1. General information. Who we are and what this document covers

The Social Incubator Association ("ATSI" or "Organizer"), with its registered office in Bucharest, Sector 2, Str. Spătarului no.7, entered in the Special Register under no.10/17.03.2020, registered in the Register of Associations and Foundations under no.16760/A/2014 and in the ANAF Register of religious entities/units since 15.04.2019, fiscal registration code 33177409, e-mail: [email protected], [email protected], phone: +40790599908, as organizer of the platform entitled "Sport For Good" (the "Platform"), will process, as a controller of personal data, the personal data of participants and of the other persons involved in the Events organized by ATSI, in compliance with the applicable legislation, in particular the General Data Protection Regulation 679/2016 ("GDPR") and the details set out in this document.

This version of the Privacy Policy was revised on 05.05.2025 and is intended to inform you about:

• the processing of your personal data, as a visitor of the Platform or as a user of the functions within the Platform;
• the processing of personal data carried out by ATSI in order to conduct its activities.

ATSI may update this Privacy Policy subsequently, in which case it will inform the data subjects through the Platform about any changes before they become applicable.

Depending on your interaction with the Association, we will process your personal data in accordance with the details set out below in this document.

2. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person (the "data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

"Platform" means the website https://sportforgood.ro/

"Donor" means the natural or legal person who donates sums of money and/or services to ATSI and/or to the persons supported by ATSI, through the instruments made available by the latter.

"Processing" (and its derivatives, including without limitation "to process") means any operation or set of operations performed on Personal Data, including without limitation the collection, recording, storage, modification, use, disclosure, access, transfer or destruction thereof.

"Visitor" means any person who accesses or uses the Platform.

"Volunteer" means any natural person who takes part in the volunteering activities organized by ATSI.

3. Types of processing. What data is processed, what are the purposes, the grounds on which we process the data and the retention period?

Purpose of processing – Legal ground – Retention period:

• Participation in social, educational or professional-integration projects and programs – Performance of a contract or pre-contractual steps (art. 6 para. 1 letter b GDPR) – For the duration of the project and 5 years from its completion, in accordance with accounting legislation.
• Administrative, organizational communications or those related to events – Legitimate interest (art. 6 para. 1 letter f GDPR) or consent (as the case may be) – For the duration of the cooperation or until an objection is expressed.
• Promotion of the Association's activity through images or video materials – Consent (art. 6 para. 1 letter a GDPR) – Until consent is withdrawn.
• Marketing communications (e.g. newsletter, event invitations, campaigns) – Consent (art. 6 para. 1 letter a GDPR) – Until consent is withdrawn.
• Selection and management of volunteers – Performance of a contract / legitimate interest – For the duration of the cooperation and up to 3 years from its termination.
• Fulfilment of legal obligations (e.g. financial reporting, archiving, audit) – Legal obligation (art. 6 para. 1 letter c GDPR) – In accordance with the applicable legislation (e.g. 10 years for accounting documents).
• Handling of requests or disputes – Legitimate interest / Legal obligation – For the period necessary to resolve the request and in accordance with the limitation periods.

What personal data is processed?

ATSI will process, as a controller of personal data, the following personal data of participants and of the other persons involved in the Events posted on the Platform:

• First name
• Last name
• Age
• Email
• Address
• Phone number
• Facebook profile
• Instagram profile
• LinkedIn profile

For what purposes and on what grounds do we process personal data?

ATSI processes personal data in the context of the organized Events, for the following purposes and on the following grounds:

• for registering participants in the Event and ensuring the running of the Events posted on the Platform, including validation of registration, awarding prizes, handling any requests/complaints made by participants, on the basis of the contract represented by the acceptance of the Terms and conditions of registration;
• for handling requests made by virtue of the rights that data subjects enjoy under the GDPR, on the basis of the legal obligation regarding the protection of personal data;
• for fulfilling the legal obligations incumbent on the Organizer (such as financial obligations, archiving, obligations regarding legal capacity);
• for producing images of how the Events posted on the Platform are conducted, in order to document them, but also to ensure the promotion of the Events, on the basis of the Organizer's legitimate interest;
• for carrying out analyses and statistics regarding the success of the Events posted on the Platform, defending the rights and interests of the Organizer, as well as resolving other notifications in connection with the running of the Events, on the basis of the Organizer's legitimate interest;
• for transmitting communications regarding subsequent events and ATSI's activity, on the basis of the consent of the Participant or of the other persons involved in organizing the Events.

