Privacy policy
Last updated: October 12, 2026
This notice explains which personal data the mikozod.ro website processes, why and on what legal basis, who receives it, how long it is kept and what rights you have. It describes only what the site actually does. The Romanian text is the main version of this notice; if the versions differ, the Romanian one applies.
1. Who is responsible for your data
The controller is Asociația Mikozod?! Egyesület, registered seat: Str. Cetății nr. 335, sc. 2, ap. 48, sat Florești, com. Florești, jud. Cluj, 407280, Romania; fiscal code (CIF) 50350274.
You can reach us at [email protected], through the contact form or by post at the registered seat. We have not designated a data protection officer (DPO); use these contact details for any question about your data.
2. What we process, why, and for how long
2.1 Visiting the website
- Data: IP address, date and time, the address of the requested page, the type of browser and device, and the page you came from if your browser sends it; the
__cf_bmsecurity cookie and, if you picked a language, theNEXT_LOCALEcookie (see the cookie policy). - Purpose: to deliver the pages, to protect the site against attacks and automated traffic, and to find errors.
- Legal basis: GDPR Art. 6(1)(f) – our legitimate interest in a secure, working website.
- Recipients: DigitalOcean, LLC, which hosts the site, and Cloudflare, Inc., which delivers the pages and filters traffic on DigitalOcean's behalf; both as processors (see section 3).
- How long: our application does not write the IP address into its logs. DigitalOcean keeps the data it processes for us at most for the duration of our contract, under its data processing agreement; its sub-processor Cloudflare has the same obligations. We do not copy the technical logs or combine them with other data.
- Required? Without this technical data the pages cannot be delivered.
2.2 Contact form
- Data: your name, email address, subject and message, and your IP address.
- Purpose: to answer you. We use the IP address only to limit how many messages one address can send (at most 5 an hour), against abuse.
- Legal basis: GDPR Art. 6(1)(f) – our legitimate interest in answering the messages we receive and in protecting the form against abuse; where your message concerns a donation or a request of yours before entering into an agreement with us, Art. 6(1)(b).
- Recipients: Resend (Plus Five Five, Inc.), which forwards the message to us by email, and Google, which hosts our mailbox (Google Workspace).
- How long: Resend keeps sent messages and delivery logs for 30 days. In our mailbox we keep the correspondence for at most 2 years after the last message exchanged, then delete it. The IP address is held only in the server's memory: it counts towards the limit for one hour and is erased at the latest when the server next restarts.
- Required? All fields are needed; without them the message cannot be sent and we cannot answer. You can also write to [email protected] directly.
2.3 Donations
- Data: on our form, the amount, whether the donation is monthly, and the page language. On Stripe's payment page (checkout.stripe.com) you enter your name, email address and card or other payment details. In our Stripe account we see the name, email, amount, date and status of the payment, and the card type and its last four digits; we never see the full card number.
- Purpose: to collect the donation (a monthly one every month), to send you a thank-you email, and for our accounting records.
- Legal basis: GDPR Art. 6(1)(b) for the donation; Art. 6(1)(f) for the thank-you email – our legitimate interest in confirming that your donation arrived and thanking you; Art. 6(1)(c) for the accounting records (Romanian accounting law, Legea contabilității nr. 82/1991).
- Recipients: Stripe (Stripe Payments Europe, Limited, Ireland, with Stripe, LLC, USA) handles the payment on our behalf and, for its own purposes such as fraud prevention and its legal obligations, acts as an independent controller under its privacy policy. Resend sends the thank-you email; if you reply, your reply reaches our mailbox at Google.
- How long: we keep the accounting documents for 5 years from 1 July of the year after the financial year of the donation (Legea nr. 82/1991, Art. 25); for a donation made in 2026, until 1 July 2032. We keep your data in our Stripe account for the same period, for a monthly donation counted from the last payment, and then delete it from the account. Stripe keeps payment data under its own legal obligations. Resend keeps the thank-you email for 30 days. If you reply to it, we keep the correspondence in our mailbox for at most 2 years after the last message exchanged, as in section 2.2.
