Privacy Policy

Last updated: June 28, 2026

1. Who we are

This policy explains how Asociația Congruent processes the personal data of people who use the congruent.ong/en website, contact us, register for activities, make donations, purchase products, or interact with us through forms, e-mail, telephone, or social media pages.

For the purposes of Regulation (EU) 2016/679 on the protection of personal data (GDPR), Asociația Congruent generally acts as the data controller for the processing activities described in this policy.

2. What data we may collect

Depending on how you interact with us, we may collect the following categories of data:

• identification data: first name, last name, organization, if applicable;
• contact data: e-mail address, telephone number, delivery address, correspondence address;
• order data: products ordered, value, order status, billing and delivery data, history of communications related to the order;
• donation data: amount, date, payment status, transaction identifier, one-time or recurring donation option, if applicable;
• payment data: information required to confirm the payment, transmitted by the payment processor. We do not store full bank card details;
• data submitted through forms or messages: the content of the request, preferences, questions, details voluntarily provided in order to receive an appropriate response;
• data related to participation in programs or activities: registration options, availability, confirmations, attendance, administrative information required for carrying out the activity;
• technical and usage data: IP address, browser type, device, operating system, pages accessed, date and time, technical errors, data collected through cookies or similar technologies;
• communication and marketing data: newsletter subscription, communication preferences, consents, unsubscribes, and interactions with the messages sent.

Please do not send us sensitive data that is not necessary for your request. If you choose to voluntarily send us information about health, alcohol use or other addictions, family situations, or other sensitive personal matters, we will handle this data with increased care and will use it only to the extent necessary to manage the request, registration, or support requested, according to the applicable legal grounds.

3. How we collect data

We may collect data directly from you when you fill in a form, send an e-mail, contact us by telephone, make a donation, place an order, create an account, subscribe to the newsletter, or participate in an activity.

We may automatically collect certain technical data when you visit the website, through cookies, log files, and similar technologies. We may also receive data from providers involved in the operation of the website, such as payment processors, delivery services, e-mail platforms, hosting services, or security tools.

4. Purposes and legal grounds for processing

We process personal data only when we have a clear purpose and a legal basis. The main purposes are:

5. Special or sensitive data

Congruent’s activity may include support, recovery, and personal development programs. In certain situations, users may voluntarily send us information that may be sensitive, such as information about health, alcohol use, addictions, family context, or difficult personal situations.

We do not request such data through the website unless it is necessary for managing a specific request or organizing an activity. When this information is necessary, we process it with additional confidentiality measures and, where applicable, on the basis of explicit consent or another legal basis permitted by the GDPR.

Do not publish sensitive data about yourself or other people on the website, in comments, or in public spaces.

6. Cookies and similar technologies

The website may use strictly necessary cookies for operation, security, displaying preferences, and session management. With your consent, cookies may also be used for analytics, statistics, embedded content, or marketing, if such tools are active on the website.

You can control cookies through your browser settings and, if the website displays a consent module, through the options provided there. Blocking certain cookies may affect the functioning of some sections of the website.

7. Payment processors and online payments

Online payments are processed through specialized providers, including banking services or payment processors integrated into the online store. Full card details are entered in the payment processor’s interface and are not stored by Asociația Congruent.

We may receive information from the processor such as payment status, amount, currency, transaction date, and technical identifiers required to confirm the donation or order, for accounting purposes, and for any refunds.

8. To whom we may disclose data

We may disclose personal data only when necessary and under conditions of confidentiality to:

• hosting, website maintenance, security, and IT support providers;
• payment processors, banks, and services involved in confirming transactions;
• courier or delivery services, for physical products;
• e-mail, newsletter, forms, CRM, or other communication tool providers;
• accounting, audit, legal advisers, or other professional collaborators, when necessary;
• public authorities, courts, or competent institutions, if there is a legal obligation;
• partners involved in carrying out certain programs or activities, only to the extent necessary and with respect for confidentiality.

We do not sell your personal data.

