Data Processing Notice

Regarding the processing of personal data

DATA PROCESSING NOTICE REGARDING PERSONAL DATA

Last updated: 03.09.2026

I. INTRODUCTION

At Sovereign Institute for Liberty & Justice, we believe that the future of Romania's justice system is built through the dialogue between the enthusiasm of young researchers and the vast experience of prestigious seniors. Our commitment to the protection of personal data is an extension of our conservative values and the principles of legality, transparency and accountability that govern all our activities.

Whether you are a young jurist at the beginning of your path, eager to reform doctrine, an esteemed expert wishing to offer mentoring and strategic vision, or a supporter of our projects, this Data Processing Notice is the foundation of our relationship of trust.

We process your data in strict compliance with Regulation (EU) 2016/679 (GDPR), as well as applicable national data protection legislation, guaranteeing that the professional and personal information you entrust to us is treated with maximum confidentiality and used exclusively for the consolidation of this project.

II. PURPOSE AND SCOPE OF THIS POLICY

This Policy clarifies and details the practices of Asociația Sovereign Institute for Liberty & Justice (hereinafter "Sovereign Institute for Liberty & Justice" or "the Controller"), regarding the application and observance of the GDPR provisions, as well as the rights that you, as a data subject, enjoy in the context of your interaction with the Sovereign Institute for Liberty & Justice platform.

This Policy establishes the internal regulatory framework and the public commitment regarding the processing of personal data collected through the website https://sovereign-institute.com/. The primary purpose is to provide you with an exhaustive and easy-to-understand picture of our processing practices, ensuring compliance with the provisions of the General Data Protection Regulation (GDPR). This includes, but is not limited to, defining the categories of data processed, establishing clear legal bases for each stage of academic collaboration and guaranteeing your individual rights as a data subject.

This Privacy Policy is obligatorily intended to clarify who, what, when and why processes your personal data, functioning as a transparency contract between you and Sovereign Institute for Liberty & Justice. It applies to all natural persons whose data is processed by our entity for the purposes of Sovereign Institute for Liberty & Justice activities, whether they are young people in the selection process, senior experts proposed for the consultancy network, editorial board members, donors, sponsors, supporters or visitors to the platform wishing to contribute to conservative legal doctrine.

III. WHO WE ARE AND WHAT ROLE WE PLAY IN DATA PROCESSING

We are Asociația Sovereign Institute for Liberty & Justice, a Romanian private law legal entity, non-profit, with registered office in Bucharest, B-Dul Unirii No. 11, Bl. 2b, Sc. 1, Et. 1, Ap. 2, Sector 4, fiscal registration code (CIF) 55448673, with email address: office@sovereign-institute.com.

Sovereign Institute for Liberty & Justice acts as the Controller of personal data within the meaning of art. 4(7) GDPR. We determine the strategic objectives and the means by which the data provided is collected to serve our mission.

To ensure rigorous protection of your data, we have appointed a Data Protection Officer (DPO). They permanently monitor the compliance of our processes with European legislation. Data subjects may at any time contact the DPO directly regarding any aspects of this Privacy Policy by sending an email to: office@sovereign-institute.com.

IV. WHAT IS PERSONAL DATA AND WHAT DOES PROCESSING INVOLVE?

Under the GDPR, personal data means any information relating to an identified or identifiable natural person (a "data subject"). A person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a unique identification number, location data, an online identifier (such as an IP address), or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

Thus, personal data includes elements such as: your contact information (email address, mobile phone number), name and surname, domicile/residence, photographs, details of your academic and professional background (CV, diplomas, history in the judiciary or bar), personal preferences and doctrinal views, financial information (where applicable), as well as any other data necessary for assessing competencies in the selection, collaboration process or fulfilment of formalities for financially supporting our projects.

Beyond defining data, it is essential to understand the concept of Data Processing. Processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means. This definition is extremely broad and covers a varied range of actions, including the collection of applications and contributions through the digital platform, their registration in Sovereign Institute for Liberty & Justice databases, the organisation of members by areas of expertise, structuring expert networks, financial-accounting records of donations and sponsorships, storage of academic documentation, adaptation or modification of information for research projects, consultation, use for the purpose of drafting legislative proposals, disclosure by transmission to institutional partners (where necessary or legally required), dissemination or making available in any other manner, alignment or combination, restriction, erasure or destruction of data.

