Data protection (GDPR)

We process data with: (a) lawfulness, fairness and transparency; (b) purpose limitation; (c) data minimisation; (d) accuracy; (e) storage limitation; (f) integrity and confidentiality; (g) accountability. These principles also govern identity verification, accounts and comments.

There is no general duty to “register processing with ANSPDCP” as under the old Law 677/2001; ANSPDCP remains the supervisory authority for complaints and guidance.

• Account and Service delivery: Art. 6(1)(b) (pre-contractual measures / platform use agreement). • Security, moderation, fraud prevention, editorial integrity: Art. 6(1)(f) (legitimate interest), with a balancing test. • Legal duties (authority responses, typical legal archives): (c). • Newsletter / marketing / non-essential cookies / some uploads: (a) consent, withdrawable at any time.

Data categories: Privacy — data categories.

Selfie images and ID photos may be used for one-off account verification (reasonable document–person matching, authenticity signals of the scan), not as continuous public biometric recognition on the site. We do not build an open “face profile” base for marketing tracking.

If a process would amount to “biometric data processed for the purpose of uniquely identifying a natural person” under Article 9 GDPR, we only do so with a valid Art. 9(2) ground (e.g. explicit consent) or applicable law. In practice we request uploads with clear information and only for functions that depend on verification.

RoAdevăr lets people contribute (account comments, articles, collaborations). Offering such a role on a public information platform creates real risks: fake accounts, abusive anonymity, difficulty responding when the law requires identifying the author of an act. Verification (ID + selfie, stored privately) is a security and integrity measure proportionate to those risks and to the public interest in responsible information.

We do not publish documents on the site. We do not use them for advertising. A new upload normally replaces older files to avoid unnecessary accumulation.

Typical combined bases, depending on context: • Art. 6(1)(b) — measures needed to let you use account functions that require identification (e.g. publishing as author); • Art. 6(1)(f) — legitimate interest: prevent fake accounts, platform security, ability to cooperate lawfully with authorities, protect readers and the newsroom; • Art. 6(1)(a) — consent at upload, in addition to form information; • Art. 6(1)(c) — where a concrete legal obligation requires identification or limited retention of evidence.

National basis: Law no. 190/2018 implementing GDPR. Legitimate interest requires the Art. 6(1)(f) balancing test (it does not automatically override a child’s interests, etc.).

We keep verification files only as long as needed for the purpose: the assessment period (pending), then, if verified, a limited period tied to the account relationship and reasonable security/litigation risk — typically no more than 24 months from last relevant activity or account closure, with earlier erasure/restriction on request when no basis remains. If rejected, files may be removed more quickly after resolution, except for a dispute or legal requirement.

Figures are indicative; a legal investigation or claim may justify documented longer temporary retention. Soft-delete: below.

• Access (Art. 15) — confirmation of processing and a copy of your data. • Rectification (Art. 16) — inaccurate data. • Erasure (Art. 17) — “right to be forgotten”, with exceptions in Art. 17(3) (e.g. freedom of expression and information, legal obligations, establishment/exercise of legal claims). • Restriction (Art. 18). • Portability (Art. 20) — where processing is based on consent or contract and is automated. • Objection (Art. 21) — to legitimate interest / direct marketing. • Not to be subject solely to automated decisions with significant legal effects (Art. 22), where applicable. • Withdraw consent (Art. 7(3)) without affecting prior lawfulness.

Request: contact@roadevar.ro. Response: normally one month (Art. 12(3)), extendable as the law allows.

Article 17(3)(a) GDPR allows retention when processing is necessary for exercising the right to freedom of expression and information. Journalistic materials already published may remain in the public archive even if an author asks to close an account, where public interest and freedom of information justify it, with minimisation of surrounding account data. Soft-deleting an account does not automatically erase signed public articles without assessment.

• Active account: for the relationship; after long inactivity we may soft-delete. • Account data after closure/soft-delete: typically up to 24 months, then erasure or anonymisation, except disputes/legal duties. • Identity documents: see identity section; short, purpose-limited retention. • Security technical logs: typically 30–180 days by type and risk. • Public editorial content: while public interest / media archive lasts, subject to moderation and law. • Payment/donation records (if any): applicable accounting/tax periods.

“Soft-delete” means deactivation (no longer usable / no longer visible as an active user), with controlled retention until the period ends or hard deletion.

The National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, and judicial remedies provided by law. We encourage you to contact us first — many cases are resolved directly.

Maximum fines under Article 83 GDPR concern controllers at system level; we commit to compliance, not to “threatening” good-faith readers with fines.

Text is updated with practice and law. The date at the bottom marks the published version. For substantial changes we notify registered users where reasonably possible.