9. Transfers outside the European Economic Area

Some technical providers may process data outside Romania or the European Economic Area. When such a transfer takes place, we aim to use providers that offer appropriate safeguards, such as standard contractual clauses, adequacy decisions, or other mechanisms permitted by the GDPR.

10. How long we keep data

We keep personal data only for as long as necessary for the purposes for which it was collected or for as long as we have legal retention obligations. As a general guide:

• data related to orders, payments, invoices, and financial-accounting documents is kept according to the applicable legal retention periods;
• data related to donations is kept for as long as necessary for records, accounting, reporting, and managing any processing errors;
• data from contact requests is kept for the period necessary to resolve the request and, afterwards, for a reasonable period for record-keeping and defense of rights;
• newsletter data is kept until unsubscribe or withdrawal of consent, while retaining minimum evidence regarding consent or unsubscribe;
• technical and security data is kept for limited periods, depending on technical and security needs;
• sensitive data voluntarily submitted is kept only for as long as necessary to manage the request or activity, unless the law requires or permits a longer period.

11. Data security

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss, modification, disclosure, or destruction. These measures may include access limitation, passwords, technical updates, security services, backup, and internal confidentiality rules.

No method of electronic transmission or storage is completely risk-free. If you notice a security issue or suspect that your data has been compromised in connection with our website, please contact us at [info@congruent.ong](mailto:info@congruent.ong).

12. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• the right of access to your data;
• the right to rectify inaccurate or incomplete data;
• the right to erasure of data, when the legal conditions are met;
• the right to restriction of processing;
• the right to data portability;
• the right to object to certain processing activities;
• the right to withdraw consent, when processing is based on consent;
• the right not to be subject to a solely automated decision that produces legal effects or similarly significant effects concerning you, if such processing were to exist.

To exercise your rights, you can write to us at info@congruent.ong. We may ask you for additional information to confirm your identity, so that we do not disclose data to unauthorized persons.

13. Withdrawal of consent and unsubscribe

If the processing is based on consent, you may withdraw it at any time, without the withdrawal affecting the lawfulness of the processing carried out before the withdrawal.

For newsletters or similar communications, you may unsubscribe using the unsubscribe link in the message, if available, or by writing to us at [info@congruent.ong](mailto:info@congruent.ong).

14. Minors

The website and online store are not intended for orders or donations placed by minors without the consent of their legal representative. If you are a parent or guardian and believe that a minor has sent us personal data without your consent, please contact us so we can assess the situation and take the necessary measures.

In the context of support or information activities, there may be situations in which young people seek help. These requests are handled with care, within the limits of the law, the person’s safety, and the applicable professional responsibilities.

15. Automated decisions

We do not use your data for solely automated decisions that produce legal effects or similarly significant effects concerning you. Some technical systems may perform automated security, anti-spam, or anti-fraud filtering, necessary to protect the website and transactions.

16. Social media pages

If you interact with our social media pages, the respective platforms may process your data according to their own policies. We may see the information you make public or send us directly through those platforms, such as comments, reactions, or messages.

Please do not publish sensitive personal data about yourself or other people in comments.

17. Links to other websites

The website may contain links to other websites or services. We do not control the privacy policies of these third parties and are not responsible for how they process data. We recommend that you read their policies before using them.

18. Complaints

If you have a question or complaint regarding how we process your data, please contact us first at info@congruent.ong, so we can try to resolve the situation directly.

You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing, through the contact details available on dataprotection.ro, if you believe that your data protection rights have been violated.

19. Changes to this policy

We may update this policy when legislative, technical, or organizational changes occur, or when the way we use the website and associated services changes. The updated version will be published on this page and will include the date of the last update.

20. Contact for data protection

For questions regarding this policy or to exercise your rights, you can contact us at:

• E-mail: info@congruent.ong
• Telephone: 0772 219 719
• Operating / correspondence address: 22 Simion Bărnuțiu St., apt. 11B, Oradea
• Registered office / legal incorporation address: Oradea, 43 Milcovului St., bl. PB92, 3rd floor, apt. 15