Sovereign Institute for Liberty & Justice carries out these operations on an ongoing basis in fulfilment of its statutory, political and academic purposes, ensuring the selection of the best specialists as well as the transparency and legality of the management of the resources necessary to support its activities.

V. PERSONAL DATA WE PROCESS THROUGH THE WEBSITE, THE PURPOSE AND LEGAL BASIS

We are committed to full transparency and do not collect more data than is strictly necessary for achieving our statutory purposes and the optimal functioning of the platform. Processing is carried out on the basis of a valid legal ground (art. 6 GDPR) and, to the extent that the data collected may reveal philosophical, doctrinal beliefs or adherence to the values promoted by our entity, processing is carried out in accordance with art. 9(2)(d) GDPR, as well as art. 9(2)(a) GDPR (explicit consent of the data subject).

The following paragraphs detail the categories of data, the purpose and legal basis of processing:

1. CONTACT AND REGISTRATION FORM FOR EXPERT COLLABORATORS

This section is intended for professionals with significant experience who wish to contribute to building the Sovereign Institute for Liberty & Justice expert network. We process data provided directly by completing mandatory fields and uploading the requested documents. Categories of data collected include: name and surname (for identification), email address (for communication), telephone number (for quick contact), uploaded CV (containing education, professional experience of at least 15 years, publications and extra-professional activities), answers to motivational questions (determination to apply, type of contribution and professional objectives) and your photograph (included in the CV or attached separately).

  • • purpose of processing: registering the interest in collaboration, evaluating the professional profile and legal expertise for co-option into the Sovereign Institute for Liberty & Justice expert network, managing the selection process, and the public presentation and promotion of experts on the Sovereign Institute for Liberty & Justice website (using the name and photograph provided).
  • • legal basis: consent of the data subject (art. 6(1)(a) and art. 9(2)(a) GDPR) expressed through the voluntary action of completing the form and uploading the CV for the purpose of initiating a collaboration, steps taken at the request of the data subject prior to entering into a contract (art. 6(1)(b) GDPR), and the legitimate interest of the Controller (art. 6(1)(f) GDPR) in efficiently managing the selection process and structuring its consultancy network.

2. APPLICATION FORM FOR YOUNG PROFESSIONALS OPPORTUNITIES

This section is intended for professionals at the start of their careers (generally up to 35 years of age) who wish to join Sovereign Institute for Liberty & Justice as part of the new generation of thinkers. We process data provided directly by completing the form and uploading documents attesting to your academic and professional potential. Categories of data collected include: name and surname (for identification), email address (for communicating the selection process), telephone number (for quick contact), uploaded CV (containing education details, degree certificate, academic publications, extra-professional activities and language skills), answers to motivational questions (determination to apply, desired type of contribution and medium-term professional objectives), age/date of birth (inferred from the CV to verify the age requirement of up to 35 years), professional qualifications, and internal selection evaluations generated by the selection team.

  • • purpose of processing: registering the application, verifying fulfilment of the age criterion (maximum 35 years) and possession of a degree, evaluating the intellectual potential and legal competencies for co-option into the Sovereign Institute for Liberty & Justice think tank, managing the selection process and integrating young professionals into the projects developed.
  • • legal basis: consent of the data subject (art. 6(1)(a) GDPR) expressed through the voluntary action of completing the form and uploading the CV for the purpose of participating in the selection process, steps taken at the request of the data subject prior to entering into a contract (art. 6(1)(b) GDPR), and the legitimate interest of the Controller (art. 6(1)(f) GDPR) in recruiting its future researchers and collaborators.

3. APPLICATION FORM FOR INTERNSHIPS / TRAINEESHIPS

We process data provided directly by completing mandatory fields and uploading application documentation. Categories of data collected include: name and surname (for identification), email address (for communicating selection stages), telephone number (optional, for quick contact), uploaded CV and motivational essay (containing detailed answers regarding the interest in the internship, learning objectives and legal topics of interest for research), and internal selection evaluations.