Attention! The Participant or the other persons involved in the Events has/have the possibility to withdraw this consent at any time. The withdrawal will take effect for the future and will not affect the lawfulness of previous processing.

• to the extent that a separate image-use agreement has been concluded with ATSI, the personal data (in particular the image) will be processed on the basis of that contract regarding the use of the image, also taking into account the details in this document;
• likewise, ATSI will process the personal data of the representatives/contact persons/employees of the Events' partners (including sponsors), on the basis of the legitimate interest of ensuring the running of the contractual relationship with that partner in the context of organizing the Events.

For how long will the data be kept?

Personal data will be processed for the period necessary to achieve the purposes described above, at least for the period necessary to run the Event for which registration was made on the Platform.

The data may also be kept for a longer period, such as where there is a legal obligation (e.g., in the case of supporting financial-accounting documents, the retention period required by law is 10 (ten) years).

If consent has been given to receive messages about our subsequent events, the data will be processed until consent is withdrawn or until the right to object is exercised.

In the case of complaints concerning non-compliance with the rules, the Terms and conditions, breach of the legislation (including that specific to the protection of personal data), the data will be kept, in principle, for a period of 3-4 (three to four) years by reference to the limitation period. In the case of proceedings where the use of such data is useful, this period may be extended until the completion of the respective proceedings (such as in the case of a court case).

In the case of images processed under the image-use Agreement concluded separately with ATSI, the data will be processed for the period provided in that contract.

Registration within the Events

If the Participant or the other persons involved in the Events select the option of registering directly on the Platform, the interested person will take note that registration will differ depending on each event, and the steps that must be followed for registration will be mentioned in the description of each event.

Payment of the participation fee for the chosen Event does not include and does not exclude the right of any person who is aware of the Event, or who participates or not in the Event, to make donations consisting of sums of money to ATSI's account. A donation of a sum of money may be made by bank transfer to ATSI's account, after transmitting to the interested person the data necessary to carry out the transfer, or by selecting the option to pay the contribution directly on the Platform.

If the User wishes to make an online donation, in support of the Association's activity, this is done through the online payment processor Netopia Payments: https://secure.mobilepay.ro/, subject to the following conditions:

• The User will be shown the amount in RON corresponding to their contribution;
• The transaction price indicated is the net price that will be paid by the user, with no additional fee.

The steps to follow in order to pay the contribution online are:

• Click on the link https://asociatiasocialincubator.org/doneaza/ where you enter the details necessary for registration;
• From this moment you will be redirected to the secure page to finalize the donation;
• If the card transaction was successful, the next page will display the message: "Thank you for your donation" and relevant information for this operation will be provided. This information will also be received by email.

For online payment, personal information is necessary for the correct and efficient processing of the transaction placed. Personal data is entered using an SSL-encrypted connection. Personal information is not transferred to other third parties, neither by ATSI nor by Netopia Payments.

Where an email address is provided, it is important because information related to the donation will be transmitted via email. Where an email address has not been provided and information about the status of the donation is desired, information may be requested by sending an email to: [email protected]

Is providing the data mandatory?

The data in the registration form completed for participation in the Event selected on the Platform is necessary for the conduct of the contractual relationship (expressed through the acceptance of the Terms and Conditions of registration and participation). In the absence of this data, we will not be able to ensure the registration and confirmation of participation in the chosen Event.

4. To whom can the personal data be disclosed?

The personal data processed by ATSI in the context of the Platform for the purposes detailed above may be disclosed to the following categories of recipients:

• ATSI's partners and collaborators involved in running the Events posted on the Platform (all partners listed on the Platform under the partners category), both those acting as processors of the Association and those acting as controllers, from fields such as: PR agencies, marketing agencies, sponsors, photography and videography companies, mobile telephony operators, courier firms;
• the public, in the case of images taken during the events/projects/actions carried out by ATSI, for the purposes described above (including on the organization's website, on the Platform and through social networks – such as Facebook, Instagram, LinkedIn);
• external consultants who support ATSI in carrying out its activity in compliance with the legal provisions (such as PR agencies, lawyers, legal advisers, notaries);
• public authorities and institutions upon their request or when there is another ground, such as a legal obligation or the legitimate interest of the Association.

