Privacy & Cookie Policy

Last updated: {{DATA_PUBLICARE}}
This policy applies to the website osmdentis.ro and to the registration and participation process for the OSMDentis 2026 congress.

1. Who we are

The controller of your personal data is {{DENUMIRE_ENTITATE_JURIDICA}}, with its registered office at {{ADRESA_SEDIU}}, registered under {{CUI_SAU_COD_INREGISTRARE}} (“OSMDentis”, “we”, “us”).

“Controller” means we decide what personal data is collected about you and why. If you have any question about this policy or about how we handle your data, contact us at {{EMAIL_CONTACT}}.

{{DPO_DACA_EXISTA: Our Data Protection Officer can be reached at ... / delete this paragraph if no DPO has been appointed}}

2. What personal data we collect

We only collect data you give us, plus a limited amount of technical data generated automatically when you use the site.

Data you provide when you create an account and register

• Identification data: first name, last name, email address, phone number.
• Personal numeric code (CNP): see section 4 below, which is dedicated to this.
• Academic and professional data: university, faculty, specialisation, year of study, or your status as a medical resident, together with the supporting document you upload.
• Supporting documents: the file you upload to prove your student or resident status (for example a student card or a certificate from your institution).
• Account data: username, password (stored only as a cryptographic hash — we never see or store your password in readable form), and the activation status of your account.

Data related to your order

• The participation package and any workshops or courses you choose.
• Billing details and order history.
• Payment status and the transaction identifier received from our payment processor. We do not receive or store your card number — card data is entered directly on the payment processor's page.

Data collected automatically

• IP address, browser type and version, operating system, device type and screen resolution.
• Pages visited, time spent on them, and the page that referred you to us.
• Cookies and similar technologies, as described in section 9.

3. Why we use your data, and on what legal basis

Under the GDPR we must have a valid legal basis for each use of your data. Here is exactly what we do and why we are allowed to do it.

What we do	Data used	Legal basis
Create and manage your account	Identification data, account data	Performance of a contract (Art. 6(1)(b) GDPR) — we cannot give you an account without it
Verify that you are eligible for the student or resident rate	Academic data, supporting document, CNP	Performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing fraudulent use of reduced rates (Art. 6(1)(f) GDPR)
Process your order and your payment	Order data, billing data, transaction identifier	Performance of a contract (Art. 6(1)(b) GDPR)
Send you transactional emails (account activation, order confirmation, practical information about the congress)	Email address, name, order data	Performance of a contract (Art. 6(1)(b) GDPR)
Issue invoices and keep accounting records	Billing data, order data	Legal obligation (Art. 6(1)(c) GDPR) under Romanian accounting and tax law
Manage participant lists, badges and attendance at the venue	Name, academic data, package purchased	Performance of a contract (Art. 6(1)(b) GDPR)
Keep the site secure and prevent abuse	IP address, technical data, strictly necessary cookies	Legitimate interest (Art. 6(1)(f) GDPR)
Measure how the site is used, in aggregate	Analytics cookies, technical data	Your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time
Send you news about future editions, if you ask for it	Email address, name	Your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time
Defend ourselves in a dispute, if one arises	Any data relevant to the dispute	Legitimate interest (Art. 6(1)(f) GDPR)

Where we rely on your consent, giving it is entirely optional and refusing it has no effect on your registration. Where we rely on a contract or a legal obligation, we cannot complete your registration without the data, and that is why those fields are mandatory.

4. The personal numeric code (CNP)

We ask for your CNP in order to {{MOTIVUL_REAL_PENTRU_CNP: state the actual, specific reason — for example issuing EMC/CME professional education credits, which requires the CNP to be reported to the professional body, or a legal reporting requirement. If there is no such requirement, this field should be removed from the form rather than justified here.}}

Specifically:

• The legal basis for processing your CNP is {{BAZA_LEGALA_CNP: legal obligation under Art. 6(1)(c) GDPR, citing the specific legislation / or consent under Art. 6(1)(a)}}.
• Your CNP is visible only to the small number of authorised members of the organising team who need it for that purpose.
• We do not use your CNP for any other purpose, and we do not disclose it to anyone other than {{DESTINATARI_CNP: the recipients named here, for example the professional body that issues the credits}}.
• Your CNP is deleted after {{PERIOADA_RETENTIE_CNP}}.

