Privacy Policy (Data Protection Declaration Pursuant To Art. 13 And 14 Gdpr)

Last update on: 29 April 2026

I. IDENTITY AND CONTACT DETAILS OF THE CONTROLLER

TIRIAC INTERNATIONAL FOUNDATION, (hereinafter referred to as the “Foundation” or the “Controller”), a predominantly private interest foundation (Stiftung) established under the laws of the Principality of Liechtenstein, registered with the Commercial Registry of Liechtenstein under number FL-0002.556.642-6, manages the websitewww.tiriacinternationalfoundation.com and connected subdomains (the “Website”) and acts as data controller. This Privacy Policy (“Policy”) details how the Foundation collects and processes your personal data, as well as your rights as a data subject and how they can be exercised, in accordance with Regulation (EU) No. 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”), as well as applicable national legislation. Please read the following information carefully, to understand our practices regarding the processing of your personal data and how we will treat them. For any information or requests regarding the processing of personal data or to exercise your rights as a data subject, please contact us by using the following contact details:

Postal address: Poststrasse 2, FL-9494 Schaan, Principality of Liechtenstein
Email address: privacy@tiriacfoundation.org

II. WHO IS THIS POLICY ADDRESSED TO

This Policy applies to visitors of the Website, the representatives and contact persons of foundations, associations or non-governmental non-profit entities, private sector entities or academic institutions, individuals, local or national governments and/or public administration bodies implementing projects with the financial support of the Foundation, the final beneficiaries and other participants in The Foundation’s programs and projects and their representatives, as well as to persons who contact us using the other contact methods provided by the Foundation.

III. SOURCE OF DATA

We collect your personal data either directly from you when you interact with our Website or when you contact us by post, telephone or email or when you otherwise provide us the personal data, or from the foundations, associations or non-governmental non-profit entities, private sector entities or academic institutions, individuals, local or national governments and/or public administration bodies when they are implementing projects with the financial support of the Foundation (hereinafter referred to as the “Partners”). To ensure that the data collected is accurate and up to date, please notify us of any changes to the personal information you have provided to us.

