Legal

Privacy Policy

Last updated: 31 October 2026

Asociația Bucharest Real Estate Club (“BREC”, “we”, “us”) respects your privacy. This policy explains what personal data we collect through brec.ro and in connection with our membership and events, why we use it, and what rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Romanian Law no. 190/2018.

1. Who is responsible for your data

The data controller is Asociația Bucharest Real Estate Club, fiscal code (CIF) 38528632, with its office at ONE Tower @ One Floreasca City, 159 Calea Floreasca, 6th Floor, District 1, Bucharest, Romania. For any question about this policy or your data, write to bucharest@brec.ro.

2. What data we collect

  • Contact and enquiry data – your name, email address and message when you use our contact form or write to us, including membership and partnership enquiries (where you share them, also your company, job title and phone number).
  • Membership data – contact details of member companies and their representatives, and the information needed to manage the membership and invoicing.
  • Event data – registration details for our roundtables, forums and other events, and photos or video recorded at our events.
  • Technical data – your IP address, browser type and the pages you request, recorded in our server and security logs when you visit the website.

We do not use analytics or advertising trackers on this website, and the fonts are served from our own server. Optional cookies are used only with your consent, which you can change at any time from “Cookie settings” at the bottom of every page. Details are in our Cookie Policy.

3. Why we use your data and on what legal basis

  • To answer your messages and enquiries – our legitimate interest in replying to you, or steps taken at your request before entering into a membership or partnership (Art. 6(1)(f) and (b) GDPR).
  • To provide and administer membership – performance of the membership agreement (Art. 6(1)(b) GDPR).
  • To organise events, manage registrations and send practical information about them – performance of the registration and our legitimate interest in running the event (Art. 6(1)(b) and (f) GDPR).
  • To publish event photos and video in our galleries, articles and social media – our legitimate interest in reporting on and promoting our events (Art. 6(1)(f) GDPR). You can object at any time and ask us to remove an image of you.
  • To keep the website secure and filter spam – our legitimate interest in protecting the website and its users (Art. 6(1)(f) GDPR).
  • To meet legal obligations, for example accounting and tax rules (Art. 6(1)(c) GDPR).

Where we ask for your consent (for example, to send you newsletters or event invitations), you can withdraw it at any time; this does not affect processing carried out before the withdrawal.

4. Who receives your data

We do not sell personal data. We share it only with service providers that help us run the website and our activities, under contracts that require them to protect it:

  • our website hosting and email providers;
  • Akismet (Automattic Inc.), which checks contact-form messages for spam;
  • Google (YouTube), only if a page contains an embedded video and you have accepted YouTube cookies;
  • event venues and co-organisers, only to the extent needed to run an event you registered for;
  • public authorities, where the law requires it.

5. Transfers outside the EU

Some providers (such as Automattic, and Google if you accept YouTube cookies) may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.

6. How long we keep your data

We keep personal data only as long as needed for the purpose it was collected for: enquiries for as long as the conversation requires and a reasonable period afterwards; membership data for the duration of the membership and afterwards for the periods required by accounting and tax law; event photos as part of our event archive unless you ask us to remove them; and technical logs for a limited period needed for security.

7. Your rights

You have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent where processing is based on consent. To exercise these rights, write to bucharest@brec.ro; we will answer within one month.

You also have the right to lodge a complaint with the Romanian data protection authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro.

8. Security

We use appropriate technical and organisational measures to protect personal data, including an encrypted (HTTPS) connection, access controls and security monitoring of the website.

9. Children

Our website and services are intended for professionals and are not directed at children under 16. We do not knowingly collect their data.

10. Changes to this policy

We may update this policy from time to time. The current version is always published on this page, with the date of the last update at the top.

See also our Terms of Use and Cookie Policy.

Start Typing