Last updated: July 18, 2026
1. Introduction
ELSA'S HAVEN ORGANISATION ("ELSA", "we", "our", or "us") is committed to protecting your privacy and respecting your rights regarding the processing of your personal data.
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit our website, submit forms, make donations, apply to adopt or foster an animal, volunteer with our organization, contact us, or otherwise interact with ELSA'S HAVEN.
We process personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR);

• Applicable Romanian data protection legislation;

• Other applicable European Union laws relating to privacy and data protection.

We are committed to processing personal data lawfully, fairly, transparently, and only for legitimate purposes.
By using our website, you acknowledge that you have read this Privacy Policy.
2. Data Controller
The controller responsible for processing your personal data is:
ELSA'S HAVEN
Tax Identification Number (CIF): 51618910
Registered Address:
Cluj-Napoca
Romania
Website:
www.elsa.ngo
Email:
contact@elsa.ngo
If you have any questions regarding this Privacy Policy or wish to exercise your rights under the GDPR, you may contact us using the details above.
3. Our Data Protection Principles
Whenever we process personal data, we are guided by the principles established by Article 5 of the GDPR.
Accordingly, personal data is:

• processed lawfully, fairly, and transparently;

• collected only for specified, explicit, and legitimate purposes;

• limited to what is necessary for those purposes;

• kept accurate and, where necessary, up to date;

• retained only for as long as necessary;

• processed using appropriate technical and organizational security measures to protect against unauthorized or unlawful processing, accidental loss, destruction, or damage.

We regularly review our data processing activities to ensure ongoing compliance with applicable legislation.
4. Categories of Personal Data We Collect
Depending on how you interact with our website and services, we may collect different categories of personal data.
A. Contact Information
When you contact us or complete one of our forms, we may collect:

• Full name

• Email address

• Telephone number

• Postal address (where applicable)

 
B. Information You Voluntarily Provide
Depending on the service requested, you may voluntarily provide additional information, including:

• Messages sent through contact forms;

• Information contained in emails;

• Information submitted through adoption applications;

• Foster applications;

• Volunteer applications;

• Partnership requests;

• Event registrations;

• Donation-related communications;

• Supporting documents uploaded voluntarily.

For adoption or foster applications, this may include information relevant to assessing the suitability of a home for an animal, such as:

• Household composition;

• Existing pets;

• Housing conditions;

• Lifestyle information;

• Previous experience with animals;

• Availability and care arrangements.

We only request information reasonably necessary to evaluate applications and carry out our charitable activities.
C. Donation Information
If you make a donation, we may collect:

• Your name;

• Email address;

• Donation amount;

• Donation date;

• Payment confirmation.

Online payments are securely processed by third-party payment providers (Stripe).
ELSA'S HAVEN does not receive or store your complete payment card information.
Payment card details are processed directly by Stripe or PayPal under their own privacy policies.
D. Website Usage Information
When you visit our website, certain information may be collected automatically, including:

• IP address;

• Browser type and version;

• Operating system;

• Device type;

• Date and time of your visit;

• Pages viewed;

• Referring website;

• General website usage statistics;

• Technical diagnostic information.

This information helps us maintain the security, stability, and performance of our website.
5. Cookies and Similar Technologies
Our website uses cookies and similar technologies to improve functionality, enhance user experience, and better understand how visitors interact with our website.
Cookies are small text files placed on your device.
Depending on your preferences, cookies may be used for:

• essential website functionality;

• remembering your preferences;

• website security;

• analytics and website performance;

• improving our services.

Where required by law, non-essential cookies are used only after obtaining your consent through our cookie banner.
You may withdraw or modify your cookie preferences at any time through your browser settings or our cookie management tool, where available.
6. Why We Process Your Personal Data
We process personal data only where necessary and for legitimate purposes, including:

• responding to enquiries;

• communicating with you;

• processing adoption applications;

• processing foster applications;

• processing volunteer applications;

• processing donations;

• issuing donation confirmations where appropriate;

• organizing events and educational activities;

• managing partnerships;

• administering our charitable projects;

• maintaining accurate internal records;

• complying with legal and regulatory obligations;

• protecting our legal rights and interests;

• preventing fraud, abuse, or misuse of our website;

• maintaining the security of our systems;

• improving our website and user experience.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
We do not share your personal data outside our organisation.
7. Legal Basis for Processing
Depending on the circumstances, we process personal data under one or more of the following legal bases set out in Article 6 of the GDPR:
Consent
Where you voluntarily submit information through forms, subscribe to communications, or otherwise consent to specific processing activities.
You may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
Performance of a Contract or Pre-contractual Steps
Where processing is necessary to respond to your request, manage an adoption or foster application, administer donations, or take steps requested by you before entering into an agreement.
Compliance with Legal Obligations
Where we are required to process personal data to comply with applicable legal, accounting, tax, financial reporting, or regulatory obligations.
Legitimate Interests
Where processing is necessary for our legitimate interests, provided these interests are not overridden by your fundamental rights and freedoms.
Our legitimate interests include:

• responding to enquiries;

• managing our charitable activities;

• protecting our website against misuse;

• maintaining website security;

• improving our services;

• maintaining internal administrative records;

• defending legal claims where necessary;

• ensuring the proper operation of our organization.