  • • purpose of processing: registering the internship application, evaluating the sincerity, curiosity and reflective capacity of candidates, managing the selection process for internship programmes and planning mentoring activities based on the legal interests expressed by candidates.
  • • legal basis: consent of the data subject (art. 6(1)(a) GDPR) expressed through the voluntary action of completing the form, drafting the motivational essay and submitting documents for admission to the internship programme, steps taken at the request of the data subject prior to entering into an internship agreement (art. 6(1)(b) GDPR), and the legitimate interest of the Controller (art. 6(1)(f) GDPR) in managing the intern recruitment process and ensuring the academic quality of the programmes offered.

4. NEWSLETTER SUBSCRIPTION FORM

This section allows visitors to stay connected to the intellectual and political activity of Sovereign Institute for Liberty & Justice. By completing this form, you express your agreement to receive periodic updates directly to your email inbox. Categories of data collected include: first name (for personalising communication), email address (for effective message delivery), the date and time of consent registration, the IP address from which subscription was made (necessary to demonstrate compliance with consent collection under art. 7 GDPR), and technical data regarding interaction with emails sent (statistics on open rates, link clicks and delivery errors).

  • • purpose of processing: sending in-depth legal analyses, legislative commentaries and comparative law perspectives, informing subscribers about Sovereign Institute for Liberty & Justice events, conferences and study launches, as well as managing the subscriber database, segmenting communications, analysing the impact and efficiency of newsletters and maintaining the internal opt-out/unsubscribe list (suppression list) to ensure no further messages are sent after consent is withdrawn.
  • • legal basis: explicit consent of the data subject (art. 6(1)(a) GDPR) expressed by entering the requested data in the form, checking the acceptance box for this Notice and pressing the "Subscribe" button, and fulfilment of a legal obligation incumbent on the Controller to be able to demonstrate the granting of consent (art. 6(1)(c) GDPR read in conjunction with art. 7(1) GDPR).

Please be informed that you may withdraw this consent at any time by using the "Unsubscribe" link included in the footer of each email received, or by contacting the DPO directly at the address mentioned in this Policy.

5. DATA AUTOMATICALLY COLLECTED FOR WEBSITE SECURITY AND FUNCTIONALITY (TECHNICAL DATA AND COOKIES)

Upon your simple navigation of our website (https://sovereign-institute.com/), certain technical data is automatically collected to ensure proper functioning, system security and general traffic analysis. This data includes: IP address (internet protocol), type of browser used, operating system and date/time of access. Much of this information is collected through cookie modules and similar technologies. This information is not used to directly identify the person, but is essential for detecting and preventing fraud, protecting the network and diagnosing technical problems.

  • • purpose of processing: ensuring network and information security, diagnosing technical problems, maintaining website functionality and generating aggregate statistics on platform usage (through IP addresses, browser, etc.).
  • • legal basis: our legitimate interest (art. 6(1)(f) GDPR) in maintaining a safe, stable online environment and protecting our digital assets against cyber attacks or malfunctions.

The website uses exclusively strictly necessary cookies, indispensable for the correct functioning of the platform and for displaying the information notice acceptance pop-up. No analytical, advertising or tracking cookies are used.

6. INTERACTIONS AND COMMUNICATIONS EXTRINSIC TO THE PLATFORM (EMAIL AND SOCIAL MEDIA)

Sovereign Institute for Liberty & Justice processes personal information from communication channels outside the direct control of the Website. If you communicate with us by email, we may retain the content of emails, your email address and the responses we provide in the course of the conversation.

Additionally, the Association maintains an active presence on social media platforms. When you visit, follow or interact with our official pages on these networks, we may collect data about you (username, profile picture, content of comments, reactions, shares, private messages sent, as well as aggregate statistical data provided by platforms regarding the audience). It is important to note that any content voluntarily published on our social media pages is public. We reserve the right to monitor and moderate these comments to ensure a civilised and lawful discourse. If you subsequently delete voluntarily published content, certain copies may remain archived on web pages or be saved by other users, with Sovereign Institute for Liberty & Justice not having full control over the internal storage and archiving policies of third-party platforms.

In relation to social networks (e.g. Meta Platforms, LinkedIn Corporation, X Corp.), Sovereign Institute for Liberty & Justice acts as a joint controller exclusively for the administration of official pages and the processing of statistics collected through them. For complete details on how these platforms independently collect and process your data, please consult the privacy policies of the respective networks.

