Privacy Policy

A. WHO ARE WE?

The platform consisting of the website unfinished.ro and the UNFINISHED mobile application (together, the “Platform”) is owned and operated by EIDOS Foundation (“EIDOS” or “Unfinished Platform”), having its headquarters at 18 Iresti Str., district 1, Bucharest, registered with the Registry of Foundations and Associations under no. 3113/B/2009, having sole registration code 26748839.

EIDOS acts as a data controller of your personal data, as defined below, for the purposes specified below.

Data protection contact: Vlad Nastasiu – [email protected].

B. APPLICATION OF THE PRIVACY POLICY

This Privacy Policy (the “Privacy Policy”) describes how we collect, use and otherwise handle your Personal Data, explains the circumstances in which we may transfer your Personal Data to others and informs you about the rights that you have in relation to the processing we perform of such Personal Data.

Our Privacy Policy should be read together with any and all other applicable legal provisions in force, as well as our Terms of Service, our Cookie Policy and any and all terms and conditions provided or made available to you on other pages of our website and in any potential contract concluded with us.

Unless otherwise stated below, all terms used with capital letters shall have the same meaning as the terms defined under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”).

C. HOW, WHEN AND WHY DO WE COLLECT AND USE PERSONAL DATA?

We process different types of personal data (“Personal Data”) when you register on the Platform in order to create an account and participate at Unfinished online events, festivals or at any activity organised by us (each, referred to below as an “Unfinished Event”), when you browse, request information or interact with our Platform and/or social media platforms (e.g. Facebook).

The Personal Data we collect and process, on a case by case basis, and depending on the extent and specific details of our interaction, are:

  • account and authentication data: your e-mail address and the one-time verification codes we send to it in order to sign you in (the Platform uses passwordless login — we do not store a password for you);
  • personal identification details, such as your name, surname, profile picture, time zone, favourite manifesto rule, address, date of birth, employment and occupation status, name of the company you work for, educational or professional background, job title and function, hobbies, curiosities, current country and city, as well as other personal information concerning your preferences, relevant for registration purposes into our community;
  • contact details, such as your telephone number, e-mail address, social media contact details;
  • event participation data: your registrations for Unfinished Events, admission credentials (such as a QR code containing a hashed identifier derived from your e-mail address) and check-in status;
  • Platform usage and other technical data, such as details of your visits to our Platform and/or social media platforms (Facebook), such as, the Internet Protocol (IP) address, login data, browser type and version, device type and operating system, mobile application version, time zone setting, browser plug-in types and versions, operating system and platform;
  • data that you voluntarily give us when you choose to register on the Platform or in various activities on or related to our social media platforms, such as, user ID, your comments and opinions, evaluation of posts and responses to feedback;
  • any other personal data relating to you that you willingly provide to us from time to time.
  • mobile application data: push notification tokens (if you enable notifications), device identifiers necessary for the operation of the app, camera access solely for scanning QR codes (images are processed on the device and not stored by us), and crash/diagnostic data;

Where we need to collect Personal Data as requested in order to create an account on the Platform and/or register with any particular Unfinished Event, if you fail to provide that data when requested, we may not be able to carry out your registration, in order to perform our obligations. In this case, we may have to cancel our engagement towards you.

D. DO WE COLLECT PERSONAL DATA ABOUT OTHER PEOPLE?

If you provide Personal Data to us about any natural person, other than yourself, such as your employees, counterparties, advisers or suppliers, you must ensure that they understand how their information will be processed and that either they have consented for you to disclose such Personal Data to us, also allowing us, and/or our outsourced service providers, to process it, or that there is another legal basis justifying such disclosure and processing.

E. HOW WE OBTAIN THE PERSONAL DATA ABOUT YOU?

We may collect or receive your Personal Data in a number of different ways:

  • whether you provide it directly and intentionally to us, for example, by registering on our Platform;
  • whether you provide it to us directly, but non-intentionally, such as the technical data we automatically collect when you use our Platform and/or social media platforms (e.g. Facebook), such as, the Internet Protocol (IP) address, login data, browser type and version, device type, time zone setting, browser plug-in types and versions, operating system, as well the data we infer from your reactions to the product of our services or, as the case may be, evaluation of posts and responses to feedback on our media platforms.

F. HOW AND WHY WE USE YOUR PERSONAL DATA?

We verify and comply with the legal grounds for processing we rely on, in each case, in order to compliantly process your Personal Data.

We may use your Personal Data as provided below:

  • in order for you to register on the Platform, at your request or based on you entering into the terms and conditions:
    • to authenticate you when you sign in, by sending a one-time verification code to your e-mail address;
    • for assessing your compatibility with the Unfinished Platform;
    • for retaining and importing your personal data on the Unfinished Platform;
    • in order to create an account for you as a member of the UNFINISHED Platform;
    • in order to identify the kind of people you feel like bumping into, we will use part of the information you shared with us in our matching criteria;
    • for giving you feedback on the usage of the Platform and interactions with other members;
  • in order to register you for Unfinished Events, at your request: to process your registration, issue your admission credential (such as a QR code), verify it at entry and manage attendance;
  • in order for you to be up to date with the developments in our community and be recommended like-minded individuals and content, at your request or based on your consent:
    • for communication purposes: in order to keep you up to date on the latest developments, announcements, and other information about us, updates (including briefings, newsletters and other information), events and initiatives;

In this regard, we provide the option to unsubscribe or opt out of further communication on any electronic communication sent to you; alternatively, you may opt out by contacting us directly, by using the contact details set out below.

  • only with your prior consent, to share your e-mail address in hashed form with advertising platforms (Meta, LinkedIn and/or Google) in order to reach people with similar interests (custom / lookalike audiences); you may withdraw this consent at any time;
  • in order to provide content display and recommendations based on your Personal Data;
  • facilitating the use of our Platform and social media platforms and to ensure that the content of our Platform and social platforms is presented in the most effective manner for you and for your device;
  • exercising or defending our legal rights or to comply with court orders, if the case;
  • protecting the security of our communications and other systems and to prevent and detect security threats, frauds or other criminal or malicious activities.

For further processing purposes that are compatible and linked with the purposes mentioned above, for which the Personal Data have been collected, including, without being limited to, facilitating, if applicable, the registration process to particular activities organized on our Platform by receiving a preferential application form.

If you have provided your consent to the processing and transfer of your Personal Data, you have the right to fully or partly withdraw your consent, free of charge and at any point in time. To withdraw your consent, please use the contact details provided at point N below. While exercising this right, please also take into account that withdrawal of consent will not affect the processing of personal data before such withdrawal.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do use limited profiling to suggest members, events and content that may interest you, as described above; you may object to this at any time using the contact details at Point N.

G. SHARING OF YOUR PERSONAL DATA

We do not sell your Personal Data. We share it only in the situations described below. However, once you apply for the creation of an account on our Platform, you acknowledge that your name, surname, photo, time zone and favourite manifesto rule shall be visible by default to the other members of our Platform, as a condition for the use of the Platform. You may consent to make other data, such as age or profession, visible on our Platform.

Furthermore, we may transmit your Personal Data to third parties, including social media platforms, for the above-mentioned purposes, or to certain service providers we may have subcontracted, in order to perform our activity, strictly to the extent that such action is necessary. These currently include:

  • e-mail delivery providers, used to send you login verification codes, event confirmations and other communications (resend.com, postmark.com);
  • hosting and infrastructure providers, including Cloudflare, Inc. (content delivery and security);
  • analytics and measurement providers: Google (Google Tag Manager, Google Analytics, Google Ads), Meta Platforms Ireland Ltd. (Meta Pixel), Hotjar Ltd., and our self-hosted Plausible Analytics instance (cookieless) — see the Cookie Policy for details;
  • Apple Inc. and Google LLC, as distributors of the mobile application through the Apple App Store and Google Play respectively.

Please note that this list is non-exhaustive and, considering specific circumstances, there may be other examples where we need to share your Personal Data with third parties, in order to provide the services and/or, as the case may be, exercise our legitimate rights.

We may also disclose your Personal Data to comply with our regulatory requirements and/or any other applicable legal provisions in force from time to time, or in the course of dialogue with regulators, as applicable, which may include disclosing your Personal Data to government and/or regulatory or law enforcement agencies, in connection with enquiries, proceedings or investigations by such entities anywhere in the world, if or where compelled to do so. Where permitted, or unless doing so would prejudice the prevention or detection of a crime, we will direct any such request to you or notify you before responding.

H. WHICH COUNTRIES DO WE TRANSFER YOUR PERSONAL DATA TO?

As a rule, we store and process your Personal Data within the European Economic Area (EEA). However, some of the service providers listed in point G above (such as Google, Meta, Hotjar, Cloudflare, Apple) may process limited Personal Data (mostly technical and usage data) outside the EEA, including in the United States. Where such transfers occur, we rely on appropriate safeguards recognised by the GDPR, such as European Commission adequacy decisions (including the EU–U.S. Data Privacy Framework, where the recipient is certified) and/or Standard Contractual Clauses.

I. THE RETENTION PERIOD OF YOUR PERSONAL DATA

Personal Data shall be retained for as long as it is either legally required, if the case is such, or needed for the purposes described in Point F above as provided below, as well as for archiving purposes.

Your Personal Data shall be retained by EIDOS throughout your use of our Platform and for any additional period required in accordance with the applicable law. However, the retention period of your Personal Data shall not exceed the necessary duration to accomplish the purposes for which this data has been collected and/or to observe any legal obligations hereof.