Whenever we rely on legitimate interests, we carefully balance those interests against your rights and freedoms before processing your personal data.
 
8. Sharing of Personal Data
We respect your privacy and do not sell, rent, or trade your personal data to third parties for marketing purposes.
We may share your personal data only where necessary to operate our website, provide our services, comply with legal obligations, or protect our legitimate interests.
Your personal data may be shared with the following categories of recipients:
Website and Hosting Provider
Our website is hosted and operated through Wix.com Ltd., which provides website hosting, website infrastructure, online forms (Wix Forms), security services, and data storage.
Information submitted through forms on our website may be processed by Wix on our behalf in accordance with their applicable privacy and security standards.
Payment Service Providers
Online donations are securely processed through trusted third-party payment providers, including:

• Stripe, Inc.

• PayPal Holdings, Inc.

Payment card information is entered directly into the secure payment systems of these providers.
ELSA'S HAVEN does not collect, access, or store your complete debit or credit card information.
These providers process personal data in accordance with their own privacy policies and applicable data protection laws.
Service Providers
Where necessary, we may also share personal data with carefully selected service providers who assist us with:

• website maintenance;

• technical support;

• cloud hosting;

• email communications;

• cybersecurity;

• accounting and bookkeeping;

• legal advice;

• administrative support.

All such providers process personal data only on our instructions and under appropriate contractual safeguards where required by law.
Legal Authorities
We may disclose personal data where required to do so by law or where disclosure is necessary to:

• comply with a legal obligation;

• respond to lawful requests from public authorities;

• protect our legal rights;

• investigate suspected fraud or unlawful activity;

• establish, exercise, or defend legal claims.

9. International Transfers
Some of our service providers, including Wix, Stripe, and PayPal, may process or store personal data outside the European Economic Area (EEA).
Whenever personal data is transferred internationally, we ensure that appropriate safeguards are implemented in accordance with Chapter V of the GDPR.
These safeguards may include:

• adequacy decisions adopted by the European Commission;

• Standard Contractual Clauses (SCCs);

• other lawful transfer mechanisms recognized under applicable data protection legislation.

We take reasonable steps to ensure that all international transfers provide an appropriate level of protection for your personal data.
10. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy or as required by applicable law.
Retention periods vary depending on the type of information and the purpose for which it was collected.
For example:

• contact enquiries are retained only as long as reasonably necessary to respond and maintain correspondence;

• adoption, foster and volunteer application data may be retained while the application is active and for an appropriate period afterwards for administrative, legal, or safeguarding purposes;

• donation records may be retained for the period required under accounting, tax, or charity legislation;

• technical website logs are retained only for the period necessary to maintain website security and functionality.

Once personal data is no longer required, it is securely deleted, anonymized, or otherwise disposed of using appropriate security measures.
11. Security of Personal Data
We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
Our security measures include, where appropriate:

• encrypted website connections (HTTPS);

• secure hosting infrastructure;

• restricted access to personal data;

• password-protected administrative accounts;

• software updates and security patches;

• regular backups;

• access controls based on operational necessity;

• staff and volunteer awareness regarding confidentiality.

Although we take reasonable steps to safeguard personal data, no website, online service, or method of electronic transmission can be guaranteed to be completely secure.
For this reason, while we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security.
12. Personal Data Breaches
In the unlikely event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, ELSA'S HAVEN will respond promptly and in accordance with the GDPR.
Where required by law, we will:

• investigate the incident;

• take appropriate measures to limit its impact;

• notify the competent supervisory authority within the applicable legal timeframe;

• notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

We continuously review and improve our security procedures to reduce the likelihood of such incidents.
13. Children's Privacy
Our website is intended primarily for adults.
We do not knowingly collect personal data from children under the age of 16 unless such processing is necessary for our charitable activities and is carried out with the involvement or authorization of a parent or legal guardian where required by law.
If you believe that a child has provided personal data without appropriate authorization, please contact us. We will take appropriate steps to investigate and, where necessary, delete the information.
14. External Links and Third-Party Websites
Our website may contain links to third-party websites, including social media platforms, payment providers, partner organizations, and other external resources.
These websites operate independently from ELSA'S HAVEN and have their own privacy policies and terms of use.
We are not responsible for the content, security, or privacy practices of third-party websites.
We encourage you to review the privacy policies of any external websites you visit before providing personal information.
15. Social Media
ELSA'S HAVEN maintains social media accounts to communicate with our community and promote our charitable activities.
If you interact with us through platforms such as Facebook, Instagram, LinkedIn, or other social media services, your personal data may also be processed by those platform providers in accordance with their own privacy policies.
Information you choose to make public on social media (such as comments, reactions, or messages) may be visible to others depending on your privacy settings.
Please remember that social media platforms operate independently from ELSA'S HAVEN, and we recommend reviewing their privacy notices before interacting with our pages.
 
16. Your Rights Under the GDPR
Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data, subject to applicable legal limitations.
Right of Access
You have the right to request confirmation as to whether we process your personal data and, where this is the case, to receive a copy of the personal data together with information about how it is processed.
Right to Rectification
You have the right to request that inaccurate or incomplete personal data be corrected or updated without undue delay.
Right to Erasure ("Right to be Forgotten")
You may request that we erase your personal data where:

• the data is no longer necessary for the purposes for which it was collected;

• you withdraw your consent and there is no other legal basis for processing;

• you object to the processing and there are no overriding legitimate grounds for continuing the processing;

• the personal data has been processed unlawfully;

• erasure is required to comply with a legal obligation.

Please note that this right is not absolute. We may be required to retain certain information where processing is necessary to comply with legal obligations or to establish, exercise, or defend legal claims.
Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data where:

• you contest the accuracy of the data;

• the processing is unlawful, but you oppose deletion;

• we no longer require the data, but you need it for legal claims;

• you have objected to processing pending verification of our legitimate grounds.

Right to Data Portability
Where processing is based on consent or on a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and, where technically feasible, to request that it be transferred directly to another controller.
Right to Object
You have the right to object, at any time, to the processing of your personal data where processing is based on our legitimate interests.
If you object, we will stop processing your personal data unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for legal claims.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of any processing carried out before the consent was withdrawn.
Right Not to Be Subject to Automated Decision-Making
You have the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects or similarly significant effects concerning you.
ELSA'S HAVEN does not carry out automated decision-making or profiling that produces such effects.
Right to Lodge a Complaint
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.
For individuals located in Romania, the competent authority is:
National Supervisory Authority for Personal Data Processing (ANSPDCP)
Bulevardul General Gheorghe Magheru 28–30, Sector 1, Bucharest, Romania
Website: https://www.dataprotection.ro
Email: anspdcp@dataprotection.ro
You also have the right to seek a judicial remedy before the competent courts.
17. Exercising Your Rights
If you wish to exercise any of your rights under this Privacy Policy or under applicable data protection legislation, you may contact us using the details below.
Email: contact@elsa.ngo
We may request additional information necessary to verify your identity before responding to your request.
We will respond to your request without undue delay and, in any event, within the time limits established by applicable law. Where permitted by law, this period may be extended where requests are particularly complex or numerous.
There is generally no fee for exercising your rights. However, where requests are manifestly unfounded, excessive, or repetitive, we reserve the right to charge a reasonable administrative fee or refuse to act in accordance with Article 12 of the GDPR.
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in applicable legislation, our services, our processing activities, or technological developments.
Any revised version will be published on this page together with the updated "Last updated" date shown at the beginning of this document.
Where changes materially affect your rights or the way we process your personal data, we will take appropriate steps to inform users where required by law.
We encourage you to review this Privacy Policy periodically to remain informed about how we protect your personal data.
19. Contact Us
If you have any questions about this Privacy Policy or about the way ELSA'S HAVEN processes your personal data, please contact us:
ELSA'S HAVEN
Website: www.elsa.ngo
Email: contact@elsa.ngo
We will make every reasonable effort to respond promptly and to resolve any concerns regarding the processing of your personal data.
20. Governing Law
This Privacy Policy shall be governed by and interpreted in accordance with the laws of Romania and applicable European Union legislation, including Regulation (EU) 2016/679 (GDPR).
Nothing in this Privacy Policy limits or excludes any rights granted to data subjects under applicable data protection laws.
21. Final Provisions
This Privacy Policy applies solely to the processing of personal data carried out by ELSA'S HAVEN through its website and related services.
If any provision of this Privacy Policy is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
This Privacy Policy should be read together with our Cookie Policy and any additional notices provided when specific personal data is collected.