Privacy Policy

Your data privacy is important to us. This policy explains what personal data we collect through the arai.org.ro website, for what purpose, to whom we disclose it, how long we keep it, and what your rights are, in accordance with Regulation (EU) 2016/679 (GDPR).

The data controller is Nord Next — [to be completed: legal name, tax ID, registered office, contact details] — which manages the platform and communication programs of the Romanian Association for Interventional Algesiology (ARAI).

For any questions regarding data processing, you can write to us at office@arai.org.ro.

We only collect the data necessary to provide you with the site's services. Depending on how you interact with us, this may include:

• Contact form: name, email address, and message content — used to respond to your inquiry (sent to office@arai.org.ro).
• Newsletter: first name, last name, and email address — to send you news about ARAI. You can unsubscribe at any time.
• Member account: name, email, password (stored encrypted), and professional details (specialty, institution, rank) — for creating and managing your account and membership.
• Membership and registration fees: payments are processed securely via Stripe; we do not store or have access to full card details.
• Member account data: records of conferences and issued diplomas/certificates.
• Cookies and local storage: we use only strictly necessary cookies for the operation and security of the website, plus local browser storage for authentication and language preference. We do not use analytics, advertising or tracking cookies, and these do not require consent.

We process your data based on the following legal grounds (Art. 6 GDPR):

• Your consent — for newsletter subscription.
• Performance of a contract — for member accounts and payment processing.
• Legitimate interest — for the security and improvement of our services.
• Legal obligation — for keeping financial and accounting records.

We do not sell your data. We only disclose it to service providers who help us operate the site, each acting as a data processor:

• Webflow — website hosting.
• Memberstack — authentication and member accounts.
• Stripe — payment processing.
• Make — form automation.
• Brevo — newsletter and transactional emails.

Some of our providers (e.g., Stripe, Memberstack, or Webflow) may process data on servers located outside the European Economic Area, including in the United States. In such cases, the transfer is carried out with appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, to ensure a level of protection equivalent to that in the EU.

• Member account data — for the duration of your account and membership.
• Newsletter data — until you unsubscribe or withdraw your consent.
• Contact messages — for a reasonable period necessary to resolve your request.
• Financial documents — for the duration required by applicable law.

We implement technical and organizational measures to protect data against unauthorized access, loss, or disclosure: encrypted connection (HTTPS) across the entire website, passwords stored in encrypted form, and restricted data access for authorized personnel only.

As a data subject, you have the following rights:

• The right to be informed (Art. 12–14).
• The right of access to data (Art. 15).
• The right to rectification (Art. 16).
• The right to erasure — the "right to be forgotten" (Art. 17).
• The right to restriction of processing (Art. 18).
• The right to data portability (Art. 20).
• The right to object (Art. 21).
• The right not to be subject to automated decision-making or profiling (Art. 22).

You can withdraw your consent at any time and have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP). To exercise any of your rights, please email us at office@arai.org.ro.