Privacy notice
GDPR-compliant data processing
Our school processes your personal data in accordance with EU Regulation 2016/679 (GDPR) and Romanian Law No. 190/2018.
1. Introduction
Bolyai Farkas Theoretical High School (hereinafter the "School", "we", the "data controller") is committed to protecting the personal data of its users. The purpose of this notice is to inform you about what personal data we collect, how we process it, and what rights you have in relation to the processing.
Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Union, the General Data Protection Regulation (GDPR), Romanian Data Protection Law No. 190/2018, and the Romanian legislation in force.
2. Details of the data controller
Liceul Teoretic Bolyai Farkas (Bolyai Farkas Theoretical High School)
Data protection officer (DPO): The duties of the data protection officer are carried out by the head teacher of the school. Please address any questions about data protection to the school office.
3. Personal data processed
Contact and enquiry data:
- Name (surname and first name)
- Email address
- Telephone number
- The content of the message
School enrolment data (for pupils / parents):
- The pupil's name, date and place of birth
- Permanent address and place of residence
- Name and contact details of the parent / legal guardian
- Previous academic results, school documents
Technical data (when visiting the website):
- IP address: the visitor statistics do not store it, only the country and town estimated from it (the estimate is made on our own server, and the IP address is not passed on to anyone)
- Security log: if someone requests an address on the website that does not exist and is sought by attackers (for example a WordPress login or a database administration tool), or arrives from a country from which the website is blocked, we keep their IP address, the requested address and the name of their browser for 30 days in order to protect the website (Article 6(1)(f) GDPR), after which they are deleted automatically
- Browser type and version
- Time and duration of the visit
- Pages viewed
4. Purpose and legal basis of processing
| Purpose of processing | Legal basis |
|---|---|
| Making contact, answering enquiries | Consent of the data subject (Article 6(1)(a) GDPR) |
| Fulfilling admission and record-keeping obligations | Compliance with a legal obligation (Article 6(1)(c) GDPR) |
| Organising events and competitions | Performance of a task carried out in the public interest (Article 6(1)(e) GDPR) |
| Publishing photos and videos of school events | Consent of the data subject (or, in the case of a minor, of their legal guardian) |
| Technical operation of the website | Legitimate interest (Article 6(1)(f) GDPR) |
5. Data retention period
We store data only for as long as is necessary to achieve the purpose of the processing:
• Contact data: for 1 year from the date the enquiry was answered
• School record data: in accordance with the Romanian education law in force, for at least 10 years from the end of the pupil's enrolment at the school
• Technical log data: for no more than 90 days
• Photos and videos of school events: until consent is withdrawn or until the publisher decides otherwise
When the retention period expires, the data are securely deleted or anonymised.
6. Rights of the data subject
Right of access
You may ask us to tell you whether we process your personal data and, if so, for what purpose.
Right to rectification
You may request the correction of inaccurate or incomplete personal data.
Right to erasure (“right to be forgotten”)
Where certain conditions are met, you may request the erasure of your data.
Right to restriction of processing
You may request that the processing of your data be suspended while a dispute is resolved.
Right to data portability
You may request your personal data in a machine-readable format, or their transfer to another data controller.
Right to object
Where processing is based on legitimate interest or on the performance of a task in the public interest, you may object to the processing.
Right to withdraw consent
Where processing is based on consent, you may withdraw your consent at any time.
7. Data security measures
The School applies appropriate technical and organisational measures to protect personal data, including:
• An encrypted HTTPS connection on the website
• Restricted access to personal data (only for authorised staff)
• Regular backups
• Password-protected databases
• Contractual data protection commitments from data processors
8. Use of cookies
Our website uses a limited number of cookies for its technical operation and to improve the user experience. You will find detailed information about cookies and how to switch them off in your browser's help pages.
Essential (technical) cookies: These are indispensable for the website to work – no consent is needed for them.
Analytics cookies: For analysing how the site is used – consent is needed for these.
You can withdraw your consent to the use of cookies at any time using the cookie banner.
9. How to lodge a complaint
If you believe that our processing of personal data infringes the GDPR, you may contact the following body:
Romanian Data Protection Authority (ANSPDCP)
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București
Tel: +40 318 059 211
Web: www.dataprotection.ro
Judicial remedy: You may also go to court to enforce your rights.
10. Changes to this notice
We reserve the right to amend this privacy notice where necessary. In the event of significant changes, we will publish a notice on the website. We recommend that you review this page regularly.
Last updated: 7 November 2026