IV. PERSONAL DATA PROCESSED, PURPOSES, LEGAL GROUNDS AND DURATION FOR PROCESSING

We collect the personal data described below exclusively for the purposes and based on the legal grounds specified in this Policy and limited to the duration indicated below. If we intend to process this data for other purposes, we will inform you in advance, as appropriate, and take all necessary measures to comply with the provisions on the protection of personal data. Personal data is processed as follows: A. MANAGING YOUR QUESTIONS OR REQUESTS When you choose to contact us by post, email or phone, we will process your identification data (first name, last name), your contact details (address, email address, phone number) and details regarding your specific question or request. The legal basis in most cases is our legitimate interest in responding to enquiries, pursuant to Art. 6(1)(f) of the GDPR. Where consent is granted or where a contract is entered into between the Foundation and the data subject, the processing can be based on the respective consent, pursuant to Art. 6(1)(a) of the GDPR, respectively on the necessity to perform the agreement, pursuant to Art. 6(1)(b) of the GDPR. If there is an agreement in place, and the personal data would be necessary to perform such agreement, failure to provide the personal data could lead to the impossibility of performing the respective agreement. The personal data will be processed for the entire period of resolving your request, as well as for a period of 3 years from the date of the last interaction, both for statistical analysis and reporting purposes, and to defend ourselves in the event of disputes. B. STATISTICAL ANALYSIS AND OPERATION OF THE WEBSITE. USE OF COOKIES When you visit our Website, we will process personal data through cookies and other similar technologies, to automatically collect technical information, such as the IP address, the type of internet browser used for navigating our Website, your operating system, data regarding the visits on the Website. The main purpose is on the one hand, to ensure the proper functioning and operation of the Website (in the case of strictly necessary cookies), or on the other hand, to perform a statistical analysis of the manner in which our Website is used to allow us to improve the Website. With respect to the latter, we will only use statistical cookies to the extent you have agreed to their use. For more details, please refer to the Cookie Policy available at the following link and to the cookies consent banner that clearly explain the cookies used and their purposes.As for the data collected through cookies, they are stored for the duration defined in each case in the Cookies Policy section/the cookies consent banner. C. PUBLIC COMMUNICATION OF THE PROGRAMS AND PROJECTS SUPPORTED BY THE FOUNDATION When you are a final beneficiary or other participant or a representative thereof in the programs and projects financially supported by the Foundation, your photos or/and audio‑video materials disclosing your image and voice could be used by the Foundation, as data controller, to publicly communicate the programs, projects and activities financially supported, for publication through its Website and the social media pages administered by the Foundation, as well as in printed materials, as and if such will be used by the Foundation. The Foundation may process also process, for the above-mentioned purpose, information on your name, the quality in which you participate in the program, and your image and voice, through testimonials describing your experience in the program, which can be published as indicated above. For this purpose, we can also use the personal data you or your representatives provide to our Partners in the consent forms (such as first name, last name, address, signature) to verify and document the consent obtained. The legal basis of this processing activity is the consent pursuant to Art. 6(1)(a) of the GDPR) obtained by our Partners in view of the relationship between you and them. This personal data will be processed for a period of 3 years following the completion of the projects or until the withdrawal of such consent, whichever is sooner. D. INTERACTIONS ON THE SOCIAL MEDIA PAGES ADMINISTERED BY THE FOUNDATION If you interact with us through the social media pages administered by the Foundation, for example Facebook, Instagram, LinkedIn, as and if such will be used, we will mainly process your data that you have sent to us (username, profile photo, the action you took, the reaction or content of your comment, and any other information or details that you communicate to us by correspondence), for example when you post a comment under one of our publications on social media, press the Like button, reshare our post or send us a message on one of our pages, for the purpose of managing the interaction with you, as well as to resolve and respond to your questions or requests. Access to our official pages active on these social media platforms is made under the conditions set exclusively by the social media platforms, such as Facebook/Instagram/LinkedIn. Each social media platform has its own data privacy policy, to which you should refer to. If you have any questions about the use of your personal data by the respective platforms, or for information about the purpose or categories of personal data collected and processed by the respective social media platforms, or information about transfer of data by them, as well as about your rights and configuration options to protect your private space, please consult their privacy policies. Also, for the purpose of continuous functional optimization and maximum ease of use, some of our online services may use plugins to social media pages. You can recognize the plugins by the logos inserted on our Website. When you click on each logo, these companies are informed that you have accessed the social media platform from our Website. However, we would like to mention that access to our official pages active on these social media platforms is made under the conditions established exclusively by the respective social media platforms, so the use of your personal data through the use of the pages on these social networks is subject to the terms and conditions and privacy policies established by the respective companies, including with respect to transfer of personal data by them outside of the European Economic Area, over which the Foundation has no control or responsibility. For example, for more information on the privacy policies adopted by certain social media platforms, visit: (i) for Facebook – https://www.facebook.com/policy.php, (ii) for Instagram – https://help.instagram.com/155833707900388, (iii) for LinkedIn – https://www.linkedin.com/legal/privacy-policy. The legal basis for this processing activity in most cases is the legitimate interest of the Foundation to maintain a good relationship with the persons interested in our activity, allowing us to provide answers to your questions and requests, pursuant to Art. 6(1)(f) of the GDPR. Where consent is granted or where a contract is entered into between the Foundation and the data subject, the processing can be based on the respective consent, pursuant to Art. 6(1)(a) of the GDPR, respectively on the necessity to perform the agreement, pursuant to Art. 6(1)(b) of the GDPR. If there is an agreement in place, and the personal data would be necessary to perform such agreement, failure to provide the personal data could lead to the impossibility of performing the respective agreement. The personal data will be processed for the duration of existence of the social media page administered by the Foundation. E. AUDIT AND VERIFICATION IN RELATION TO OUR PARTNERS When our Partners are granted with financial support from the Foundation, the Foundation may conduct audits or verifications on the relationship with the Partners, and in this context may receive or access information or documentation in this respect, which may contain certain personal data of the final beneficiaries and other participants in the programs and projects and their representatives. In certain limited cases, these activities can determine processing of personal data by the Foundation, such as name, surname, address, contact details, photos, signature, activities performed. The legal basis for this processing activity is the legitimate interest of the Foundation to audit compliance and the proper use of the funds granted to our Partners, pursuant to Art. 6(1)(f) of the GDPR. This personal data will be processed for the duration of the relationship with the Partners, as well as for a period of 10 years starting from the end of the business year in which the last entries were made, the respective supporting documents were created and/or the respective the business documents were received or sent, in what concerns business correspondence, transfer accounts and other accounting documents, to the extent the applicable legislation does not provide for a different storage term. F. STATISTICS AND AGGREGATE REPORTS. CENTRALISING OPERATIONS AND MAINTAINING AN INTERNAL DATABASE The Foundation can process personal data deriving from the supported programs and projects for the purpose of performing statistics and aggregate reports aimed at developing and improving our activities, centralising operations and maintaining an internal database. The legal basis for this processing activity is the legitimate interest of the Foundation to ensure proper management of the activity, to analyse the activity and to keep an internal database for future references, pursuant to Art. 6(1)(f) of the GDPR. The personal data will be processed for this purpose for the duration necessary to prepare the statistics and reports, but no more than 1 year. G. ENSURING THE SECURITY OF THE SYSTEMS, NETWORKS AND EQUIPMENT USED, AND THEIR MAINTENANCE The Foundation undertakes steps to ensure security of the systems, networks and equipment used, and to ensure their maintenance and to this end, personal data could be processed on a need-to-know basis. The legal basis for this processing activity is the legitimate interest of the Foundation to ensure the security and proper functioning of systems, equipment and networks, pursuant to Art. 6(1)(f) of the GDPR. The personal data will be processed for the duration necessary to perform the required verification and to take necessary steps. H. DEFENCE, EXERCISE OR ESTABLISHMENT OF RIGHTS, AND RESOLUTION OF DISPUTES The Foundation could process personal data necessary for the purpose of defending, exercising or establishing its rights and to resolve disputes. The legal basis for processing is our legitimate interest in requesting the establishment of rights, exercising or defending our rights, in accordance with Article 6(1)(f) of the GDPR. The personal data shall be processed for the duration necessary to defend, exercise or establish its rights and to resolve disputes, including for 3 years from our last interaction/the settlement of the dispute. I. COMPLIANCE WITH OUR LEGAL OBLIGATIONS The Foundation can process personal data if necessary for compliance with our legal obligations (e.g. obligations under tax law, archiving obligations, data protection obligations, know your customer, etc.), including reporting to certain institutions and/or public authorities. The legal basis for processing in such case is the fulfilment of our legal obligations under Article 6(1)(c) of the GDPR. The personal data will be stored for the period provided by applicable law, where the law provides for such a period, or for a period of 3 years necessary to protect the rights of the Foundation.

