PRIVACY POLICY& GDPR

01

WHO IS RESPONSIBLE FOR YOUR DATA

The World Roma Israel Mandate is the controller of your personal data. If you have any question about this policy or about how we handle your data, write to us at info@worldromaisrael.org and we will answer you.

02

WHAT DATA WE COLLECT

We collect only what the movement needs to function, and nothing more:

• Account data — your first name, last name, e-mail address, country and preferred language, plus the dates you accepted these Terms and this Privacy Policy.
• Register data — only if you choose to join the World Roma Israel Register: your identity selections, an optional free description of your connection, an optional community note, your display name, region and membership status.
• Public support — only if you explicitly opt in: your first name, the first initial of your surname and your country, shown on the public supporters wall.
• Consent records — what you agreed to, when, and in which version of this policy, together with a short activity log so we can prove and honour your choices.
• Contact messages — if you write to us through the contact form: your name, e-mail, subject and message.

03

WHY WE USE IT, AND ON WHAT LEGAL BASIS

We process your data only where we have a lawful basis under the GDPR:

• Your consent (Art. 6(1)(a)) — joining the Register, your identity selections, and public display of your name are all voluntary choices you can withdraw at any time.
• Performance of a contract (Art. 6(1)(b)) — keeping your account working so you can sign in and use the member area.
• Legitimate interests (Art. 6(1)(f)) — keeping the platform secure, preventing abuse, and keeping the audit records that protect your rights.

04

YOUR REGISTER ENTRIES ARE PRIVATE BY DEFAULT

The Register is never public. Nobody can browse members, and there is no public member directory. Your identity selections, your description and your community note are visible only to you and to the administrators who safeguard the Register. The single, deliberate exception is the public supporters wall — and only for people who tick the opt-in box in step 03 of the registration, and only ever as a first name, a surname initial and a country.

05

HOW LONG WE KEEP YOUR DATA

Account data is kept while your account exists. Register data is kept while your registration is active; if you withdraw, the registration is marked withdrawn and its details are no longer shown, while a minimal record of the withdrawal is retained so your choice is respected. Contact messages are kept until your request is handled. Consent and audit records are kept so that we can always demonstrate what you agreed to and when.

06

YOUR RIGHTS

Under the GDPR you have the right to:

• Access — see the personal data we hold about you, shown directly in your member area under My Registration and Privacy & Data.
• Rectification — correct your name, country, language and register details at any time.
• Erasure — delete your registration (withdrawal) and ask us to delete your account; we will honour it subject to the minimal records described above.
• Restriction and objection — ask us to pause or stop a processing activity.
• Data portability — receive the data you gave us in a structured, commonly used format.
• Withdraw consent — withdraw any consent, including public display of your name, at any time; it takes effect immediately.

07

HOW TO USE YOUR RIGHTS

Most things you can do yourself in the member area: update your profile, update your registration, or withdraw from the Register. For anything else — including full account deletion — write to info@worldromaisrael.org. If you believe your rights have been violated, you may lodge a complaint with your national data-protection authority; in the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ).

08

HOW WE PROTECT YOUR DATA

Your data is stored in a secure hosted database protected by row-level security, which means every record is locked to your account, and administrators can reach member data only through strictly controlled, role-based access. Passwords are stored only as cryptographic hashes. Data is transmitted exclusively over encrypted connections. Access by administrators is limited to what is necessary to operate the Register, and every sensitive action is recorded in the audit log.

09

WHO CAN SEE YOUR DATA

Only you, and the small circle of administrators who operate the Register. We do not sell your data, we do not share it with advertisers, and we do not pass it to third parties for their own marketing. Our hosting and e-mail providers process data only on our instructions, under contract, to keep the service running.

10

COOKIES

We use only the cookies and local storage that are strictly necessary: keeping you signed in, remembering your chosen language, and basic security protection. We use no advertising cookies and no third-party tracking.

11

CHILDREN

The movement is intended for adults. We do not knowingly collect data from children under 16. If you believe a child has given us data, contact us and we will remove it.

12

CHANGES TO THIS POLICY

If this policy changes, we will record a new version and, where the change affects your rights, ask for your consent again where required. Your consent records always show which version you accepted and when.