Privacy Policy
Effective date: 27 October 2026
1. Controller identity and contact details
1.1. This website, available at alacrity.education and its subdomains (the "Website"), is operated by ASOCIAȚIA ALACRITY EDUCATION, a company incorporated under the laws of Romania, having its registered office at MUNICIPIUL BUCURESTI, SECTOR 1, CAL. VICTORIEI 142-148, Sc. D, Et. 5, Ap. 24, sole registration code (CUI) 51180585 ("we", "us", "our").
1.2. We act as the controller of the personal data described in this Privacy Policy within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the "GDPR").
1.3. Requests concerning this Privacy Policy or the exercise of the rights set out in Section 9 may be addressed to us at [email protected], or in writing at the registered office indicated above.
1.4. We have determined that we are not required to appoint a Data Protection Officer under Article 37 GDPR.
2. Scope
2.1. This Privacy Policy describes the categories of personal data we process in connection with the Website, the purposes and legal bases of such processing, the recipients of such data, the applicable retention periods, and the rights available to data subjects.
2.2. This Privacy Policy does not apply to websites, platforms or services operated by third parties to which the Website may link, including our social media profiles. Processing carried out by the operators of those destinations is governed by their own privacy notices.
3. Principles
3.1. We process personal data lawfully, fairly and in a transparent manner, for the specified purposes set out below, and limited to what is necessary for those purposes.
3.2. We do not sell personal data. We do not process personal data for behavioural advertising purposes, and we do not carry out automated decision-making producing legal effects concerning data subjects or similarly significantly affecting them, within the meaning of Article 22 GDPR.
4. Categories of personal data, purposes and legal bases
4.1. Access to the Website
4.1.1. When the Website is accessed, our hosting and content delivery providers process technical data relating to each request, namely: the IP address from which the request originates, the resource requested, the date and time of the request, the HTTP response status, the user agent string (browser and operating system version) and, where transmitted by the browser, the referring address.
4.1.2. The pages and static assets of the Website are delivered through the network of Cloudflare, Inc. ("Cloudflare"), which also stands in front of the server referred to in the following sentence. The content management system from which the Website is produced, the media files uploaded to it and the submissions referred to in clause 4.5 are held on a virtual machine which we operate ourselves on Microsoft Azure infrastructure, in the West Europe region (Netherlands).
4.1.3. Purpose. Delivery of the Website, maintenance of its availability and integrity, prevention and investigation of abuse, and protection against attacks directed at the Website.
4.1.4. Legal basis. Article 6(1)(f) GDPR, our legitimate interest in operating a secure and functioning website.
4.2. Audience measurement
4.2.1. We measure the use of the Website by means of Umami, an analytics application which we operate ourselves on the virtual machine referred to in clause 4.1.2. The data which it records are held on that machine and are not transmitted to the publisher of that application or to any other recipient.
4.2.2. Umami operates without cookies and without any other form of storage on or access to the terminal equipment of the visitor. It does not retain IP addresses and does not permit the tracking of visitors across websites or the construction of individual profiles. The following data are recorded in respect of each page view: the page viewed; the referring address; the browser, operating system, device type and screen dimensions; and the country of origin of the request, derived from the IP address, which is not itself retained.
4.2.3. For the purpose of distinguishing repeat page views within a single day, Umami generates a one-way hash from the IP address, the user agent and a secret value which is rotated every twenty-four hours. By reason of such rotation, the resulting identifier cannot be attributed to a data subject and ceases to correspond to the same visitor after that period.
4.2.4. Purpose. Measurement of audience and of the use made of individual pages, for the purpose of maintaining and improving the content and structure of the Website.
4.2.5. Legal basis. Article 6(1)(f) GDPR, our legitimate interest in understanding how the Website is used. As no information is stored on, or accessed from, the terminal equipment of the visitor, the consent requirement under Article 5(3) of Directive 2002/58/EC, as transposed by Law no. 506/2004, does not apply to this processing.
4.3. Map functionality
4.3.1. Certain pages of the Website display a map. The map is rendered in the visitor's browser by means of the MapLibre GL JS library, which is served from our own domain. The map imagery is requested by the visitor's browser directly from Stadia Maps ("Stadia Maps") as the map is displayed.
4.3.2. By reason of that direct request, Stadia Maps receives the visitor's IP address, the user agent string and the identifiers of the map imagery requested, which disclose the geographic area displayed. No further data are transmitted to Stadia Maps by us, and we receive no data concerning the visitor in return. Stadia Maps acts as our processor under a data processing agreement concluded pursuant to Article 28 GDPR. Its privacy notice is available at https://stadiamaps.com/privacy-policy/.
4.3.3. The map is loaded upon the opening of a page containing it, and not upon interaction with it.
4.3.4. Where a map is accompanied by a link permitting the location to be opened in an external mapping service, no data are transmitted to the operator of that service unless and until the link is activated by the visitor, at which point the visitor leaves the Website and the privacy notice of that operator applies.
4.3.5. Purpose. Display of the geographic location of our premises.
4.3.6. Legal basis. Article 6(1)(f) GDPR, our legitimate interest in indicating our location to visitors.
4.4. Embedded video content
4.4.1. Certain pages of the Website incorporate video content hosted on YouTube, a service provided in the European Economic Area by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
4.4.2. The loading of a YouTube player constitutes the incorporation of third party content into the Website. Upon such loading, Google receives the visitor's IP address, the address of the page on which the player appears and information concerning the visitor's browser, and may store information on, and access information stored on, the visitor's terminal equipment, including cookies and comparable identifiers. Where the visitor is at that time authenticated to a Google account, Google is able to attribute such activity to that account. Such processing may occur irrespective of whether playback is initiated. The subsequent processing of those data is carried out by Google for its own purposes and under its own privacy policy, available at https://policies.google.com/privacy, and is outside our control.
4.4.3. For that reason, no YouTube player is loaded, and no data are transmitted to Google, unless the visitor first requests playback. Until such request, the location of the video displays a static image together with a notice to that effect. Activation of the player by the visitor constitutes the consent referred to in clause 4.4.4.
4.4.4. Legal basis. Article 6(1)(a) GDPR, the consent of the data subject, and Article 5(3) of Directive 2002/58/EC as transposed by Law no. 506/2004 in respect of the storage of and access to information on terminal equipment. Consent may be withdrawn at any time, with effect for the future, by reloading the page without requesting playback; withdrawal does not affect the lawfulness of processing carried out prior to it.
4.5. Forms submitted through the Website
4.5.1. Where a contact, enquiry, application or comparable form is submitted through the Website, we process the data entered into the fields of that form, which comprise, depending on the form concerned, the name, electronic mail address, telephone number and message of the sender, together with any further data which the relevant form requests. Submissions are stored in the content management system referred to in clause 4.1.2.
4.5.2. Purpose. Receipt of, and response to, the communication, and the conduct of any subsequent correspondence or pre-contractual exchange arising from it.
4.5.3. Legal basis. Article 6(1)(b) GDPR, where the submission is made with a view to taking steps at the request of the data subject prior to entering into a contract or to the performance of a contract; and Article 6(1)(f) GDPR, our legitimate interest in responding to communications addressed to us.
4.5.4. The provision of the data marked as mandatory in a form is necessary in order for us to respond. The provision of any further data is optional and a failure to provide it carries no consequence other than the inability to take it into account.
4.5.5. Data subjects are requested not to submit, by means of a web form, data falling within the special categories referred to in Article 9(1) GDPR. Where communication of such data is necessary, an appropriate means of transmission may be requested from us at the address indicated in clause 1.3.
4.5.6. Where we notify ourselves of a submission, or correspond with the sender in reply to it, by electronic mail, that correspondence is carried by Google Workspace, a service provided by Google Ireland Limited.
4.6. Display preferences
4.6.1. Where the visitor selects a light or dark appearance for the Website, that selection is stored in the local storage of the visitor's browser under the key payload-theme. The stored value is not transmitted to us or to any third party and is not accessible to us.
4.6.2. Legal basis. Article 5(3), second sentence, of Directive 2002/58/EC, as transposed by Law no. 506/2004, the storage being strictly necessary in order to provide a functionality expressly requested by the visitor. The stored value is removed upon clearing the browsing data of the browser concerned.
5. Cookies and comparable technologies
5.1. The Website employs the following cookies and comparable technologies:
Identifier / mechanism | Origin | Purpose | Duration | Consent required |
|---|---|---|---|---|
| First party | Retention of the selected light or dark appearance | Until browsing data are cleared | No (strictly necessary) |
| First party | Authentication of editorial users to the content management system. Set exclusively upon login by authorised personnel and never in respect of visitors to the Website | Two hours from login | No (strictly necessary) |
Map imagery requests | Stadia Maps | Rendering of map content | Not applicable (no storage on terminal equipment) | No |
Audience measurement | First party (Umami, self-hosted) | Measurement of page views without cookies | Not applicable (no storage on terminal equipment) | No |
YouTube cookies and comparable identifiers | Video playback and the own purposes of Google | As determined by Google | Yes (see clause 4.4) |
5.2. No cookies are employed on the Website for advertising, retargeting or cross-site tracking purposes.
6. Recipients and processors
6.1. Personal data processed in connection with the Website are disclosed to the following categories of recipient:
Recipient | Function | Categories of data | Place of processing |
|---|---|---|---|
Cloudflare, Inc. | Delivery of the Website and protection against attacks | Data referred to in clause 4.1.1 | Global network of distribution points |
Microsoft Ireland Operations Limited (Microsoft Azure) | Supply of the infrastructure on which the virtual machine referred to in clause 4.1.2 runs | Data referred to in clauses 4.1.1, 4.2.2 and 4.5.1, as held on that machine | West Europe region (Netherlands) |
Stadia Maps | Supply of map imagery | Data referred to in clause 4.3.2 | [●] |
Google Ireland Limited | Hosting of video content (YouTube) | Data referred to in clause 4.4.2 | Global |
Google Ireland Limited | Transmission of electronic mail (Google Workspace) | Content of the communication | Global |
6.2. The recipients listed in clause 6.1, with the exception of Google in its capacity as the provider of YouTube, act as processors on our behalf pursuant to data processing agreements concluded in accordance with Article 28 GDPR, and process personal data solely on our documented instructions.