V. DATA RECIPIENTS

Personal data may be disclosed, strictly to the extent necessary for the purposes detailed above or in cases where this is required by law or where we have a legitimate interest, to the following categories of recipients who may be independent controllers or data processors, as follows:

Service providers
1. consulting services;
2. accounting services;
3. personal data protection services;
4. IT systems development, technical support and maintenance services;
5. cyber security services;
6. electronic communication services;
7. archiving services;
8. audit services;
9. software solutions, platforms or other IT systems, such as those designed to manage information collected through websites etc.;
10. banks performing the payment operations to the Partners;
11. social media platforms, to the extent they are used;
12. external consultants whom we contact in specific situations (e.g. lawyers, consultants, experts);
Public authorities and bodies, namely investigative bodies and courts of law or institutions with powers to carry out inspections and controls on the controller’s activity and assets, to the extent that the transfer of data to them is required by law and/or is necessary in the event of a dispute or dispute resolution, as well as in the event of controls where we are required to make them available;
Persons expressly indicated by you;
Third-party acquirers, to the extent that our activity would be transferred (in whole or in part) and the data of the data subjects would be inherently linked to the assets that are the subject of such a transaction.

The personal data we are disclosing to our service providers is limited to the minimum personal data information which is necessary to perform the respective services. We make every effort to ensure that all the entities we are working with are storing your personal data in safe and secure conditions.

VI. TRANSFERS OF PERSONAL DATA

As a rule, we will not transfer your personal data outside the European Economic Area. In exceptional circumstances and only if necessary, the transfer of your personal data outside the European Economic Area will only be made with the application of appropriate safeguards in accordance with the specific legal provisions on the protection of personal data and with your appropriate information.