- Required? For an online donation, Stripe's page needs your name, email and payment details; without them you cannot donate through the site. You can donate by bank transfer instead, to the account shown on the Impressum page.
2.4 Newsletter
- Data: your email address and the time you subscribed. If you gave us your name earlier, we keep it too until you unsubscribe.
- Purpose: to send you our newsletter about articles and events.
- Legal basis: your consent (GDPR Art. 6(1)(a)), given when you subscribe.
- Recipients: Google: we keep the subscriber list in Google Sheets and send the newsletter from our mailbox at Google (Google Workspace).
- How long: until you unsubscribe; after your request we delete your data from the list within 30 days.
- Withdrawing consent: at any time, by email to [email protected]. Withdrawal does not affect the lawfulness of earlier mailings.
- Required? Without an email address we cannot send you the newsletter.
2.5 Visitor statistics (Plausible), only with your consent
- Data: the address of the page (including any parameters in it), the page you came from, how far you scroll and how long the page is open in the foreground, the addresses of links to other sites you click, and your IP address and browser details.
- How: only after you press "Accept" in the statistics banner does your browser load the Plausible script from plausible.dextra.dev and send it this data. According to Plausible's documentation, the server uses the IP address and browser details only to compute a visitor code that changes every 24 hours and to determine the country, region and city as well as the browser and operating system, and does not store them as such. The script stores nothing on your device; it only reads the
plausible_ignoresetting in your browser's storage, which excludes a visit from the statistics. - Purpose: to count visits and see which content is read and which links are used, so that we can improve the site.
- Legal basis: your consent – GDPR Art. 6(1)(a) and Art. 4(5) of Romanian Law no. 506/2004.
- Recipients: Dextra Software S.R.L., a company registered in Romania, which hosts Plausible Community Edition for us as a processor. The server runs in DigitalOcean's FRA1 region in Frankfurt am Main, Germany (EU); DigitalOcean, LLC is Dextra's sub-processor for this hosting. On the server, a Caddy reverse proxy passes the requests on to Plausible; on the way to the server, traffic passes through Cloudflare, Inc. (see section 3).
- How long: after 24 hours the visitor code no longer identifies you; the statistics that remain do not contain your IP address and are kept for as long as the association uses the service. For how long Cloudflare keeps traffic data, see Cloudflare's privacy policy.
- Withdrawing consent: at any time, with "Cookie settings" at the bottom of every page; the page then reloads without the Plausible script. Withdrawal does not affect the lawfulness of earlier processing.
- Required? No. If you reject, the site works the same.
2.6 Video previews on the "Episodes" page
- Data: on this page your browser downloads the preview images of our videos from Google's servers (i.ytimg.com); Google thereby receives your IP address, browser details and our site's domain. The home page shows the same images from our own server, so there your browser does not contact Google.
- Purpose: to show our latest YouTube videos with their pictures.
- Legal basis: GDPR Art. 6(1)(f) – our legitimate interest in presenting our videos.
- Recipient: Google Ireland Limited, as an independent controller, under Google's privacy policy.
- How long: under Google's policy; we do not receive or keep this data.
- The videos are not embedded: clicking one opens YouTube. If you do not want your browser to contact Google, do not open this page, or block third-party content in your browser.
2.7 Record of your statistics choice
- Data: a randomly generated consent ID, the version of the text shown, your choice, the page language and the time of the choice. We record neither your IP address nor your browser details. We use the IP address only to limit how many choices one address can send (at most 20 an hour), against abuse.
- Purpose: to remember your choice and to be able to show what you chose.
- Legal basis: GDPR Art. 6(1)(c) in conjunction with Art. 7(1) (we must be able to show consent); for a refusal, Art. 6(1)(f) – our legitimate interest in being able to show that we respected it; for the limit by IP address, also Art. 6(1)(f) – our legitimate interest in protecting the record against abuse.
- Recipients: Google (Google Sheets).
- How long: in your browser 6 months; in our records 3 years from the choice (the general limitation period under Art. 2517 of the Romanian Civil Code), then we delete it. The IP address is held only in the server's memory: it counts towards the limit for one hour and is erased at the latest when the server next restarts.
