for the contact points and joint activities of ARMA and ARMADATA S.R.L.
1. Relationship between this notice and ARMA’s policy
This notice supplements the Data Protection Policy published by the Romanian Association for Audience Measurement (“ARMA”) on its website. The ARMA Policy remains the primary document governing data processing specific to the association’s activities carried out exclusively by ARMA, including member relations management, voting procedures, the Association’s legal formalities, its own contractual relationships, and other association activities described in the ARMA Policy.
This notice applies only in those situations where ARMA and ARMADATA S.R.L. (“ARMADATA”) use common points of contact, operational resources, or personnel and jointly determine the essential purposes and/or means of certain personal data processing operations, or when, upon initial contact, it is unclear whether the relevant relationship is exclusively associative, commercial, or mixed.
For data flows relating exclusively to ARMADATA’s commercial activities, ARMADATA acts as a separate controller, and its specific information applies accordingly.
2. Who We Are
The Romanian Association for Audience Measurement (“ARMA”) is a non-profit legal entity. ARMADATA S.R.L. (“ARMADATA”) is a commercial company owned by ARMA. In certain situations, the two entities use the same mailing address, the same operational email addresses, and the same operational/administrative staff.
For this reason, certain points of contact and activities are carried out jointly. For these joint data flows, ARMA and ARMADATA may act as joint controllers within the meaning of Article 26 of the GDPR.
3. Our shared contact information
• shared mailing address: Bucharest, 3A Promoroacă St., 3rd floor, Sector 1, Bucharest;
• shared email address / point of contact: contact@arma.org.ro;
• other shared channels used, as applicable: phone, contact forms, event invitations, email signatures of shared staff.
4. In what situations do we jointly process your data
ARMA and ARMADATA may jointly process your data, in particular, in the following situations:
• when you submit a request to us through a shared channel and we need to determine whether your relationship is exclusively associative, commercial, or mixed;
• when we use the same contact information and the same staff to receive, assess, and manage your requests;
• when we jointly organize or conduct meetings, workshops, seminars, webinars, conferences, courses, gatherings, or other events;
• when we jointly manage a contact database or interaction history, to the extent that these exist and are used by both entities for common purposes;
• in any other situations where we expressly inform you that the processing is carried out jointly by ARMA and ARMADATA.
5. What types of data can we process in these joint data flows
• identification and contact data: first name, last name, title, company, workplace, email address, phone number;
• data from correspondence and interactions: message content, requests, responses, communication history, operational notes related to the request;
• data related to event participation: registration, attendance, role (e.g., speaker, moderator, participant), signature, materials sent or received;
• technical data generated by the use of digital services: IP address, browser type, operating system, session data, logs, and other technical identifiers limited to what is necessary for the service used;
• image and voice when you participate in teleconferences, photographs, videos, or recordings, provided that the applicable legal conditions are met.
6. For what purposes and on what legal grounds do we process data
• to receive, analyze, route, and respond to your requests—based on the legitimate interest in communicating effectively and identifying the relevant entity;
• to organize and conduct joint activities and events—based on legitimate interest and, where applicable, the performance of pre-contractual/contractual obligations or a legal obligation;
• to manage joint professional relationships with representatives of companies and other entities—based on legitimate interest;
• for photography, filming, audio-video recording, and the publication of images/voices – based on consent, when required by law or our procedures;
• to fulfill legal obligations, defend our rights, and manage incidents, requests, or disputes related to shared data flows—based on legal obligation and/or legitimate interest, as applicable.
7. How we share primary responsibilities
Responsibilities between ARMA and ARMADATA are shared transparently, without affecting your right to exercise your rights against either entity.
• ARMA generally publishes on its website the policy specific to its association activities and this joint notice;
• ARMADATA collaborates with ARMA to update this note and, where appropriate, publishes it or makes it available through its own relevant channels;
• The shared contact channels are managed operationally by shared staff, and requests are directed internally to the relevant entity or workflow;
• For requests regarding the rights of data subjects, the Parties collaborate to identify the relevant workflow and formulate the response;
• If a joint event or activity involves digital systems, recordings, or other technical setups, ARMA and ARMADATA determine in advance who configures the system, who activates the recording, who retains the files, and who approves subsequent communications;
• To the extent that ARMADATA manages the shared IT infrastructure or certain licenses/platforms used in joint workflows, it is responsible for the technical measures related to the infrastructure it manages; ARMA is primarily responsible for the functional context of the joint activities and the operational rules associated with them.
8. To whom we may disclose your data
We may disclose your data to service providers used in shared workflows, including providers of IT services, audio-video teleconferencing, electronic signatures, secure document transmission, transcription, and, in certain cases, generative artificial intelligence tools with minimal/limited risk, used in a controlled manner and proportionate to the intended purpose.
We may also disclose data to authorities, courts, consultants, auditors, or other recipients when there is a legal obligation to do so, when it is necessary to defend our rights, or when the law expressly permits such disclosure.
9. Data Transfers Abroad
Some services used in our standard workflows may involve providers established in other EU/EEA countries and, where applicable, infrastructure or sub-processing with international elements. In such situations, we ensure that there is an appropriate legal basis for the transfer and that GDPR requirements are met.
10. How long we retain data
• Data from shared correspondence is retained for the duration of the matter and, as a rule, for up to 3 years from collection, unless there is a legal obligation or a dispute that justifies a longer retention period;
• Data related to joint events is retained for the period necessary for their organization, conduct, and follow-up, and thereafter in accordance with the internal rules applicable to that category of activity;
• Data processed on the basis of consent, such as images and voice recordings, are retained until consent is withdrawn or until the communicated retention period expires, whichever occurs first, unless there is another legal basis for retention;
• For data flows that, after the initial contact, become exclusively associative or exclusively commercial, the retention periods set forth in the relevant entity’s policy or specific notice apply.
11. Your Rights
Under the terms of the GDPR, you have the right to access, rectify, erase, restrict processing, object, withdraw consent, and data portability, as well as the right to file a complaint with the ANSPDCP and to bring a matter before the competent courts.
You may exercise your rights with ARMA or ARMADATA. If the request concerns a shared data flow, we will coordinate the response internally without asking you to identify the “correct” entity yourself.
12. How to Contact Us
For questions regarding this notice or to exercise your rights, you can write to us at contact@arma.org.ro or at the shared mailing address mentioned above.
13. Important Note
This notice does not replace ARMA’s Data Protection Policy or any specific information provided by ARMADATA regarding its own commercial activities. It supplements the aforementioned documents for those situations where points of contact, personnel, and certain activities are shared or overlap.
14. Date of update
Rev. June 22, 2026