  • • purpose of processing: managing official correspondence (email), direct communication with the public, experts and young professionals, as well as monitoring/moderating content published on our social media pages to maintain a civilised, lawful discourse in keeping with the values of Sovereign Institute for Liberty & Justice. Data is processed exclusively for the purpose of the interaction initiated by you, for analysing the performance of our social media pages or for resolving formal requests addressed to the Association.
  • • legal basis: our legitimate interest (art. 6(1)(f) GDPR) in conducting our communication activities with the public and managing our presence in the online environment; steps taken at the request of the data subject prior to entering into a contract/partnership or executing an agreement (art. 6(1)(b) GDPR), to the extent that the email correspondence concerns a future collaboration, donation or application; fulfilment of legal obligations (art. 6(1)(c) GDPR), where the correspondence includes formal GDPR rights requests or legal/fiscal reports.

7. SUPPORT / DONATION FORM

This section is intended for individuals, companies, foundations or other entities wishing to financially support the activities, research projects and operations of Sovereign Institute for Liberty & Justice. We process data provided directly by completing the form fields or at the conclusion of the contribution/donation document. Categories of data collected include: name and surname or the name of the entity/representative, email address (for communication and document transmission), telephone number (for quick contact), capacity (natural person, company, foundation/organisation, other entity), the selected level of support and the envisaged contribution amount, the public recognition option (yes/no), the message transmitted (optional), banking data (IBAN account number, issuing bank, bank statement or payment order details, collected upon direct bank transfer to the Association's BRD accounts), personal identification number (CNP), processed for drawing up the contribution document, issuing receipts/invoices and financial-accounting reports, and the handwritten or electronic signature.

  • • purpose of processing: registering and processing financial support requests, establishing the level of contribution and holding preliminary discussions with the Association's leadership, drafting and concluding the simple contribution/donation document, activating the related status and access to benefits, managing the public recognition option and respecting the anonymity preference, the annual publication of the funding structure and the Annual Transparency Report (pursuant to G.O. no. 26/2000), financial-accounting records of collected funds, fulfilment of fiscal obligations reported to tax authorities (ANAF), and maintaining the list of founding supporters.
  • • legal basis: steps taken at the request of the data subject prior to entering into a contract and execution of the contribution/donation document (art. 6(1)(b) GDPR); fulfilment of legal obligations incumbent on the Controller in financial-accounting, fiscal and association transparency matters (art. 6(1)(c) GDPR read in conjunction with the Tax Code, Accounting Law no. 82/1991 and G.O. no. 26/2000); consent of the data subject (art. 6(1)(a) and art. 9(2)(a) GDPR) expressed by checking the agreement box and voluntarily submitting the form; and the legitimate interest of the Controller (art. 6(1)(f) GDPR) in ensuring its financial independence and sustainability and in efficiently managing its network of supporters.

VI. DURATION OF STORAGE OF YOUR PERSONAL DATA

Sovereign Institute for Liberty & Justice processes the personal data collected only for the duration necessary to fulfil the purposes for which they were collected, as well as to comply with legal, statutory obligations or to defend a legitimate interest before courts.

In the absence of an express legal period, storage periods are established internally, based on the principles of proportionality and necessity.

Retention periods by category of processing:

