Liga Studenților din Facultatea de Automatică și Calculatoare (Liga AC) – The students’ organization from the Faculty of Automation and Computing, residing in Timișoara, Timiș county, Romania, Blvd. Vasile Pârvan, no. 2, room A021, TIN 7267553, hereinafter referred to as the “Controller”, represented by Alexandru-Petrică Brăescu, the person responsible for implementing measures regarding personal data protection (reachable at contact@ligaac.ro or contact@robotec.engineering), hereby notifies you of the following, in accordance with Article 13 of Regulation (EU) 2016/679 (GDPR):

Liga AC, as a personal data controller for the RoboTEC competition, is constantly concerned with providing a high level of protection regarding the personal data processing we perform according to the law. We implement technical and organizational measures to protect all operations that directly or indirectly concern personal data and to prevent unauthorized or illegal operations, as well as accidental or illegal data loss or damage. In this regard, the controller is subject to the control of The National Supervisory Authority for Personal Data Processing (ANSPDCP).

Legal Ground for Processing

According to Article 6 of the General Data Protection Regulation, data processing shall be lawful only if at least one of the following applies:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

The PURPOSE of personal data processing by Liga AC for RoboTEC is to fulfill our specific activity (organizing the robotics competition) and the contract with the participant, as well as legal obligations concerning financial, commercial, and international law matters.

The LEGAL GROUND for personal data processing by Liga AC is, mainly, article 6, paragraph (1), letter b) from GDPR - processing is necessary for the performance of a contract, as well as, article 6, paragraph (1), letter c) from GDPR – processing is necessary for compliance with a legal obligation – the legal obligations that apply to the controller are regulated by labor law or any other legislative or administrative document or decision relating to data collection and processing.

Personal Data Categories Processed

In order to fulfill our tasks for RoboTEC, the controller processes the following categories:

1. 1. Identification Data:
   First, middle, and last names, home addresses, personal identification number (CNP/Passport No.), and data from identity documents.
   Purpose: Signing contracts, billing, payments, accounting obligations, settling financing projects, displaying competition results/rankings, and creating non-nominal statistics.
2. 2. Financial Data:
   Bank account details (IBAN, Bank Name).
   Purpose: Making prize payments or reimbursements.
3. 3. Contact Data:
   Phone numbers, email addresses, social media accounts, websites.
   Purpose: Communicating results, providing updates about RoboTEC, confirming participation, and facilitating communication between organizers and participants.
4. 4. Logistics & Preferences:
   Clothing sizes (for T-shirts), dietary preferences, gender, nationality.
   Purpose: Ensuring a proper experience during the event (catering, merchandise) and statistical reporting.
5. 5. Multimedia:
   Images or videos taken during the event.
   Purpose: Promotional use on the controller’s social media accounts and website.
6. 6. Special Categories (if applicable):
   According to GDPR, processing special categories (e.g., health data for medical emergencies) requires a higher protection standard and is done only with explicit consent or to fulfill specific legal obligations (Article 9(2) GDPR).

Recipients of Personal Data

The RECIPIENTS of personal data are the controller’s proxies, employees, the accounting and human resources departments, as well as clients, partners, beneficiaries, suppliers and state institutions.

We do not intend to transfer data to other companies (marketing or advertising companies).

We do not intend to transfer personal data to another country or international organization unless we are partners or collaborators and this fact is clearly stated in the data collection form.

Information regarding personal data might be communicated, by request, to the following recipients or recipient categories: the National Authority for Community Programs in Education and Professional Training (ANPCDEFP), the Ministry of Finances, the Ministry of Youth and Sports, Timișoara City Hall, Timiș County Council, the Sports and Youth Department of Timiș County, the Ministry of Culture and National Identity, the Ministry of Education, universities in Timișoara, the Timiș County School Inspectorate and subordinate institutions, public authorities with attributions regarding defense, public order, supervising and controlling economic activity, national security and justice, institutions or authorities of public administration, foreign diplomatic missions recognized by Romania, public institutions or authorities in healthcare and social insurance, other public or private entities that can prove a legitimate interest, according to the law.

