Privacy Policy

Atomo Schola ("we," "us," or "the Controller") operates https://atomoschola.vercel.app (the "Site"). This policy explains what personal data we collect, why, how we use it, and the rights you have under EU and Romanian law.

1. Data Controller

The data controller responsible for your personal data is:

2. What Personal Data We Collect

We collect only the following categories of personal data:

• Email address : required to create an account and log in.
• Password : required to secure your account. Passwords are stored only in encrypted (hashed) form and are never stored or displayed as plain text.
• Username (optional) : if provided, may be displayed publicly on the Site.
• Name (optional) : if provided, may be displayed publicly on the Site.

We do not collect location data, payment data, browsing/tracking data, or data from third parties. We do not use tracking or advertising cookies (see Section 9).

3. Purpose and Legal Basis for Processing (Art. 6 GDPR)

You may withdraw your consent to the optional data at any time by removing it from your profile, without affecting the lawfulness of processing carried out before withdrawal.

We do not use your personal data for marketing, profiling, or automated decision-making, and we do not sell or rent your data.

4. Recipients of Data

We do not share, sell, or disclose your personal data to third parties, except:

• Hosting/infrastructure providers strictly necessary to operate the Site (acting as data processors under Art. 28 GDPR, bound by data processing agreements).
• Where required by Romanian or EU law, or in response to a valid request from a competent public authority.

5. International Data Transfers

Your data is stored on servers located within the European Economic Area (EEA) and is not transferred outside the EEA.

6. Data Retention

We retain your personal data only for as long as your account is active. If you delete your account by contacting the Administration Team, your email, password, username, and name are erased from our active systems within 30 days, except where a longer retention period is required by law (e.g., for accounting, security incident records, or to establish/defend legal claims).

7. Your Rights Under the GDPR

As a data subject, you have the right to:

• Access your personal data (Art. 15) : obtain confirmation and a copy of the data we hold about you.
• Rectification (Art. 16) : correct inaccurate or incomplete data, including via your account settings.
• Erasure ("right to be forgotten") (Art. 17) : request deletion of your data, including by deleting your account.
• Restriction of processing (Art. 18) : request that we limit how we use your data in certain circumstances.
• Data portability (Art. 20) : receive your data in a structured, commonly used, machine-readable format.
• Object to processing (Art. 21) : object to processing based on legitimate interest (not currently used) or withdraw consent for optional data.
• Not be subject to automated individual decision-making, including profiling (Art. 22) : not applicable, as we do not use automated decision-making.

To exercise any of these rights, contact us at atomoschola@gmail.com. We will respond within one month, as required by Art. 12(3) GDPR (extendable by two further months for complex requests, with notice).

8. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Romanian supervisory authority:

You may also lodge a complaint with the supervisory authority of your own EU member state of residence or the place of the alleged infringement.

9. Cookies

We use only strictly necessary cookies or equivalent technologies (e.g., a session/authentication token) required to keep you logged in. These do not require consent under Romanian Law No. 506/2004 on the processing of personal data in the electronic communications sector (transposing the ePrivacy Directive), as they are essential to the service you requested.

We do not use analytics, tracking, or advertising cookies.

10. Security Measures

In accordance with Art. 32 GDPR, we implement appropriate technical and organizational measures, including:

• Hashing/encryption of passwords.
• Access controls limiting who can view stored data.
• Reasonable safeguards against unauthorized access, loss, or disclosure.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify ANSPDCP within 72 hours (Art. 33 GDPR) and, where required, notify you directly (Art. 34 GDPR).

11. Children's Data

In accordance with Romanian Law No. 190/2018, the processing of personal data of children under 16 years old based on consent is only lawful with the consent of a parent or legal guardian. Creation of accounts on the Site is not intended for children under 16, and we do not knowingly collect data from them without such consent. If you believe a child has provided us with data without appropriate consent, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy to reflect legal, technical, or operational changes. The "Effective Date" above will be updated accordingly. Material changes will be communicated via the Site or by email where appropriate.

13. Contact Us

For any questions or to exercise your rights, contact us at: