GDPR policy.

1. The data controller

Asociația Română pentru Smart City (ARSC, the Romanian Smart City Association) - controller of personal data for all processing carried out under the ‘Stup de Energie’ brand.
Registered office: Integral Business Center, Bd. Pipera nr. 1-IA, Voluntari 077190, Ilfov County, Romania
Phone: 031 425 42 63
Contact / data processing officer email: [email protected]
ARSC general email: [email protected]

2. What data we collect

• Identification data: surname, first name, job title, institution/organisation (when you subscribe to the Brief, sign up for the Forum/Academy, or make a commercial enquiry).
• Contact data: email address, phone number (optional).
• Technical data: IP address, browser type, pages visited (technical logs, kept for a maximum of 30 days).
• Contractual data: for direct clients - billing data as required by tax legislation.

3. Why we collect this data (legal basis)

• Explicit consent (art. 6(1)(a) GDPR) - for subscribing to the Brief and receiving marketing communications.
• Performance of a contract (art. 6(1)(b)) - for clients who contract STUP services.
• Legal obligation (art. 6(1)(c)) - invoicing, accounting records, tax reporting.
• Legitimate interest (art. 6(1)(f)) - site traffic analysis, platform security, fraud prevention.

4. Who we share data with

Your data is never sold. It may be accessed only by:

• The internal ARSC team, under a duty of confidentiality.
• Public authorities, only upon an official request and under the conditions laid down by law.

In practice, this is the path your data takes when you fill in a form on stupenergie.ro:

• Cloudflare Turnstile first checks that you are a human, not a robot.
• What you filled in reaches api.arsc.ro, ARSC's own service that receives the forms from all our sites.
• From there, the submission is saved in a database on our own server, at forms.arsc.ro. Access is restricted to ARSC administrators.
• At the same time, an email notification goes to the team, sent through Resend, our transactional email provider.

Besides what you write in the form, two technical data items are also saved: your IP address in encrypted form (a code from which the IP cannot be reconstructed) and your browser type. Both serve to prove consent and to stop abuse, not to identify you.

Each provider works under a processing contract in accordance with art. 28 GDPR.

5. Transfers outside the EU

The site is delivered through a Cloudflare network, and the anti-bot check on the forms (Cloudflare Turnstile) is also a Cloudflare service. Cloudflare may process data outside the European Union and applies Standard Contractual Clauses for this purpose; it is also certified under the EU-US Data Privacy Framework.

Email notifications to the team are sent through Resend, which may also process data outside the European Union, under the same contractual safeguards.

Our servers are in the European Union. The site hosting, the traffic measurement (Plausible) and the database that receives the forms run on ARSC's own infrastructure, at Hetzner, in Nuremberg, Germany. We no longer use Netlify for hosting and we use no automatic translation service.

6. How long we keep data

• Brief subscription: until you unsubscribe + 30 days.
• Contractual data: at least 10 years (tax requirement).
• Technical logs: a maximum of 30 days.
• Marketing communications: until consent is withdrawn.

7. Your rights

Under the GDPR, you have the right to:

• Access your data (art. 15)
• Rectification of inaccurate data (art. 16)
• Erasure (‘the right to be forgotten’, art. 17)
• Restriction of processing (art. 18)
• Portability of your data (art. 20)
• Object to processing (art. 21)
• Withdraw consent at any time, without retroactive effect (art. 7(3))

To exercise any of these rights, write to us at [email protected]. We reply within 30 days at most.

8. Complaints

If you believe that the processing of your data breaches the GDPR, you have the right to lodge a complaint with the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, the Romanian data protection authority):
Address: B-dul G-ral Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania
Web: www.dataprotection.ro

9. Security

We apply reasonable technical and organisational measures to protect data: mandatory HTTPS, encryption at rest where applicable, access control, regular team training. In the event of a security breach, we notify ANSPDCP within 72 hours in accordance with art. 33 GDPR.

10. Changes to this policy

The current version is published on this page. Material changes will be notified to subscribed users.