Document
Personal data and cookies
Updated on
This is a translation. In case of any difference, the Romanian version prevails.
1 Principles
The nedrept.ro site has no user accounts, forms, cookies, advertising, or tools that track visitors or count visits, and it loads no measurement scripts.
Fonts, styles and scripts come from the site itself: when you open a page, your browser requests nothing from other sites. The site's security rule (Content Security Policy) blocks any loading from other addresses, including Cloudflare's measurement scripts.
The site contains data about the people in the cases, each item with a public source or a document. The rules are in the section "Data about the people in the cases".
2 Who is responsible for the data
The controller, meaning the one who decides which data are processed and why, is Gabriel Popa, a natural person, through the civic initiative "Nedrept".
Contact: [email protected]
3 What data about visitors is received
The site is hosted on Cloudflare Pages. When you open a page, Cloudflare's servers receive, as with any site, some technical data: your IP address, your type of browser and device (user agent), the page requested and the time of the request.
Cloudflare uses this data to deliver the page and to protect the site from attacks. Nedrept does not use it to identify visitors and does not combine it with other data. Cloudflare, as hosting provider, records aggregated data about network traffic and technical logs, under its own policy.
The site does not ask for your name or e-mail. If you write to [email protected], your message and your e-mail address are used only to reply to you.
5 Data about the people in the cases
The cases name two categories of people:
- the people who acted on behalf of the state: judges, prosecutors, members of councils, civil servants;
- the people the state acted against.
About the first, the site writes only the position held, the act signed or voted and the document that proves it. About the others, only what concerns the case.
The data come from public sources: judgments and decisions, statements issued by institutions, press articles, public statements by the people themselves. Each fact has at least one source, shown next to it.
Nedrept also keeps private copies of some documents, which are never published. The site shows only their download date and their SHA-256 fingerprint, a code that makes it possible to check that the document has not been changed.
If you are named in a case, you can ask for a fact to be corrected, ask for your reply to be published and object to the processing. The steps are in the Terms of use, section "Corrections and right of reply", and in the section "Your rights" below.
6 Legal basis
The legal basis is the rule that allows the data to be processed. There are two situations.
Data about the people in the cases
The General Data Protection Regulation (Regulation (EU) 2016/679, known as the GDPR), in Article 85, requires each Member State to reconcile by law the protection of personal data with the right to freedom of expression and information, including processing for journalistic purposes. Romania did this through Article 7 of „Legea nr. 190/2018” (Law no. 190/2018 on measures implementing the GDPR), which allows processing for journalistic purposes of data that:
- have been manifestly made public by the person themselves; or
- are closely related to the person's status as a public figure; or
- are closely related to the public nature of the facts in which the person is involved.
For these data, the law allows derogations from several chapters of the GDPR, including the chapter on the rights of the data subject (the person the data are about). The purpose of the site is to inform the public about the way state institutions exercise their power.
For processing that does not fall under Article 7, the legal basis is the legitimate interests pursued by the controller, under point (f) of Article 6(1) GDPR: the public documentation of the way state institutions act.
Data about visitors
The technical data in Cloudflare's records are processed on the basis of legitimate interests, under point (f) of Article 6(1) GDPR: delivering the pages and keeping the site secure.
7 Providers
A provider that processes data on behalf of the controller is called a "processor". The site uses only one:
- Cloudflare, Inc.
- hosting of the site (Cloudflare Pages), the page delivery network (CDN) and the server logs. Privacy policy: https://www.cloudflare.com/privacypolicy/
8 Transfer outside the EU
Cloudflare, Inc. is a company based in the United States, with servers in many countries. Visitors' technical data may also be processed outside the European Union.
Cloudflare states that it is certified under the EU-U.S. Data Privacy Framework, the framework for data transfers between the EU and the United States recognised by the European Commission, and that, if the certification ends, it relies on the standard contractual clauses adopted by the European Commission. Cloudflare's data processing agreement applies through the standard terms of the service used by the site.
9 How long data are kept
- Cloudflare server logs: as long as Cloudflare's policy provides.
- Data about the people in the cases: as long as the fact remains published in the public interest.
- Private copies of documents: as long as the case file is kept.
- Messages sent to [email protected]: as long as needed to deal with the request, then at most 3 years, as proof of the reply.
10 Your rights
As a rule, the GDPR gives you the following rights:
- access: to find out what data about you are processed;
- rectification: to ask for incorrect data to be corrected;
- erasure: to ask for data to be erased, in the cases provided by law;
- objection: to object to processing, on grounds relating to your particular situation;
- complaint: to lodge a complaint with „Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal” (ANSPDCP, the Romanian National Supervisory Authority for Personal Data Processing), https://www.dataprotection.ro/
If you are a visitor
From your visits to the site, Nedrept keeps no data about you and has no access to Cloudflare's individual records. A request about these records is sent to Cloudflare, through the address in their privacy policy. If you wrote to [email protected], you can ask for access to your message or for it to be erased.
If you are named in a case
Article 7 of „Legea nr. 190/2018” (Law no. 190/2018) allows derogations from these rights. Nedrept nevertheless offers you three options:
- correction of a fact, if you show a source that contradicts it;
- reply, published next to the fact it refers to;
- objection: you ask that certain data about you no longer be processed. Nedrept weighs the request against the public interest of the documented fact and communicates its decision to you, with the reasons for it.
A fact with a source is not deleted merely because the person named asks for it.
What you need to do: write to [email protected]. State who you are, which right you are exercising and, for a fact, the address of its page and the source you rely on. Nedrept responds no later than one month after receiving the request. For a complex request, this period can be extended by two further months at most, under Article 12(3) GDPR; the extension and its reason are communicated within the first month. If you receive no response, or you are not satisfied with it, you can lodge a complaint with ANSPDCP.
11 Changes
This page changes when the way the site processes data changes. The date of the last change appears at the top, and each change appears below, with its date.
- : first version.
12 Contact
Controller: Gabriel Popa, the civic initiative "Nedrept".
E-mail: [email protected]