Privacy Policy
We treat adoption records with the highest level of confidentiality. This policy explains what we collect and why.
Last updated · May 18, 2026
These documents are shared by Heartline Romania’s website (heartlineromania.org) and Heartline Romania SkyDrive (cloud.heartlineromania.org).
1. Data We Collect
- Identity & contact data (name, email, phone, address).
- Case data you provide (birth records, adoption decrees, jurisdiction, agency, dates).
- Account & security data (hashed credentials, IP, device, audit logs).
- Communications with our team and partner agencies.
2. Purpose & Legal Basis
We process data to deliver search & reunification services. Legal bases under GDPR Art. 6 include consent (Art. 6(1)(a)), performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), and legitimate interests (Art. 6(1)(f)). Sensitive data is processed only with explicit consent under Art. 9(2)(a).
3. Sharing
We share data only with: your assigned case worker, partner agencies you authorize, government offices required for record retrieval, and processors bound by data-processing agreements. We never sell personal data.
4. International Transfers
Data is stored in the EU and the United States. Transfers from the EU to the US rely on Standard Contractual Clauses (Commission Decision 2021/914) and supplementary safeguards.
5. Retention Schedule
| Category | Period |
|---|---|
| Case records | Life of case + 10 years (Law 273/2004) |
| KYC / ID documents | 5 years |
| Audit logs | 7 years |
| Account profile | Until closure + 90 days |
| Financial records | 10 years |
| Marketing email opt-in | Until unsubscribe |
6. Children's Data
Adoption case files often relate to minors. We process such data under Art. 6(1)(c)/(e) (legal obligation / public-interest task under Romanian Law 272/2004 and Law 273/2004) combined with Art. 9(2)(g) (substantial public interest). The portal is intended for users 18+; minors cannot create accounts.
7. Your Rights & ANSPDCP Complaint
Under GDPR and applicable US state laws you have the right to:
- Access, rectify, or erase your data.
- Restrict or object to processing.
- Data portability.
- Withdraw consent at any time.
- Lodge a complaint with a supervisory authority (e.g. ANSPDCP in Romania).
8. Security
TLS 1.3 in transit, AES-256 at rest, row-level access control, tamper-evident audit logging, and least-privilege access for staff.
9. Cookies
We use strictly necessary cookies for authentication, security, and language preference. We do not use third-party advertising cookies.
10. Contact / Data Controller & DPO
Heart Line Romania — office@heartlineromania.org1207 Delaware Ave #1782, Wilmington, Delaware 19806, USAData Protection Officer: same address, subject 'DPO request'.
11. Lodge a Complaint (ANSPDCP)
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal — www.dataprotection.ro
SkyDrive supplement
This supplement applies to SkyDrive (cloud.heartlineromania.org). SkyDrive is zero-knowledge: files, file names and folder names are encrypted in your browser before upload, and Heartline Romania never receives your passphrase, recovery code or keys. Where this supplement differs from the sections above, it controls for SkyDrive.
What SkyDrive can and cannot see
SkyDrive does not collect case data in readable form. The contents of your files, their names and your folder names reach us only as encrypted data that we cannot decrypt. We hold:
- Account data: your name, email address and sign-in details (passwords are handled by our authentication provider and stored hashed).
- Vault data: your vault key, stored only in encrypted (wrapped) form that your passphrase or recovery code unlocks in your browser.
- Technical file data: encrypted size, number of chunks, dates, storage region and folder structure, needed to run the service and enforce storage limits.
- Share link settings (expiry, download limit, download count), plan and billing status, an activity log of account events, and IP addresses in our hosting provider’s logs.
Card details are entered on Stripe’s pages and never reach SkyDrive.
Processors
SkyDrive uses Netlify (hosting, sign-in, database and encrypted file storage), Stripe (payments) and Cloudflare (domain name service). They receive account and technical data only, never readable file contents.
Where SkyDrive data is stored
You choose where your encrypted files are stored: the EU (Frankfurt, Germany) or the US (Ohio). Account data and encrypted file metadata are processed in the United States for all users, under the transfer safeguards described above.
Retention and your rights on SkyDrive
Encrypted files are kept until you delete them or close your account. Deleted items stay in your Trash for the period your plan includes (7 to 180 days) and are then erased; earlier file versions are kept up to your plan’s limit. If your plan includes link access history, we keep the time and visitor country (never the IP address) of each use of your share links until the link is deleted. We can provide or erase the account data we hold, but we cannot provide a readable copy of your files: you download and decrypt them yourself with your passphrase.
Cookies on SkyDrive
SkyDrive uses a strictly necessary sign-in cookie. Your unlocked vault key stays in your browser’s memory only and is never stored in a cookie or sent to us.