6.3. The audience measurement described in Section 4.2 involves no recipient: the application is operated by us and the data which it records do not leave the virtual machine referred to in clause 4.1.2.
6.4. Beyond the recipients listed above, personal data are disclosed only where disclosure is required by law or by a decision of a competent authority or court, or where it is necessary for the establishment, exercise or defence of legal claims.
7. Transfers to third countries
7.1. The virtual machine referred to in clause 4.1.2 is located within the European Economic Area. Certain recipients referred to in Section 6 nevertheless carry out processing operations outside it, principally in the United States of America.
7.2. Where such a transfer occurs, it is effected on the basis of an adequacy decision of the European Commission, including, where the recipient is certified thereunder, the EU–US Data Privacy Framework; on the basis of the standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR, supplemented where necessary by additional technical and organisational measures; or on the basis of another safeguard provided for in Chapter V GDPR.
7.3. Information as to the safeguard applicable to a given recipient, and a copy of the relevant instrument where applicable, may be obtained upon request addressed as provided in clause 1.3.
8. Retention
8.1. Personal data are retained for the following periods:
Processing operation | Retention period |
|---|---|
Access to the Website (clause 4.1) | No record of individual requests is retained on our server. Error logs produced by it are overwritten in rotation once they reach a fixed size. Records held by Cloudflare are retained in accordance with its data processing agreement |
Audience measurement (clause 4.2) | Twenty-four months from the date of recording, after which the records are deleted |
Forms submitted through the Website (clause 4.5) | Three years from the date of submission, after which the submission is deleted from our content management system |
8.2. Notwithstanding clause 8.1, personal data may be retained for a longer period where retention is required in order to comply with a legal obligation to which we are subject, or where it is necessary for the establishment, exercise or defence of legal claims, and in such case solely for the duration of that requirement or necessity.
9. Rights of the data subject
9.1. Subject to the conditions laid down in the GDPR, data subjects have the right:
a) to obtain confirmation as to whether personal data concerning them are being processed and, where that is the case, access to those data and to the information referred to in Article 15 GDPR;
b) to obtain the rectification of inaccurate personal data and the completion of incomplete personal data (Article 16 GDPR);
c) to obtain the erasure of personal data concerning them where one of the grounds in Article 17 GDPR applies;
d) to obtain the restriction of processing in the circumstances set out in Article 18 GDPR;
e) to receive the personal data which they have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller, where the processing is based on consent or on a contract and is carried out by automated means (Article 20 GDPR);
f) to object, on grounds relating to their particular situation, at any time to processing based on Article 6(1)(f) GDPR, including the processing described in clauses 4.1, 4.2, 4.3 and 4.5, in which case we shall cease such processing unless we demonstrate compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or the processing is required for the establishment, exercise or defence of legal claims (Article 21 GDPR);
g) to withdraw consent at any time where processing is based on Article 6(1)(a) GDPR, without affecting the lawfulness of processing based on consent before its withdrawal.
9.2. The rights set out in clause 9.1 may be exercised by request addressed as provided in clause 1.3. We shall provide information on action taken without undue delay and in any event within one month of receipt of the request, which period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case the data subject shall be informed of the extension and of the reasons for the delay within one month of receipt. No fee is charged, save in the circumstances provided for in Article 12(5) GDPR.
9.3. Where necessary in order to confirm the identity of the requesting person, we may request the provision of additional information for that purpose, in accordance with Article 12(6) GDPR.
9.4. Data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement. The supervisory authority competent in Romania is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru nos. 28-30, Sector 1, 010336 Bucharest, electronic mail [email protected], www.dataprotection.ro. The exercise of that right is without prejudice to any other administrative or judicial remedy.
10. Security
10.1. We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, including the encryption of data in transit by means of transport layer security, the restriction of access to personal data to persons requiring such access for the performance of their duties, and the authentication of all access to the content management system.
11. Minors
11.1. The Website is not directed at, and its functionalities are not intended for use by, persons under the age of sixteen.
11.2. Where processing is based on consent pursuant to Article 6(1)(a) GDPR and the data subject is under the age of sixteen, such processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the data subject, in accordance with Article 8 GDPR.
11.3. Where we become aware that personal data concerning a person under the age of sixteen have been provided to us without the authorisation referred to in clause 11.2, we shall erase those data without undue delay. Any such circumstance may be notified to us at the address indicated in clause 1.3.
12. Amendments
12.1. We may amend this Privacy Policy in order to reflect changes in our processing operations or in the applicable legal framework. The version in force at any time bears the effective date indicated at the head of this document.
12.2. Where an amendment materially affects the manner in which personal data are processed, we shall bring it to the attention of data subjects by an appropriate notice on the Website prior to the amendment taking effect.
13. Governing law
13.1. This Privacy Policy and the processing operations described in it are governed by Regulation (EU) 2016/679, by Law no. 190/2018 on measures implementing that Regulation, and by Law no. 506/2004 concerning the processing of personal data and the protection of privacy in the electronic communications sector.