Providing that other personal data is required, the petitioner must provide legitimate interest, according to the law.

Personal data may be processed by the petitioners only for the purpose they were required for and provided for, except in situations stated by the law.

If the petitioner intends to process the personal data acquired from the controller, they have the obligation to respect the regulations regarding personal data processing.

Duration of Storage

The DURATION of personal data storage and processing is limited, for as long as the contract between the two parties is valid, in case of litigation – for the duration of the settlement of said litigation, as well as in accordance with the law and for as long as it is legally required that we keep work contracts, documents regarding payments or accounting or other legal documents that we must keep in accounting and society archives. Furthermore, personal data belonging to participants in projects, activities or events organized by Liga AC is stored for up to ten years or until the data subject requests its erasure.

Your Rights

As a data subject, the following RIGHTS apply to you:

1. The right to access – you have the right to obtain confirmation from us that we do or do not process personal data that is of interest to you, and to gain access to your own data and to information regarding the means of data collecting.
2. The right to data portability – you have the right to receive personal data in a structured, commonly used format that can be automatically read and the right to have this data transferred to another controller should this be possible from a technical standpoint.
3. The right to opposition – you have the right to oppose personal data processing when the processing is necessary to a task that serves public interest or a legitimate interest of the controller. When personal data is processed for direct marketing, you have the right to oppose processing at any moment.
4. The right to rectification – you have the right to have your personal data rectified, without unjustified delays. The rectification will be further communicated to any recipient whom the data was previously sent to, unless this proves to be impossible or entails disproportionate effort.
5. The right to data erasure (“the right to be forgotten”) – you have the right to request that your personal data is erased, without unjustified delays, provided one of the following reasons apply: the data is no longer necessary in order to fulfil the purpose it was collected or processed for, you withdraw consent and there is no longer legal ground for the processing, you oppose the processing and there are no other prevalent legitimate reasons, personal data must be erased in order to respect a legal obligation, the personal data was illegally processed, the personal data was collected in order to provide services of an informational society.
6. The right to restriction of processing – it can be exercised if the accuracy of the personal data is contested by the data subject for a period of time that allows us to check the correctness of the data; the processing is unlawful and the data subject opposes personal data erasure, requesting restriction instead; if the controller no longer needs the personal data for processing but the data subject requests the data for the establishment, exercise or defense of a legal claim; the data subject objected processing for the time period pending the verification whether the legitimate grounds of the controller override those of the data subject.

All these rights may be exercised via a written, signed and dated request that is sent to our headquarters via email(contact@ligaac.ro or contact@robotec.engineering) at the contact details previously mentioned and the controller will respond to the request without unjustified delays, in a month from the date of its receival, or in exceptional situations, if the data subject’s request is complex, the controller will respond in a period of time of maximum three months from its receival and the data subject will be notified of this situation.

We inform you that we do not use personal data for automatic processing or for creating profiles. We do not make automatic decisions regarding your personal data. We use technological means to store personal data securely. We do not process data for purposes that are incompatible with the purpose the data was collected for.

We respect and strictly ensure professional secrets. We do not publish personal data, unless it is in your interest or to fulfil legal obligations. Confidentiality represents not only a professional obligation for us, but also a fundamental value.

We will take technical and procedural measures in order to protect and to ensure the confidentiality, integrity and accessibility of your personal data that is processed by us. We will prevent unauthorized access or usage and personal data security violations, according to the law.

Complaints

Furthermore, as a data subject, should you be unhappy with how we apply the regulations and respect the rights regarding personal data protection, you have the right to file a complaint with the National Authority for Community Programs in Education and Professional Training (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal - ANSPDCP) at their headquarters at blvd. General Gheorghe Magheru no. 28-30, sector 1, Bucharest, postal code 0103336, email: anspdcp@dataprotection.ro or to take legal action.

We inform you that an intervention over the personal data you provided us might prevent us from fulfilling the contract signed between you and the controller, the controller being released from any obligation or liability in such an event. Refusal to provide certain personal data may prevent us from fulfilling the contract (e.g., allowing participation in RoboTEC).