  • • Expert Collaborators (consultancy network): given the nature of the "think tank" and the need to maintain a permanent network of experts, the data will be retained for the entire duration of Sovereign Institute for Liberty & Justice's operation, to ensure continuity of research. In the event of voluntary withdrawal of the expert, contact details and CV will be stored for an additional period of 5 years for administrative archiving and defence of legitimate interests. The name and status of author in studies or publications remain permanently archived as part of Sovereign Institute for Liberty & Justice.
  • • Young Professionals and Internships (candidate data): data collected during selection processes (CVs, motivational essays, diplomas) for unsuccessful candidates will be retained for a period of 3 years from the completion of the selection process. This period is justified by our legitimate interest in creating a reserve pool for future opportunities and being able to defend against any challenges/litigation. For selected candidates who conclude an internship or collaboration agreement, data will be retained for the duration of the contract/agreement plus 5 years from its termination.
  • • Supporters / Donations: personal data processed for processing contributions and donations, drawing up contribution documents, issuing invoices/receipts and financial-accounting reports will be retained for a period of 10 years, starting from 1 January of the year following that in which the supporting documents were drawn up, in accordance with the provisions of Accounting Law no. 82/1991 and the Tax Code. Data relating to supporter/founding member status and the record of the public recognition option are retained for the entire duration of the Association's operation, for institutional archiving.
  • • Newsletter Subscription: data used for sending legal newsletters is processed for the entire duration of your subscription. Immediately after the withdrawal of consent (unsubscription), the data will be deleted from the active database.
  • • Technical data and log records (IP addresses): technical data automatically collected for the security of the platform https://sovereign-institute.com/ will be retained for a maximum period of 30 days, a period necessary for detecting security incidents.
  • • Email correspondence and Social Media interactions: data and content transmitted through direct email correspondence, as well as information generated through interactions on our official social media pages, will be retained for a period of 1 year from the date of the last communication or interaction. By way of exception, if the email concerns a formal GDPR rights exercise request, a petition or pre-contractual/contractual matters, the email will be stored for the period of resolution plus 3 years (the general limitation period).

VII. RECIPIENTS AND TRANSFER OF DATA

Sovereign Institute for Liberty & Justice respects the confidentiality of your collected data and discloses it only to the extent necessary to fulfil research purposes and only on the basis of a valid legal ground. Data may be disclosed to the following categories of recipients:

1. Internal recipients (structures of Sovereign Institute for Liberty & Justice)

Your data is accessible only to Sovereign Institute for Liberty & Justice staff and members who have a genuine need to know it:

  • • Coordinators: For evaluating applications and coordinating research projects.
  • • Internal departments: For integrating studies in legislative proposals, promoting the expertise of Sovereign Institute for Liberty & Justice members and issuing supporting documents.

2. Public authorities and supervisory bodies

Disclosure is made exclusively on the basis of a legal obligation or at their express request:

  • • ANSPDCP (National Supervisory Authority for Personal Data Processing): In the context of compliance audits.
  • • Courts and prosecution authorities: Where Sovereign Institute for Liberty & Justice must defend a right in court in connection with its activities.

3. Service providers and processors

Sovereign Institute for Liberty & Justice collaborates with third parties acting in accordance with our instructions (art. 28 GDPR):

  • • IT providers and site maintenance: Companies that provide hosting for the website https://sovereign-institute.com/, cybersecurity and technical maintenance services.
  • • Email marketing platforms: For sending newsletters to subscribers.

4. Transfer of data outside the European Economic Area (EEA)

Your data is generally processed within Romania or EEA member states. In situations where technology providers outside the EEA are used (e.g. communication or cloud storage platforms), we ensure that the transfer complies with art. 44 GDPR, relying on:

  • • Standard Contractual Clauses (SCCs) adopted by the European Commission.
  • • Adequacy decisions of the European Commission for the destination countries.
  • • Your explicit consent, following prior information about the risks.

VIII. RIGHTS OF DATA SUBJECTS

In accordance with the provisions of the General Data Protection Regulation (GDPR), as a data subject you benefit from a series of rights designed to give you control over your personal data. Sovereign Institute for Liberty & Justice is committed to facilitating the exercise of these rights in an efficient and transparent manner.

1. Right to information (art. 12, 13, 14)

You have the right to receive clear, transparent and easily accessible information about the processing. This right is satisfied by this Policy, which details the identity of the Controller, purposes, legal bases and storage periods.

2. Right of access (art. 15)

You have the right to obtain confirmation that your data is being processed by Sovereign Institute for Liberty & Justice and to request access to it, together with details about the purpose of processing and its recipients. The first copy of the data is provided free of charge. Manifestly unfounded, excessive or repetitive requests may not receive a response, or where they do receive one, it may be negative.

3. Right to rectification (art. 16)

You have the right to obtain the correction of inaccurate data (e.g. updating a CV or a telephone number) and the completion of incomplete data.

4. Right to erasure ("Right to be forgotten", art. 17)

You may request the erasure of data if it is no longer necessary for the purpose.

5. Right to restriction of processing (art. 18)

You have the right to obtain limitation of the use of data in specific cases.

