Personal data protection and privacy policy

Regulatory framework applicable to catanan.ro · Last updated: 30 September 2026

Preliminary remarks

This privacy policy sets out how personal data is processed in the digital interactions taking place through catanan.ro. It strictly complies with Regulation (EU) 2016/679 (GDPR) and is based on the principles of transparency, data minimisation and storage limitation, strictly according to the stated purpose.

1. Identity and contact details of the data controller

The data controller is Cătălin Viorel Nan, a natural person residing in Râșnov, Brașov County, Romania. Any request to exercise your data protection rights can be sent to the following email address: contact@catanan.ro.

Separation from the organisations I represent: This website (catanan.ro) is exclusively a space for personal communication and individual professional representation. As President of the National Federation of Romanian Parents – Edupart and through its affiliation with the European Parents’ Association, I would point out that the data of people interacting with these organisations is processed under their own, separate data governance policies, publicly available at federatiaparintilor.ro and europarents.eu. Organisational requests should be sent strictly through the official communication channels of those organisations.

2. Types of data processed, purpose and legal basis

Data is processed strictly to facilitate communication and ensure the website works properly:

  • Direct correspondence (contact form): When you get in touch, we collect identification data (name), contact details (email address, phone number – only if provided voluntarily) and the content of your message. The legal basis is the legitimate interest in managing public relations and dialogue effectively (Art. 6(1)(f) GDPR) or, where applicable, pre-contractual steps taken at the request of the data subject (Art. 6(1)(b) GDPR). The data is not used for marketing campaigns and is not passed on to third parties, except for the service providers mentioned in section 4.
  • Infrastructure and cyber security: The host server automatically collects technical connection metadata (IP address, user agent/browser type, access logs). This processing is based on the legitimate interest in ensuring network security, technical auditing and the integrity of the website (Art. 6(1)(f) GDPR).
  • Quantitative traffic analysis: Interactions with the website are assessed exclusively through internal statistics tools (WP Statistics), which work independently of cookies and without sending data to third parties. IP addresses are anonymised before storage, and the resulting data is processed only in aggregate form to analyse content performance.

3. Cookie policy

In line with good digital governance practice, the website uses only technically necessary cookies (e.g. remembering your consent choices). No tracking cookies, behavioural advertising technologies or third-party traffic analytics services are used. Fonts are served locally from our own server. You can review your technical preferences at any time using the “Cookie settings” button on the Cookie policy.

4. Data recipients and international transfers

Data flows involve only service providers strictly necessary for the website’s technical architecture (the web hosting provider and the email ecosystem operated by Google, through Gmail). If these providers transfer data outside the European Economic Area (EEA), such transfers take place on the basis of the appropriate safeguards provided by the GDPR (adequacy decisions issued by the European Commission or standard contractual clauses).

5. Data retention

The storage limitation principle is strictly applied:

  • Correspondence data is kept for the duration of the dialogue and for a maximum of 2 years from the last interaction, except where retention is required to establish, exercise or defend a legal claim.
  • Server metadata (access logs) is stored temporarily, according to the hosting provider’s policies, for a limited period (usually a few weeks).

6. Your rights as a data subject

Data subjects have a full range of rights guaranteed by European law:

  • the right of access, rectification or erasure of data (including the “right to be forgotten”);
  • the right to restriction of processing and the right to data portability;
  • the right to object, applicable directly to processing based on legitimate interest.

Requests to exercise these rights can be sent to contact@catanan.ro, and a reasoned reply will be provided within one calendar month. You also have the right to lodge a formal complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), via www.dataprotection.ro.

7. Additional provisions

  • Automated decision-making: No user profiling takes place and no decisions with legal or similarly significant effects are taken solely by automated means.
  • Protection of minors: The structure and content of the website are not intended for children under 16, and there is no intention to collect data from this group.
  • External links: The website may include references to academic sources, press articles or social networks, which operate under their own independent privacy policies.