LEGAL DOCUMENT

Privacy policy

This document explains what personal data we collect through this site, why we collect it, and what rights you have over it, in line with Regulation (EU) 2016/679 (GDPR).

Last updated: 22 August 2026

1. DATA CONTROLLER

Who processes the data

The data controller is ASOCIAȚIA STEM DUO, non-governmental, non-profit association.

Tax identification number 54630862
Contact email contact@stemduo.com
Registered office Str. Brăilei nr. 208, bl. C2, sc. 1, et. 4, ap. 17, Galați, Galați County, Romania

2. WHAT WE COLLECT

Data from the contact form

When you write to us through the form on this site, we store:

the first and last name you enter;
your email address;
the subject and body of the message;
the date and time it was sent;
a cryptographic fingerprint of your IP address and your browser type.

Your IP address is never stored in the clear. We keep only a value irreversibly derived from it, used solely to limit automated messages and abuse. It cannot be turned back into an IP address.

3. WHY, AND ON WHAT BASIS

Purpose of processing

We use the data solely to reply to your message and to carry on the correspondence that follows from it. The legal basis is your consent (Art. 6(1)(a) GDPR), given by ticking the box in the form.

The IP fingerprint and browser type rest on legitimate interest (Art. 6(1)(f) GDPR) in protecting the site against automated messages.

4. HOW LONG WE KEEP IT

Retention period

Contact messages: at most 24 months from the last correspondence, then deleted.
Technical security logs: at most 180 days.
The session cookie: deleted when the session ends, or after at most one hour of inactivity.
Your statistics preference: stays in your browser until you clear it.

5. COOKIES

What is stored in your browser

This site uses no advertising cookies and does not track visitors across websites.

A strictly necessary session cookie. It is created only when needed — when submitting the form or signing in to the private area — and serves to protect against CSRF attacks. It does not require consent.
Audience statistics. We currently use no traffic analytics service at all.

6. THIRD PARTIES

Who we share data with

We do not sell or share your data for commercial purposes. The data can be accessed only by the site’s hosting provider, acting as a processor, strictly in order to keep the service running.

The fonts and all graphic assets are hosted on our own server. Opening a page generates no request to any third-party server — not to Google Fonts, and not to social networks.

7. YOUR RIGHTS

What you can ask for

Under the GDPR, you have the right to:

Access

To find out what data we hold about you.

Rectification

To have inaccurate data corrected.

Erasure

To have your data deleted (the “right to be forgotten”).

Restriction

To have processing limited in certain situations.

Portability

To receive your data in a structured format.

Objection

To object to processing based on legitimate interest.

You can withdraw your consent at any time, without affecting the lawfulness of processing beforehand. For any request, write to us at contact@stemduo.com. We reply within 30 days at the latest.

If you are not satisfied with our reply, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro.

8. SECURITY

How we protect the data

Traffic is encrypted over HTTPS, with automatic redirection from HTTP.
Administrator account passwords are stored only as hashes, using an attack-resistant function (scrypt).
Access to messages is limited to the association’s administrators, through server-side authentication.
Forms are protected against CSRF attacks and automated submissions.
Data is written to the database exclusively through parameterised queries.

9. MINORS

Participants under 16

Our activities are aimed at pupils too. The contact form, however, is intended for adults (parents, teachers, partners). If a minor under 16 sends us personal data without the consent of a parent or guardian, we delete the information as soon as we become aware of it.

This document describes how the site actually works. For a document with full legal effect, we also recommend a review by a legal adviser.