GDPR

1. What is GDPR?

The General Data Protection Regulation (GDPR) - EU Regulation 2016/679 - is a European law that establishes rules for the collection, storage, and processing of EU citizens' personal data. GDPR came into force on May 25, 2018, and applies to all organizations that process EU citizens' data, including non-profit organizations in Romania.

Taxi Gratis Association fully complies with GDPR provisions and is committed to protecting the personal data of all beneficiaries of our services.

2. Our Role in GDPR

2.1 Data Controller

Taxi Gratis Association acts as the data controller for personal data collected within our medical transport services. This means that:

• We decide what data we collect and how we use it
• We are responsible for complying with GDPR principles
• We implement technical and organizational protection measures
• We respond to the exercise of data subjects' rights

3. GDPR Principles We Follow

4. Your GDPR Rights

As a data subject, GDPR grants you the following rights that you can exercise at any time:

5. How to Exercise Your GDPR Rights

Information Required for Request:

• Full name and surname
• Email address used for our services
• Phone number
• Type of right you wish to exercise
• Justification for the request (if applicable)
• Copy of identity document (for identity verification)

Processing Procedure:

1. Receiving the request: We confirm receipt within maximum 3 working days
2. Identity verification: For data protection, we verify the requester's identity
3. Request evaluation: We analyze whether the request is justified and legal
4. Implementation: We execute the requested action
5. Response: We inform you about the result within maximum 30 days

6. GDPR Security Measures

6.1 Technical Measures

• Data encryption: Sensitive data is encrypted in storage and transmission
• Secure backup: Backups are protected with passwords and encryption
• Controlled access: Password authentication systems and role-based access
• Software updates: We keep systems updated with security patches
• Monitoring: We track data access and detect suspicious activities

6.2 Organizational Measures

• Staff training: Volunteers are trained on data protection
• Privacy policies: We have clear procedures for data handling
• Need-to-know principle: Data access based on role and necessity
• Incident procedures: Action plan for security breaches
• Internal audit: Periodic checks of GDPR compliance

7. Security Breaches (Data Breaches)

7.1 Our Obligations

In case of a personal data security breach, we commit to:

• Notify ANSPDCP within maximum 72 hours of becoming aware of the incident
• Inform you directly if the breach presents a high risk to your rights and freedoms
• Document the incident and measures taken
• Implement corrective measures to prevent similar incidents

7.2 Information Communicated

In case of an incident, we will inform you about:

• Nature of the breach and types of data affected
• Measures taken to limit the effects
• Recommended measures for your protection
• Contact person for additional information

8. International Data Transfers

Taxi Gratis Association does not transfer personal data outside the European Economic Area (EEA). All data is stored and processed exclusively in Romania, on servers that comply with European data protection legislation.

In the extremely rare case where data transmission would be necessary (for example, for emergency technical assistance), we will only use providers that offer adequate protection guarantees through:

• European Commission adequacy decisions
• EU-approved standard contractual clauses
• Your explicit consent

9. Right to Complaint

10. Contact for GDPR Questions