Privacy policy

PRIVACY POLICY

Updated on April 21, 2026

Future Romania („we” or „our”) is committed to protecting privacy
you. This Privacy Policy explains how the data
your personal data is collected, used and disclosed by Future Romania through
through the Future Romania mobile application (the „Application”).
This Policy applies to the Application and the services accessible through it. The Application is the platform
digital community of the „Future Romania – Public Leadership Program” („Program”),
operated by the Vintilă Brătianu Association, a non-profit organization registered in Romania, fiscal registration code (CIF)
49750951, with headquarters at 134 Viitorului Street, Building A, ground floor, apartment 02, Sector 2, Bucharest, Romania.
The application does not process payments, orders, or commercial transactions.

1. The data controller and the DPO
Data controller: Vintilă Brătianu Association, tax ID 49750951, 134 Viitorului Street, Building A, ground floor,
Apt. 02, Sector 2, Bucharest, Romania. E-mail: suport@futureromania.ro.
Data Protection Officer (DPO): Niculina Șomlea. E-mail: dpo@futureromania.ro.
Mailing address: 134 Viitorului Street, Building A, ground floor, apt. 02, District 2, Bucharest – „În
DPO's attention.

2. The data we collect
2.1. Data provided directly by you:
Upon registration and use of the Application, you may provide: full name, e-mail address, telephone number
phone (optional), date of birth, gender, profile picture (optional), city and country of residence,
professional field and/or current position (optional), the edition of the Program you participated in.
2.2. Automatically collected data:
When using the Application, the following data may be collected automatically: the device's IP address;
visited Application sections, time, date and duration of the visit; type and version of the operating system;
device type and unique identifiers; usage analytics (via Google Analytics for Firebase);
error reports (via Firebase Crashlytics).
2.3. Location data:
The application can collect approximate geolocation data for features based on
location and personalized content. Aggregated and anonymized location data may be used to
performance analysis and improvement of the application. You can disable location access at any time from
device settings.
2.4. Device functionality data:
Camera and Photo Gallery: The app may request access to allow you to upload a photo
profile. You can refuse these permissions without affecting other functionalities of the Application.

3. Purposes and legal grounds for processing
3.1. Performance of the contract (Art. 6(1)(b) GDPR):
User account management; enabling networking functionalities, including visibility
profile and messaging between active users; providing access to content related to the Program and
community features; displaying your profile to other active users according to
community functionalities described in the Unilateral Declaration of Participation.
3.2. Legitimate interest (Art. 6 para. (1) lit. f) GDPR):
Improving application functionality and user experience; analyzing patterns of
use through aggregated and anonymized analyses; ensuring the security of the Application and preventing
abuses; facilitating professional and civic networking among Program alumni. A test of
The proportionality (balancing test) has been conducted and is available upon request.
3.3. Consent (Art. 6(1)(a) GDPR):
Sending push notifications about relevant events, activities, or opportunities of
Program; the use of the profile picture in promotional materials. You can withdraw
consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7
para. (3) GDPR).
3.4. Legal obligation (Article 6(1)(c) GDPR):
Maintaining accounting and tax documentation in accordance with Romanian legislation, including Law no. 82/1991
(Accounting Law), the Fiscal Code (Law no. 227/2015) and Law no. 16/1996 (Archives Law
Nationals.
3.5. Obligation to provide data
Providing personal data is a contractual requirement necessary for creation
and maintaining your account in the Application. Without the mandatory data (name, address,
email, program edition), we cannot register the account and we cannot provide the functionalities
community. Data marked as optional (phone number, profile picture, domain
professional) are not mandatory, and the refusal to provide them does not affect the possibility of using
The Application. No legal or regulatory provision obligates you to provide data to the Application.
3.6. Automated decisions
The application does not make decisions based solely on automated processing, including profiling
profiling that produces legal effects or similarly significant effects on you, in
the meaning of Art. 22 GDPR.

4. Profile visibility and community features
By creating an active account, the following profile data is visible to other active users:
name, profile picture (if uploaded), Program edition, professional field/position
(if you filled them in), the city/country. Email address and phone number are visible to others
users only if you choose to display them in your profile privacy settings. You have control
fully regarding the visible contact data.
The app includes an internal messaging feature (chat) for direct communication between
active users. Messages are processed by the Operator exclusively as a provider of
technical infrastructure, pursuant to Art. 6 para. (1) lit. b) GDPR. The content of the messages is not
monitored and is not used for other purposes.