5. Transfer of data

ATSI will not transfer your personal data to countries outside the European Economic Area. To the extent that such transfers are carried out, the Association will ensure that it implements the appropriate transfer safeguards and will inform you accordingly about the transfer countries and about the fact that you may at any time request information or copies of the transfer safeguards adopted.

6. What rights do you have regarding the processing of personal data?

Under the conditions of the applicable data protection legislation, in particular under the GDPR, you have the following rights:

• the right to be informed – the right to receive a minimum content of information regarding the processing activities carried out by ATSI, in accordance with legal requirements;
• the right of access – the right to obtain from the controller confirmation as to whether or not personal data concerning you is being processed, and, if so, the provision of information about the details of the processing (e.g., purpose, categories of data, recipients/categories of recipients, where possible the envisaged storage period or the criteria used to establish that period);
• the right to rectification – the right to obtain from the controller the rectification of inaccurate personal data concerning you, or the completion of data that is incomplete, including by providing a supplementary statement;
• the right to erasure of data ("the right to be forgotten") – the right to obtain from the controller the erasure of personal data in the cases established by law – such as when the data is no longer necessary for the purposes for which it was collected/processed; you withdraw the consent on which the processing was based and there is no other legal ground for the processing; the data was processed unlawfully; the data must be erased to comply with a legal obligation incumbent on the controller) and subject to the other conditions;
• the right to restriction of processing – the right to obtain from the controller the restriction of processing where one of the following applies: (i) the accuracy of the data is contested by the data subject; (ii) the processing is unlawful and the data subject opposes the erasure of the data; (iii) the controller no longer needs the data, but the data subject requests it for the establishment, exercise or defence of a legal claim in court; (iv) for the period during which it is verified whether the controller's legitimate rights prevail over those of the data subject, in the case of the latter's objection;
• the right to data portability – the right to receive the data concerning them that they provided to the controller in a structured, commonly used and machine-readable format, and to request the transmission of this data to another controller where the processing is based on consent or on a contract and is carried out by automated means;
• the right to object – the right to object at any time, on grounds relating to their particular situation, to processing carried out on the basis of legitimate interest. Where data is processed for direct marketing purposes, the data subject has the right to object at any time;
• the right to withdraw consent where the processing is based on it, the withdrawal taking effect for the future without affecting the lawfulness of processing carried out prior to the withdrawal;
• the right not to be subject to an automated individual decision – the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them, except in cases where such decisions/profiles are permitted under the applicable legislation. When such decisions or profiles may be taken/created in compliance with the law, you have the right to obtain information about the logic used, the consequences for you and their significance, as well as the right to contest or otherwise obtain human intervention;
• the right to lodge a complaint with the supervisory authority (the National Supervisory Authority for Personal Data Processing – ANSPDCP) or before the competent courts.

Please note that, in the case of withdrawing consent in accordance with the applicable legal provisions, where such consent was previously given for direct marketing activities, ATSI, after taking note of this fact, will no longer send you direct marketing communications. Although you will no longer receive direct marketing communications, ATSI may nevertheless process your Personal Data lawfully, on other grounds and for other purposes, such as fulfilling certain legal obligations incumbent on it, performing the contract, or ATSI's legitimate interest (e.g., improving services, resolving complaints received, defending rights and interests).

Where the data subject submits a request in electronic form for the exercise of their rights, the information will be provided by our Association also in electronic form where possible, except where the data subject requests another format.

We will try to respond promptly to any request from you and, in any case, within the time limits expressly stated by the applicable legal provisions (as a rule 1 month from the registration of the request). Depending on the complexity of the request, the response deadline may be extended, in accordance with the legal provisions, by a further 2 months.

To exercise the rights mentioned above or for more information about how ATSI processes personal data in the context of registration on the Platform, you can contact us at the email address: [email protected] or at our registered office located in Bucharest, Sector 2, Str. Spătarului no.7.