Privacy Policy

Privacy Policy
Notice on the processing of personal data - mantrailing.ro

Data Controller

Name	The "Drumeții Montane" Association
Tax ID (CUI)	27700553
Registered office	Bucharest Municipality, Sector 3, Romania
Data protection (DPO)	[email protected] (forwarded to the single point of contact [email protected])
Supervisory authority	ANSPDCP, Bd. G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro

Your personal data is processed by the "Drumeții Montane" Association, in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018. This policy applies to all users of the mantrailing.ro platform: members and volunteers of the Association, participants in mantrailing courses and training sessions and in search and rescue (SAR) activities, as well as any other registered user who publishes or accesses content on the platform - individuals, representatives of other associations, institutions, or partners who promote events, articles, or collaborations through the site. This document is subordinate to the Association's general GDPR Policy and may not derogate from it.

1. What data we collect about you

The categories of data depend on how you use the platform. We collect:

• Identification and contact data of any registered user: first and last name, phone number, locality, email.
• If you register on behalf of, or as a representative of, an association, institution, or partner company: its name and contact details, to the extent you provide them.
• Content that you publish on the platform - events, articles, presentations of your organization, photographs, or video materials - becomes public through your own action and may contain personal data, in which case you are responsible for it in accordance with the Terms and Conditions of Use.
• If you take part in mantrailing courses or training sessions, or in search and rescue (SAR) activities, we additionally collect:
  • data about the dog(s) you train with: name, breed, age, identification/microchip number - necessary for organizing training sessions and keeping SAR team records;
  • health-related data, only if explicitly required for participation (e.g. a medical fitness certificate for a course or a mission); we collect strictly the minimum necessary;
  • photographs and video materials taken during training sessions, courses, events, and missions, when you are identifiable in them;
  • geolocation (GPS) data, when tracking apps or devices are used during search and rescue exercises and missions;
  • and, if required for insurance purposes or participation in a competition, your personal identification number (CNP).
• Minimal technical data on the use of the account and the Platform (registration date, last login date, logs), necessary for the site's operation and security.

We only ask for the data necessary for the purpose for which it is collected. Fields that are not mandatory are marked as such on forms. Providing the mandatory fields is required to create an account, register for activities, or publish content; refusing to provide them may result in being unable to use the relevant feature of the Platform.

2. Why we process this data and on what legal basis

Purpose	Examples	Legal basis
Creating and managing your account	Authentication, account management	Performance of a contract
Publishing content on the platform	Events, articles, presentations of your organization	Performance of a contract / legitimate interest
Partnerships with other organizations	Collaborations, mutual promotion of events	Legitimate interest / pre-contractual measures
Organizing courses and training sessions	Registration, communication, group scheduling	Performance of a contract / pre-contractual measures
Search and rescue operations	Coordinating teams and dogs in emergency situations	Vital interests of the person being searched for or of the team
SAR team and dog records	Certifications, training history	Legitimate interest of the Association
Contact forms	Responding to inquiries	Legitimate interest / pre-contractual measures
Newsletter	Communications and news about the Association's activity	Explicit consent (opt-in)
Photo/video promotion	Publication on the site or social media	Explicit consent
Health-related data	Verifying physical fitness for a course	Explicit consent / vital interest, as applicable
Platform security	Technical logs, preventing unlawful use	Legitimate interest
Compliance with legal obligations	Responding to requests from authorities, archiving	Legal obligation

We do not use your data for profiling, scoring/credit assessment, or loyalty programs. Direct marketing is carried out exclusively on the basis of explicit consent (opt-in), never inferred from mere browsing of the site.

3. Who we disclose your data to

• We do not sell, rent, or share your data with third parties for commercial purposes.
• Data may be transmitted to public authorities (police, prosecutor's office, courts, judicial enforcement officers), strictly when there is an express request based on a legal obligation.
• Within search and rescue operations, in specific mission situations, the strictly necessary data (e.g. team identity, contact details) may be communicated verbally or in writing to the authorities or structures with which we cooperate on that specific mission (e.g. IGSU, ISU, Salvamont, local authorities), without this implying a formal institutional partnership or a systematic data transfer.
• Technical providers that support the operation of the platform (web hosting, email, newsletter), acting as data processors, under a contract that obliges them to comply with the GDPR.
• Data is not transferred outside the European Union/EEA unless the relevant provider offers adequate safeguards in accordance with the GDPR.

4. How long we keep your data

Data category	Retention period	Notes
Account data	For the duration of the account + 1 year in backups	Contract
Published content (events, articles)	For as long as the content remains relevant/valid, reviewed periodically	Contract / legitimate interest
Course/training registration data	1 year after the event ends	Contract
Health-related data	Until the activity is completed, then destroyed immediately	Strict minimization
SAR team and dog records	For the duration of the activity + 3 years	Evidence of certifications and compliance
Published photo/video materials	Until consent is withdrawn	Consent
Geolocation (GPS) data	For the duration of the mission/exercise, then deleted	Strict minimization
Newsletter	Until unsubscription	Consent
Contact forms	1 year after the request is resolved	Legitimate interest
Technical logs	Maximum 6 months	Legitimate interest - security

After these periods expire, data is irreversibly deleted or anonymized, except where the law requires a longer archiving period or a dispute is ongoing.

5. Your rights

Regarding your data, you have the following rights, which you may exercise at any time, free of charge, by sending a request to [email protected]:

• the right of access - to find out what data we process about you;
• the right to rectification - to correct inaccurate data;
• the right to erasure - to request the deletion of your data, when there is no longer a legal basis for keeping it;
• the right to restriction of processing, in certain situations;
• the right to data portability, for data processed by automated means, based on the contract or on consent;
• the right to object to processing based on legitimate interest;
• the right to lodge a complaint with ANSPDCP, if you consider that your rights have been violated.

We respond to any request within one month of receiving it at the latest. Please note that exercising the right to erasure over your account data may result in being unable to continue using your account and participating in projects that require an active account.

6. Consent and its withdrawal

Where processing is based on consent (e.g. newsletter, promotional photographs and video materials, some health-related data), it may be withdrawn at any time, as easily as it was given, by email to [email protected] or, for the newsletter, via the unsubscribe link. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal and does not condition participation in activities for which consent is not required.

7. Minors

If you take part in courses or training sessions and are under 16 years old, registration and any related consent (including for photography and filming) must be given by your parent or legal guardian. Refusing photo/video consent does not condition participation in the activity.

8. Data security

We apply appropriate technical and organizational measures to protect your data against unauthorized access, loss, or accidental disclosure: access control, encryption where applicable, backups, and training for personnel with access to data. Any information transmitted to the platform over the internet is done at the usual technical risk of the network; once received, we protect it through the measures described above.

9. Contact

For any question regarding this policy or the exercise of your rights, you may write to us at [email protected].