No tracking
No analytics, no advertising, no cookies. Visiting the site sends nothing to Google or social networks.
Legal · GDPR
Privacy Policy.
We ask young people to trust us with their ideas. This page explains, in plain language, what we collect, why, and how you stay in control — as required by the EU General Data Protection Regulation (GDPR).
Last updated: 14 September 2026
Only what you send
We only receive what you choose to write in our forms or emails — and most fields are optional.
Your call
Ask to see, correct or delete your data at any time with one email. We never sell it.
01Who is responsible
GoActive Bucharest is an informal group of young people based in Bucharest, Romania. Because an informal group has no separate legal personality, the data controller responsible for your personal data is its group leader:
Daniel Butnar, Group Leader, GoActive BucharestBucharest, Romania
Email: daniel.butnar@gmail.com
We have not appointed a Data Protection Officer because the law does not require one for a group of our size. Every privacy question goes directly to the email address above.
02What we collect and why
We collect personal data only when you send it to us, and only for the purposes below.
| Situation | Data | Purpose | Legal basis | How long we keep it |
|---|---|---|---|---|
| “Tell us your ideas” form | Age group, your ideas and preferences; optionally first name, city, email and the barriers you tick | Planning future youth exchanges; contacting you if you left your email | Your consent — Art. 6(1)(a) GDPR | 24 months after you submit, or sooner if you withdraw consent |
| Accessibility or health needs (only if you choose to share them) | Options such as “accessibility needs” and anything you write about them | Planning support so our projects are accessible | Your explicit consent — Art. 9(2)(a) GDPR | Deleted as soon as it is no longer needed for planning, and within 24 months at most |
| Partnership proposal form | Organisation details, contact person’s name, role and email; optionally phone, website and Erasmus+ OID; your proposal | Evaluating and answering proposals; preparing joint projects | Steps before entering an agreement — Art. 6(1)(b); our legitimate interest in building partnerships — Art. 6(1)(f) | 3 years after our last contact, or longer if the funding rules of a joint project require it |
| Emails you send us | Email address, name and the content of your message | Answering you | Legitimate interest — Art. 6(1)(f) | Up to 3 years after the conversation ends |
| Visiting the website | IP address, date and time, requested page, browser type | Delivering the website securely and preventing abuse (handled by our hosting provider) | Legitimate interest — Art. 6(1)(f) | Short-term server logs, kept by the host under its own policy |
Fields marked optional really are optional. We never ask for identity card numbers, and please don’t send sensitive information we haven’t asked for. We may keep anonymous, aggregated statistics (for example, “40% of ideas were about mental health”) that can’t identify anyone.
You can withdraw your consent at any time by emailing us. Withdrawal doesn’t affect anything we did lawfully before you withdrew.
03Young people under 16
Our projects are designed for young people aged 13–30. In Romania, a young person under 16 can only consent to the processing of their data online with the agreement of a parent or legal guardian.
If you are under 16, please ask a parent or guardian to agree before you send the ideas form. If we find out we have received data from someone under 16 without that agreement, we will delete it.
04Who receives your data
We never sell your data and never use it for advertising. It is only shared with:
- Our core team — Daniel Butnar, Vlad Rusu and Bianca Constantin, and only when they need it for their role.
- FormSubmit (formsubmit.co) — the service that delivers form submissions from the website to our inbox.
- Google (Gmail) — our email provider, where form submissions and emails are stored.
- GitHub, Inc. — hosts the website on GitHub Pages and processes the technical data of visits.
- Erasmus+ partner organisations and the Romanian National Agency (ANPCDEFP) — only if you later sign up to take part in a specific project. We will tell you exactly what is shared before it happens.
We may also disclose data where Romanian or EU law requires it.
05Transfers outside the EU
Some of the service providers above are based in, or may process data in, the United States. When that happens, the transfer is protected by the EU–US Data Privacy Framework (for certified companies) and/or the European Commission’s Standard Contractual Clauses.
06Visiting the website
This website has no analytics, no advertising and no tracking. Fonts and images are served from our own site, so simply opening a page sends no data to Google, Meta or any other third party.
A connection to an outside service only happens when you choose it:
- when you send a form, your answers go to FormSubmit to be delivered to us;
- when you click our Instagram link, you leave our site, and Meta’s own privacy policy applies from then on.
We don’t use cookies. The details are in our Cookie Policy.
07Your rights
Under the GDPR, you have the right to:
- Access — get a copy of the data we hold about you (Art. 15);
- Rectification — have incorrect data corrected (Art. 16);
- Erasure — have your data deleted (Art. 17);
- Restriction — ask us to limit how we use your data (Art. 18);
- Portability — receive the data you gave us in a common format (Art. 20);
- Objection — object to processing based on our legitimate interest (Art. 21);
- Withdraw consent at any time, as easily as you gave it (Art. 7(3)).
To use any of these rights, email daniel.butnar@gmail.com. It’s free. We answer within one month; for complex requests we may need up to two more months, and we’ll tell you if so. We may ask you to confirm your identity so nobody else can access your data.
We don’t make automated decisions or build profiles about you.
08Complaints
If you think we’ve handled your data wrongly, please talk to us first — we’ll try to fix it. You also have the right to complain to the Romanian data protection authority:
National Supervisory Authority for Personal Data Processing (ANSPDCP)B-dul G-ral Gheorghe Magheru 28–30, Sector 1, Bucharest, Romania
Website: www.dataprotection.ro
Email: anspdcp@dataprotection.ro
09Security
The website is served only over encrypted HTTPS, and form submissions travel encrypted to our inbox. Access to submissions is limited to the core team, and we delete data when the retention periods above end.
10Changes to this policy
If we change how we handle personal data — for example, by adding a new form or service — we will update this page and the date at the top. If a change affects consent you have already given, we will ask you again.