VII. STORAGE OF YOUR PERSONAL DATA

The personal data indicated in the sections above will be processed only for the period necessary to fulfil the purposes mentioned in this Policy, as mentioned in section IV above. After that, we will remove or delete your personal data from our systems and records and/or take steps to anonymise it so that you can no longer be identified. We will also take all reasonable steps to ensure that personal data transmitted to third parties or made public for the purposes mentioned above is deleted. The storage periods mentioned above may be changed if it is necessary to protect our legitimate interests or if there are changes in the legal storage obligations. In such cases, we will act in accordance with the law, including with regard to informing you. The Foundation constantly evaluates and upgrades the security measures implemented as to ensure a secure and safe personal data processing.

VIII. YOUR RIGHTS REGARDING PERSONAL DATA

1. The right to be informed, in accordance with Articles 13 and 14 of the GDPR, as set out in this document.
2. The right of access, to obtain certain information about how we process your personal data and a copy of such data, in accordance with Article 15 of the GDPR.
3. The right to rectification of inaccurate personal data, and the supplementation of incomplete data, in accordance with Article 16 of the GDPR.
4. The right to erasure/right to be forgotten, in case (i) the data are no longer needed for their original purpose (and no new lawful purpose exists), (ii) the lawful basis for the processing is the data subject’s consent, the data subject withdraws that consent, and no other lawful ground exists, (iii) the data subject exercises the right to object and the Controller has no overriding grounds for continuing the processing, (iv) the data have been processed unlawfully, (v) erasure is necessary for compliance with the applicable law, or (vi) the data were collected in connection with the informational society services offered to children (if the case), where specific requirements regarding consent are applicable, pursuant to Article 17 of the GDPR.
5. Right to restriction of processing, in cases where: (i) you consider that the processed personal data are inaccurate, for a period enabling the Controller to verify the accuracy of the personal data; (ii) the processing is unlawful, however you do not want us to erase your personal data, but to restrict the use of data; (iii) in case the data Controller no longer needs your personal data for the above-mentioned purposes, but you are requiring the data for establishing, exercising or defending a legal claim or (iv) you have objected to processing pending the verification whether the legitimate grounds of the data Controller override those of the data subject, pursuant to Article 18 of the GDPR.
6. Right to data portability, meaning the right to receive your personal data, which you provided to the data controller in a structured, commonly used and machine-readable format and the right to transfer those data to another controller, if the processing is based on your consent or the performance of a contract and is undertaken by using automatic means, according to Art. 20 of the GDPR.
7. Right to object to the data processing on grounds relating to your particular situation, when the processing is based on legitimate interest and to object at any moment to the data processing for direct marketing purposes, including profiling, according to Art. 21 of the GDPR.

When you send us a request to exercise this right, please also mention the reasons related to your particular situation, if required. We will no longer process your personal data unless we demonstrate (i) that we have legitimate and compelling reasons for processing that override your interests, rights and freedoms, or (ii) that the purpose of the processing is to establish, exercise or defend a right in court.

1. The right to withdraw your consent, in accordance with Art. 7 of the GDPR. This right applies if your personal data is processed on the basis of your consent, in which case you may withdraw your consent at any time using the contact details provided above.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

The right not to be subject to a decision based solely on automated processing, including profiling, in accordance with Article 22 of the GDPR. The personal data referred to in this Policy is not subject to automated decision-making processes, including profiling. Please note that these rights are not absolute, which means that there are certain exceptions to their exercise. These rights are applicable on a case-by-case basis.
The right to lodge a complaint with the supervisory authority. Without prejudice to your right to contact the supervisory authority at any time, we encourage you to contact us in advance regarding the exercise of the above rights.

If you believe that we have not resolved all your requests or you are not satisfied with our responses, you can contact the supervisory authority to lodge a complaint using the following contact details:

Data Protection Authority, Kirchstrasse 8, 9490 Vaduz, Principality of Liechtenstein
Tel: +423 236 6090
Email: info.dss@llv.li
Website: https://www.datenschutzstelle.li

National Supervisory Authority for Personal Data Processing, Street 28-30 Gheorghe Magheru, 1^st District, postal code 010336, Bucharest, Romania, for Romanian data subjects.
Tel: +40.318.059.211; +40.318.059.212
Email: anspdcp@dataprotection.ro
Website: https://www.dataprotection.ro/

or you can file a complaint with the competent court.