machine-readable format, or you may request that such data be transferred to another controller
• The right to lodge a complaint – you may lodge a complaint regarding the processing of your personal data with the competent National Supervisory Authority for the Processing of Personal Data or bring the matter before the courts.
• The right not to be subject to automated decisions or further profiling related to automated decisions: the right to request and obtain the withdrawal, annulment or reassessment of any decision producing legal effects, adopted solely on the basis of the processing of personal data carried out by automated means, intended to evaluate certain aspects of your personality, such as professional competence, credibility, behaviour or other similar aspects.

To exercise any of your rights, please contact us using the following contact details if you wish to exercise the rights mentioned above: email: remcluj@rotaract.ro ; postal address: Cluj-Napoca, Viilor Street, No. 22, Block 6D, Staircase 1, 4th Floor, Flat 9, Cluj County, Romania

We undertake to consider and resolve any request, complaint or petition received and to respond within a reasonable timeframe, without undue delay, within a maximum of 14 working days, so as to comply with the relevant legal provisions.

We work with the relevant regulatory authorities, including the national data protection authorities of the Member States of the European Union, to resolve any complaints regarding the transfer of personal data that we are unable to resolve directly with our users.

The controller has implemented appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction, disclosure, alteration or unlawful processing, including by restricting access to data on a ‘need-to-know’ basis, the use of individual accounts, authentication and secure storage facilities, avoiding storage on physical media, and by imposing confidentiality obligations on individuals and entities with access to the data.

Access to data will be granted exclusively to persons involved in organising the Event and to suppliers who require the data to carry out their duties, and the data will be managed in such a way as to minimise the risk of unauthorised access, loss or accidental disclosure.

In the event of a personal data breach, the Controller will investigate the incident and fulfil its obligations to notify the competent authority and, where applicable, the data subjects, in accordance with the conditions and timeframes set out in the GDPR.

This Policy may be updated to reflect changes to legislation, the registration process, the website, the service providers used, the recipients of the data or the way in which the Event is organised. The updated version will be published on the website and will take effect from the date of publication, unless a later date is specified.