2.8 Links to other sites
Links to YouTube, Spotify, Apple Podcasts, Facebook, Instagram and formular230.ro open sites of other controllers, whose own policies apply there. Until you click, these sites receive nothing from our pages.
3. Recipients and transfers outside the European Economic Area
Your data reaches the providers below, to the extent described in section 2, and authorities only where the law obliges us.
- DigitalOcean, LLC (USA) – hosting of the site, as a processor, and of Dextra's statistics server, in its FRA1 region in Frankfurt am Main, Germany (EU), as Dextra's sub-processor. Transfer: DigitalOcean's certification under the EU-US Data Privacy Framework (DPF), with the standard contractual clauses in its data processing agreement as a fallback. DigitalOcean's privacy policy.
- Cloudflare, Inc. (USA) – delivery and security of the pages on DigitalOcean's behalf, and for Dextra's statistics server; sub-processor. Transfer: DPF, with standard contractual clauses as a fallback. Cloudflare's privacy policy.
- Plus Five Five, Inc. (Resend) (USA) – sending emails; processor. Transfer: the standard contractual clauses in Resend's data processing agreement; Resend is also DPF-certified. Resend stores the data in the USA, whichever region an email is sent from. Resend's privacy policy.
- Google (Google Cloud EMEA Limited, Ireland, and Google LLC, USA) – Google Workspace, for the [email protected] mailbox and for sending the newsletter, and Google Sheets; processor. Transfer: DPF (Google LLC) and the standard contractual clauses in the Cloud Data Processing Addendum.
- Stripe (Stripe Payments Europe, Limited, Ireland, and Stripe, LLC, USA) – payments; processor, and independent controller for its own purposes. Transfer: DPF (Stripe, LLC) and the standard contractual clauses in Stripe's Data Transfer Addendum; Stripe's privacy policy lists further destination countries.
- Dextra Software S.R.L., a company registered in Romania – hosting of the Plausible statistics, only if you accept them, on a DigitalOcean server in Frankfurt am Main, Germany (EU); processor, with DigitalOcean, LLC as its sub-processor.
- Google Ireland Limited (Ireland) – the YouTube preview images; independent controller, under Google's privacy policy.
The list of DPF-certified organisations: dataprivacyframework.gov. The standard contractual clauses are part of the agreements above; you can also ask us for a copy at [email protected].
4. Your rights
You have the right to:
- find out whether we process your data and get a copy of it (GDPR Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17), for example when it is no longer needed or you withdraw your consent; data the law obliges us to keep, such as accounting records, we delete at the end of the legal period;
- have the processing restricted (Art. 18);
- receive the data you gave us in a structured, commonly used and machine-readable format and pass it to another controller (Art. 20), for processing based on consent or a contract: the newsletter and donations;
- object to processing based on our legitimate interest (Art. 21) – see the box below;
- withdraw your consent at any time (Art. 7(3)): for statistics with "Cookie settings", for the newsletter by email; withdrawal does not affect earlier processing.
To use any of these rights, write to [email protected] or by post to the registered seat. We answer free of charge within one month of receiving your request; for a complex request we extend this by at most two months and tell you so within the first month. If we cannot tell that a request comes from you, we ask for additional information.
5. Your right to object
You can object at any time (GDPR Art. 21), on grounds relating to your particular situation, to processing based on our legitimate interest (GDPR Art. 6(1)(f)): the technical logs and security of the site, answering contact-form messages, the thank-you email after a donation, the record of a refused statistics choice, and the video previews. Write to [email protected]. We then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need it to establish, exercise or defend legal claims.
6. Complaints to the supervisory authority
If you consider that the processing of your data breaks the law, you have the right to lodge a complaint with the supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP):
- Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania
- Email: [email protected]
- Phone: +40.318.059.211 or +40.318.059.212
- Website: www.dataprotection.ro, with a page on complaints
You can also complain to the supervisory authority of the EU member state where you live or work, or where the alleged infringement took place (GDPR Art. 77).
7. Automated decisions
We make no decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Stripe checks payments for fraud prevention as an independent controller, under its own policy.
8. Changes
We update this notice when our processing changes; the date of the latest update is shown at its top.