Your Personal Data retained for communication purposes — in order to keep you up to date on the latest developments, announcements, and other information about us, updates, including briefings, newsletters and other events and initiatives — shall be retained until you unsubscribe or withdraw your consent, or following 3 years of inactivity (no interaction with our communications), whichever comes first.

J. OUR PROTECTION OF YOUR PERSONAL DATA

We are highly committed to observing data privacy and, thus, we have implemented a range of commercially reasonable physical, technical and procedural measures to help protect Personal Data from unauthorized access, use, disclosure, alteration or destruction, such as:

  • limiting the number of recipients/users from our community who have access to Personal Data and correlating access rights with the actual and justified need of each recipient/user;
  • concluding agreements with our collaborators, suppliers and service providers, providing confidentiality and personal data protection obligations for ensuring the protection of your Personal Data;
  • adopting, at our community level, specific rules on copying and disseminating documents, to prevent any unauthorized access to Personal Data and the disclosure thereof;
  • creating back-ups of the stored Personal Data;
  • introducing specific access rights in order to prevent any unauthorized individuals to access Personal Data, areas where Personal Data are being stored and/or equipment on which Personal Data are stored/located.

Furthermore, our collaborators, as well as any third-party service providers we may engage that process Personal Data on our behalf (for the purposes listed above) are also contractually bound to respect the confidentiality of your Personal Data.

K. THE RIGHTS THAT YOU HAVE IN RELATION TO YOUR PERSONAL DATA

In your capacity as data subject, the GDPR grants you the following rights:

  • right of access — allowing you to obtain confirmation that your Personal Data is being processed by us and, if affirmative, the relevant details of such processing activities;
  • the right to rectification — allowing you to rectify your Personal Data, if inaccurate;
  • right to erasure — allowing you to obtain the erasure of your Personal Data, subject to the limitations provided in this Privacy Policy and/or by law;
  • right to restriction — allowing you to obtain the restriction of processing your Personal Data, subject to the limitations provided in this Privacy Policy and/or by law;
  • right to object — allowing you to object to further processing of your Personal Data, subject to the limitations provided in this Privacy Policy and/or by law; and
  • right to data portability — allowing you to receive the Personal Data concerning you that you have provided to us, in a structured, commonly used and machine-readable format or to transmit such data to another data controller (provided that such data have been provided to us or stored by us in such a structured, commonly used, machine-readable and portable format).

You may exercise your aforementioned rights and find out more about such rights by filing with us, as data controller, a written request, using the contact details provided at Point N below.

You also have the right, whether dissatisfied with our use of your Personal Data or with our response related to your claims on exercising your rights, to lodge a complaint with the Romanian Supervisory Authority (010336, 28–30 G-ral. Gheorghe Magheru Blvd. District 1 Bucharest, Romania / E-mail: [email protected] / Telephone number: +40 318059211 and +40 318059212 / webpage: https://www.dataprotection.ro/?page=Plangeri_pagina_principala).

L. DELETING YOUR ACCOUNT

You may deactivate or delete your UNFINISHED account at any time:

  • directly in the mobile application, through the account settings (where available); or
  • by sending a deletion request from the e-mail address associated with your account to [email protected] or on the Support page.

Upon a deletion request we will delete your account and the Personal Data associated with it, except for data we are legally required to retain or need in order to establish, exercise or defend legal claims; any such retained data is kept only for as long as strictly necessary (see Point I above). Content you shared with other members before deletion may remain visible to them, as described in our Terms of Service.

M. COOKIES AND SIMILAR TECHNOLOGIES

In general, cookies are text files containing small amounts of information which are downloaded to your device when you visit a website.

Our Platform uses strictly necessary cookies (which are essential in order to enable you to move around the Platform and use features, such as accessing secure areas of the Platform), as well as analytics and advertising cookies and similar technologies provided by third parties such as Google, Meta and Hotjar. We also use a self-hosted, cookieless analytics tool (Plausible).

The full list of the cookies in use, their purposes and lifetimes, and the ways in which you can manage or refuse them, is set out in our Cookie Policy. You can find more information about cookies in general at www.allaboutcookies.org.

N. CONTACT US

If you have any questions on this Privacy Policy or if you want to exert your right(s), as data subject, please contact us via e-mail at: [email protected]. For matters concerning data protection you may also contact Vlad Nastasiu – [email protected].

O. HOW WE MAY UPDATE THIS PRIVACY NOTICE

We reserve the right to update and amend this Privacy Policy from time to time, in order to reflect any changes to the way in which we process your Personal Data or changing legal requirements.

The changes we may make to this Privacy Policy will be posted on this page and notified to you while visiting our Platform or, where appropriate, notified to you by e-mail.

This Privacy Policy is valid as of 22.07.2026.