Privacy Notice

Who are we? 

UNHCR is an agency of the United Nations whose mandate is to protect, assist and find solutions for forcibly displaced persons and stateless people. More specifically, UNHCR in Romania and our partners work together to promote access by refugees and asylum-seekers to territory and a protection status, as well as basic rights and services in Romania, including through legal information on their rights to asylum and international and temporary protection. 

Under international law, UNHCR enjoys the privileges and immunities necessary to perform its functions independently. This means that national legislation related to data protection and privacy, such as the EU General Data Protection Regulation, does not apply to UNHCR.  

To ensure the protection of the dignity and fundamental rights of the people whom we work with and for, UNHCR has established a comprehensive framework for the collection, use, and sharing of their personal data. This framework consists of two key policies: the UNHCR General Policy on Data Protection and Privacy (2022) and the Policy on the Protection of Personal Data of Persons of Concern to UNHCR (2015). 

This privacy notice explains how UNHCR in Romania uses the personal data collected from you and your rights relating to the use of your personal data. 

Why are we processing your information? 

UNHCR currently provides limited direct protection services to forcibly displaced or stateless persons in Romania, mainly through our RomExpo community centre in Bucharest. Where necessary, UNHCR may process your personal data on an ad hoc basis for the following limited purposes: 

• Responding to enquiries and requests for protection interventions addressed to UNHCR; 

• Making referrals to government authorities, UN agencies, or partner organizations, where appropriate and requested; 

• Facilitating participation in UNHCR organized activities, services, and programmes; 

• Following up on or handling data subject requests related to past UNHCR activities, including assistance previously provided; 

• Meeting accountability, audit, oversight, and archival requirements. 

In short, we process your personal data only when it is necessary to carry out our international protection and solution mandate. When we process your personal data for accountability, audit, oversight or other obligations, we will only do so when it does not override your rights and freedoms. 

UNHCR does not carry out continuous registration, case management, or assistance delivery activities in Romania. 

UNHCR’s NGO partners may process your personal data when providing you with direct services. They are bound by national data protection laws and regulations. For further information about how they use your personal data and your rights under the applicable national laws, please contact the relevant NGOs directly.  

What personal data do we keep? 

For the abovementioned purposes and where necessary, UNHCR Romania may process the following types of personal data: 

• Basic biographical data (such as name, date of birth, nationality); 

• Contact details (where provided); 

• Information relevant to an enquiry or referral; 

• Historical assistance records related to past UNHCR cash assistance and core relief item programmes in Romania. 

How long do we keep your personal data? 

Your personal data will be retained by UNHCR only for as long as necessary to fulfil the specific purpose that we collected the data for. The retention period varies depending on the specific purpose. For example, your personal data may be retained for six years for audit purposes. Records of historical value may be retained for longer for  archive purposes. Access to personal data is restricted to authorized UNHCR personnel [please see below regarding potential sharing of your data] . 

Special note on biometric data (fingerprints) collected for UNHCR’s cash assistance programme between 2022–2024 
If you enrolled in the UNHCR cash assistance programme in Romania between 2022 and 2024, please be informed that your biometric data (i.e. fingerprints), which was collected for identity verification purposes has now been deleted. 

Your biometric data may have been retained by UNHCR only in the rare situation when:  

• You have subsequently moved to another country, and 

• You have enrolled/registered with UNHCR in that country where the Biometric Identity Management System (BIMS) is in use. 

Your biographical data and assistance records related to past cash assistance or other UNHCR activities in Romania are retained only for audit, accountability, and archival purposes, in line with UNHCR retention standards. 

For further information about the deletion of your biometric data (fingerprints), please consult this [FAQ page].  

How do we keep your personal data safe? 

We process your personal data only in secure UNHCR information management systems which have appropriate cyber security features. 

We have also put in place organizational and technical measures to ensure your personal data is safe with us, including access controls, confidentiality obligations for staff, and other technical security features designed to prevent unauthorized access, loss, or misuse of personal data. 

Do we share your personal data with third party and who? 

UNHCR will not share your personal data with authorities of your country of origin. However, if it is relevant to your situation, your personal data may be shared with our partner NGOs and/or the relevant government authorities in Romania in order to advocate for your rights and access to essential services. In this case, information we share will be strictly limited to what is necessary for accessing such services. The data sharing agreements that we have with our partners guarantee that your personal data will not be shared onward unless it is done in compliance with applicable data protection policies and regulations, which bind our partners. UNHCR will inform you if your personal data is shared with any of these third parties, the reason for the data sharing, and what you can reasonably expect UNCHR to do in your case. 

What are your rights? 

You have the right to be informed by UNHCR about the following: (i) what data we have about you, (ii) how your data is used, (iii) which Partner, if any, processes your personal data on behalf of UNHCR, (iv) where your data is stored, (v) which data may be shared with others and with whom.  

You can request confirmation from UNHCR of the personal data that we hold about you, and the absence thereof, and to access your personal data being processed by UNHCR.  

You have the right to object to UNHCR’s processing of your data because of your specific situation.  

You also have the right to request for correction of any incorrect, inaccurate or incomplete data about you, and request for deletion of your personal data if you believe that UNHCR no longer has any purpose or legitimate basis to keep it.    

Please note that your requests will be subject to review in line with UNHCR’s data protection policies.  

Should you have any concerns, questions or complaints regarding the processing of your personal data by UNHCR, you can contact UNHCR Romania via the following  channels. 

• Online: Feedback and Complaint Form 

• Email: [email protected]   

• Phone:   +40 723 653 651 

Please be aware that certain personal data may be necessary for UNHCR to respond to enquiries or ensure accountability. Objecting to the use of your personal data may therefore affect UNHCR’s ability to respond to your request. 

Please pay attention: 

UNHCR may update this privacy notice from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. 

When we make changes to this privacy notice, we may notify you by: 

• Posting the updated notice on our website; 

• Including a notice in our regular communications. 

We encourage you to review this privacy notice periodically.