Privacy Policy

1) Who we are

This website (mures-phacademy.org) is operated by Centrul de tratament al  hipertensiunii pulmonare din Târgu Mureș. For the purposes of the EU/UK data protection laws, we act as the Data Controller of your personal data collected via this site.

Contact for privacy matters and to exercise your rights: office@mures-phacademy.org, phone +40 0748 164 585. If you have appointed a DPO, add: DPO: [Name], [Email].

2) What data we collect and why

• Data you provide (e.g., name, email, phone, organisation, role) through contact forms, event registrations, newsletter sign‑up, surveys, or account creation — used to respond to requests, manage registrations, send service communications, and deliver our educational activities.
• Technical/usage data (IP address, device and browser info, pages visited, referral source, date and time, approximate location) collected via our servers and cookies for security, fraud prevention, and to operate and improve the site.
• Cookies & similar tech for essential functionality and, where enabled, analytics/performance. See Cookies.
• Communication preferences (e.g., newsletter subscription status) to honour your choices and legal requirements.
• User content you submit (e.g., comments, uploaded files) where available and subject to moderation.

3) Legal bases (GDPR Art. 6)

• Contract — to provide requested services (e.g., event registration and participation).
• Consent — for optional activities (e.g., newsletters, non‑essential cookies). You may withdraw consent at any time.
• Legitimate interests — to operate, secure and improve our website; to prevent abuse and fraud; to communicate about our activities (where permitted).
• Legal obligation — where we must retain or disclose data to comply with applicable laws.

4) How we use your data

• Provide and maintain the website and services.
• Respond to enquiries and provide customer support.
• Process event registrations and participation logistics (badges, certificates, attendance lists where appropriate).
• Send service messages (e.g., confirmations, operational notices). Marketing emails only with your consent or where lawful.
• Ensure security; prevent, investigate and deter fraudulent, unauthorised or illegal activity.
• Analyse usage to improve content, accessibility and performance (aggregated/anonymised where possible).
• Comply with legal requirements and enforce our Terms.

5) Data retention

We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. Typical periods:

• Contact enquiries: up to 24 months after last interaction.
• Newsletter subscribers: until you unsubscribe or we close the list.
• Event records: up to 3 years after the event (or longer where legally required).
• Contractual/financial: according to statutory requirements (e.g., 5–10 years).
• Security logs: up to 12 months, unless needed longer for incident investigation.

6) Sharing your data

• Service providers (processors): hosting, email delivery, analytics, payment and event tools (if used) under written agreements and data protection obligations.
• Event partners where necessary for logistics (e.g., venue security lists) or with your consent.
• Public authorities if required by law or to protect our rights or users.

We do not sell your personal data.

7) International transfers

If we transfer personal data outside the EEA/UK, we ensure appropriate safeguards (e.g., EU Standard Contractual Clauses, UK IDTA/Addendum) and additional measures where necessary.

8) Security

We implement technical and organisational measures appropriate to the risk (access controls, encryption in transit, least‑privilege access, backups). However, no system is perfectly secure, and we cannot guarantee absolute security.

9) Your rights

You may have the following rights under applicable law: access, rectification, erasure, restriction, portability, and objection to processing, plus the right to withdraw consent at any time (without affecting prior lawful processing).

To exercise your rights, contact us at office@mures-phacademy.org. You may also complain to the Romanian supervisory authority ANSPDCP — www.dataprotection.ro — or your local authority.

10) Children

Our website is not directed to children under 16. If you believe a child provided personal data without parental consent, please contact us so we can take appropriate action.

We use essential cookies to make the site work. Where we use analytics or functional cookies, we ask for your consent via the cookie banner. You can change your choices any time via Cookie Settings.

• Essential (strictly necessary)
• Analytics (e.g., [Matomo/Google Analytics])
• Functionality (remember preferences)

12) Contact

For any privacy questions, email office@mures-phacademy.org or write to 38 Gheorghe Marinescu St., Târgu Mureș, Romania.

13) Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version here and update the “Last updated” date above.