5. Who else sees your data

We do not sell your data and we do not share it for anyone else's marketing. We do use a small number of service providers who process data strictly on our instructions, under a data processing agreement:

• Hosting: Hetzner Online GmbH (Germany) — our servers, and therefore the whole database, are hosted there.
• Payment processing: Netopia Payments (Romania) — receives the data needed to take your payment. Card details are entered on Netopia's own page and never pass through our site.
• Email delivery: MailerSend (part of Smartsend Oy / MailerSend UAB) — delivers transactional emails. It processes your email address and the content of the message.
• Network and security: Cloudflare, Inc. — routes traffic to our site and filters abusive requests, processing your IP address and request data.
• Analytics: Google Analytics (Google Ireland Limited) — only if you have accepted analytics cookies.
• {{ALTI_FURNIZORI: any other provider you use — for example the invoicing platform or a cloud backup service}}

We may also disclose data to public authorities where we are legally required to, and to our professional advisers (accountants, lawyers) where necessary.

6. Transfers outside the European Economic Area

Most of our providers process data inside the EEA. Where a provider processes data outside it — which is the case for Cloudflare and Google — the transfer is covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You may ask us for a copy of the safeguards in place.

7. How long we keep your data

• Account data: for as long as your account exists, and for {{PERIOADA_RETENTIE_CONT}} after you ask us to delete it or after your last activity.
• Supporting documents (student or resident proof): {{PERIOADA_RETENTIE_DOCUMENTE}} after the congress, after which they are deleted.
• Invoices and accounting records: 10 years, as required by Romanian accounting law. We cannot delete these on request.
• Participation and attendance records: {{PERIOADA_RETENTIE_PARTICIPARE}}.
• CNP: {{PERIOADA_RETENTIE_CNP}}.
• Server and security logs: up to 12 months.
• Marketing consent: until you withdraw it.

8. Your rights

Under the GDPR you have the following rights, which you can exercise free of charge by writing to {{EMAIL_CONTACT}}. We will respond within one month.

• Access — ask us for a copy of the data we hold about you.
• Rectification — have inaccurate data corrected. Most of it you can edit yourself in your account.
• Erasure — ask us to delete your data, where we have no legal obligation or overriding reason to keep it.
• Restriction — ask us to pause the processing while a complaint or correction is being resolved.
• Portability — receive the data you gave us in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — at any time, for anything we do on the basis of consent. This does not affect what we lawfully did before you withdrew it.

We do not make decisions about you by purely automated means, and we do not profile you.

If you believe we have handled your data unlawfully, you may lodge a complaint with the Romanian supervisory authority:

You also have the right to an effective judicial remedy before the competent courts.

9. Cookies

A cookie is a small text file placed on your device when you visit a website. We use them in three groups.

Strictly necessary cookies

These make the site work and cannot be switched off. They keep you logged in, remember what is in your cart, protect forms against cross-site request forgery, and record your cookie choices. They are placed on the basis of our legitimate interest and do not require your consent.

Functional cookies

These remember preferences such as your language or display settings. Without them the site still works, but less conveniently.

Analytics cookies

These help us understand, in aggregate, which pages are useful and where people get stuck. We use Google Analytics for this. They are only set if you accept them.

You can change your choice at any time from the cookie settings link in the site footer. You can also block or delete cookies in your browser settings, though blocking strictly necessary cookies will stop login and checkout from working.

We do not use advertising cookies and we do not share cookie data with advertising networks.

10. How we protect your data

• All traffic to and from the site is encrypted with TLS (HTTPS).
• Passwords are stored only as salted cryptographic hashes.
• The database is not reachable from the internet; access is restricted to the application server.
• Administrative access is limited to the members of the organising team who need it, over authenticated connections.
• Backups are taken regularly and stored encrypted.
• Server software is kept up to date with security patches.

No system can be guaranteed absolutely secure, but if a breach occurs that is likely to put your rights at risk, we will notify the ANSPDCP within 72 hours and inform you without undue delay.

11. Children

The site is intended for students and professionals in dentistry and medicine, and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a minor has given us their data, write to us and we will delete it.

12. Changes to this policy

We may update this policy, for instance when we add a service or change a provider. The date at the top always shows the current version. If a change materially affects your rights, we will notify you by email or with a notice on the site before it takes effect.

13. Contact

For any question about this policy or about your personal data:

{{DENUMIRE_ENTITATE_JURIDICA}}
{{ADRESA_SEDIU}}
Email: {{EMAIL_CONTACT}}{{TELEFON_CONTACT_OPTIONAL}}