5. Third-party services
The application uses the following third-party services, each with its own Privacy Policy:
Google Play Services (https://policies.google.com/privacy); Google Analytics for Firebase
(https://firebase.google.com/support/privacy); Firebase Crashlytics
(https://firebase.google.com/support/privacy). Only aggregated and anonymized data is transmitted
periodic to these services.

6. Data sharing and recipients
Your personal data may be shared with: IT service providers, hosting, and
email acting as data processors pursuant to Article 28 GDPR agreements; other users
App activities (profile data, subject to privacy settings); academic institutions
partners (e.g., Oxford, Cambridge, Harvard) – including in countries outside the EU/EEA – exclusively for
validation of scholarships or academic programs; public authorities, exclusively when required by law
this thing.
The Service Provider does not sell, rent, or share your personal data
personal with third parties for commercial, advertising, or marketing purposes.

7. International data transfers
For transfers to the USA (Google LLC and other certified providers), we rely on the adequacy decision of
adequacy regarding the EU-U.S. Data Privacy Framework ((EU) 2023/1795), supplemented by Clauses
Standard Contractual Clauses (SCC) pursuant to Decision (EU) 2021/914, Module 2. For transfers to
United Kingdom, we rely on Adequacy Decision (EU) 2021/1772, as renewed on 19
December 2025. For other third countries, we use SCCs supplemented by technical measures in accordance with
EDPB Recommendations 01/2020. You can request a copy of the transfer safeguards at
dpo@futureromania.ro.

8. Data retention
We retain personal data for as long as the account is active and for a reasonable period
subsequent (up to 30 days after account deletion). Data necessary for legal obligations
(accounting, taxation, archiving) are kept for the duration provided by law (usually, 10 years
for financial records in accordance with Romanian legislation. Anonymous and aggregated data may be
stored indefinitely for statistical and research purposes.

9. Your rights under the GDPR
You benefit from the following rights: The right of access (Art. 15) – to obtain confirmation and a
copy of personal data; Right to rectification (Art. 16) – to correct inaccurate data;
Right to erasure (Art. 17) – the right to request the deletion of data; Right to restriction (Art.
18) – to restrict processing in certain circumstances; The right to data portability (Art. 20) – to
provide the data in a structured, machine-readable format; The right to object (Art. 21) – to
object to processing based on legitimate interest; The right against automated decisions (Art. 22) –
not to be subject to decisions based solely on automated processing; The right to withdraw consent
(Art. 7 para. (3)) – at any time, without affecting prior processing.
To exercise your rights, contact: dpo@futureromania.ro or by mail at: Association
Vintilă Brătianu, 134 Viitorului St., Building A, ground floor, apt. 02, Sector 2, Bucharest – „Attn."
DPO”. Response deadline: one month (Article 12(3) GDPR), extendable by two months in cases
complex, with prior notification.

10. Account deletion
You have the right to delete your account at any time, either directly from the Application or by contacting
dpo@futureromania.ro. Upon account deletion: the profile and all associated personal data
will be deleted; the data will no longer be visible to other users; personal data will be deleted in
30-day term; the data necessary for legal obligations will be kept for the duration provided by
law.

11. Protection of minors
The application is not intended for persons under 16 years of age, in accordance with Art. 8 para. (1) of
Regulation (EU) 2016/679 (GDPR). We do not knowingly collect personal data from
children under 16 years of age. If we find that personal data has been collected from a minor under 16 years of age without
parental consent, we will take steps to delete them immediately. Contact:
dpo@futureromania.ro.

12. Security measures
We implement appropriate technical and organizational measures to protect data in accordance with Art. 32
GDPR, including: encrypted authentication; data encryption in transit (TLS/SSL); limited access to
authenticated users; periodic security assessments; incident response procedures
in accordance with the internal Security Incident Management Policy.

13. The supervisory authority
You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing
Data Protection Authority (ANSPDCP): General Gheorghe Magheru Blvd., no. 28-30, District 1,
Bucharest, 010336. Website: www.dataprotection.ro. E-mail: anspdcp@dataprotection.ro. Phone:
+40 318 059 211.

14. Changes to the Privacy Policy
We may update this Policy periodically. We will notify you of any material changes.
through the Application, prior to their entry into force. In the event that the changes concern processing activities
based on your consent, we will request new consent, to the extent that
The law requires this. If you do not agree with the updated policy, you can delete your account.

15. Contact
For general questions: suport@futureromania.ro. For data protection:
dpo@futureromania.ro. Website: https://futureromania.ro.