This policy explains what personal data the BookTruck website processes, why, for how long and what your rights are, under the General Data Protection Regulation (EU) 2016/679 (GDPR).
The controller is Asociația Culturală Cărțile pe Față, tax ID 37845446, registered office at str. Bistriței nr. 11, Cluj-Napoca. For anything related to your data, write to us at salut@cartilepefata.ro.
Your first and last name, email address, the amount and frequency, the transaction details from EuPlătesc and, on a campaign, your message and whether you chose to donate anonymously. We use them to process the donation and the monthly payments (to carry out your request), to keep the accounting records required by law (legal obligation) and to answer you. Your card details are processed only by EuPlătesc; we never receive them.
On a campaign page, unless you choose to donate anonymously, we show your name, the amount, your message and your Gravatar profile picture, if you have one. To find it, your browser asks Gravatar for a picture by a code derived from your email address (a hash), not by the address itself. For anonymous donations Gravatar is never used. You can ask us at any time to hide your name or your message.
Name, email, phone, delivery address and, when you ask for an invoice on a company, the company’s details, to deliver the order and issue the invoice. Card payments for orders are processed by Stripe.
The details you fill in on the volunteering form (name, age, email, phone, availability, favourite books), sent by email to the volunteer coordinators so they can get in touch with you.
Your IP address, used briefly to limit repeated attempts (for donations, at most 10 every 10 minutes, after which the counter is deleted) and by Cloudflare Turnstile to tell people from automated scripts (legitimate interest in protecting the website).
Google Analytics sets cookies only after you agree in the cookie banner. Vercel Analytics and Speed Insights measure visits and page speed without cookies. Smartlook helps us understand how the website is used by recording how visitors move through its pages. Embedded YouTube videos and the Substack newsletter are loaded from those services.
Only with the providers that run the website for us, each for its own part: EuPlătesc and Stripe (payments), Oblio (invoices), Brevo (emails), Supabase (database and campaign files), Vercel (hosting and statistics), Cloudinary (images), Cloudflare (Turnstile), Google (Analytics, YouTube), Smartlook and Gravatar. Some of them process data outside the European Economic Area, under the safeguards the GDPR requires (for example, standard contractual clauses). We do not sell your data and do not use it for advertising.
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability and to withdraw your consent at any time, without affecting what was done before. Write to us at salut@cartilepefata.ro. You can also complain to the National Supervisory Authority for Personal Data Processing (dataprotection.ro).
We may update this policy; the version on this page applies, with the date of its last update. See also the terms and conditions.