6. Right to data portability (art. 20)

You have the right to receive data you have provided in a structured, machine-readable format, for transmission to another controller, where technically feasible.

7. Right to object (art. 21)

You may object at any time to the processing of your data, on grounds relating to your particular situation, where the processing is based on the legitimate interest of Sovereign Institute for Liberty & Justice (art. 6(1)(f) GDPR) or the performance of a task serving a public interest. Sovereign Institute for Liberty & Justice will cease processing, unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms.

8. Right not to be subject to a decision based solely on automated processing (art. 22)

You have the right not to be subject to a decision based solely on automated processing. We emphasise that the selection of experts, young professionals and interns within Sovereign Institute for Liberty & Justice is done through human evaluation, not automated algorithms.

9. Right to withdraw consent

For processing based on explicit consent (newsletter, expert/intern registration, use of photograph), you have the right to withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.

10. Right to lodge a complaint with the Supervisory Authority (art. 77)

If you consider that your rights have been infringed, you may contact ANSPDCP (B-dul G-ral. Gheorghe Magheru no. 28-30, Sector 1, Bucharest, email: anspdcp@dataprotection.ro, web: dataprotection.ro).

How to exercise these rights: Send a written, dated and signed request to the Data Protection Officer (DPO) at email: office@sovereign-institute.com. We will respond within a maximum of one month (with the possibility of extension to two months for complex requests).

To the extent that your request is unfounded or excessive, bearing in mind that these rights are not absolute, Sovereign Institute for Liberty & Justice may reject it, however we will inform you of the reasons for the refusal and of your right to lodge a complaint with the Supervisory Authority.

IX. SECURITY OF PROCESSING

Sovereign Institute for Liberty & Justice implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, pursuant to article 32 GDPR. These measures protect data against destruction, loss, alteration or unauthorised access, with data security being a periodically reviewed priority.

Technical security includes the use of the secure SSL/TLS protocol for the website https://sovereign-institute.com/, encryption of stored data, use of updated firewalls and antivirus solutions. We also implement periodic backup systems to ensure data availability and resilience in the event of any technical incident.

On the organisational front, access to data is strictly limited on the basis of the "need-to-know" principle. Sovereign Institute for Liberty & Justice staff and collaborators are trained on GDPR obligations and are subject to strict confidentiality clauses. We use pseudonymisation and anonymisation of data whenever possible.

Sovereign Institute for Liberty & Justice applies rigorous procedures for managing any personal data breaches. In the event of a risk to your rights, we will notify ANSPDCP within a maximum of 72 hours and will inform you without undue delay, pursuant to articles 33 and 34 GDPR.

X. COOKIES

These cookies are indispensable for the technical operation of the Platform and for accessing secured sections. The storage of login data or navigation preferences is carried out on your device exclusively to provide the requested service. Authentication through third-party services (where applicable) involves the storage and access of information on your device by those providers, in accordance with their own policies.

ePrivacy legal basis: The exception provided by art. 5(3) of the ePrivacy Directive and art. 4(5) of Law no. 506/2004 — strictly necessary cookies do not require consent, as they are indispensable for providing the service explicitly requested by the user.

Complementary GDPR legal basis: The legitimate interest of the Controller (art. 6(1)(f) GDPR) and the performance of steps taken at the request of the data subject (art. 6(1)(b) GDPR), as applicable.

These cookies enable: the functioning of navigation modules, archive search filters and quick searches in studies and publications; the functioning of contact, registration, application and donation forms; securing internal flows and protection against automated SPAM submissions (e.g. reCAPTCHA); storage and maintenance of cookie consent preferences. You cannot disable these cookies without affecting the functionality and security of the Platform.

XI. FINAL PROVISIONS

This Policy is applicable from 03.09.2026 and will be periodically reviewed. Any changes will be published on the Sovereign Institute for Liberty & Justice website. We encourage you to periodically check this page to stay informed of any updates to our data protection commitment.

By using the website https://sovereign-institute.com/ and by providing data through the forms on the site, you confirm that you have fully understood the processing conditions.

Our commitment is to ensure a framework of professionalism and maximum diligence in the handling of your personal data.

Sovereign Institute for Liberty & Justice