Last updated: 15 October 2026
The Kónya Ádám Cultural Centre is committed to protecting the personal data of all individuals who access the website of the Red Star Museum of Communism, purchase tickets online, plan a visit or use other services offered by the museum.
This Privacy Policy explains what personal data we collect, for what purposes and on what legal basis we process them, to whom we may disclose them, how long we retain them and what rights data subjects have in relation to the processing of their personal data.
The purpose of this policy is to inform visitors about how their personal data are processed while using the website and the museum’s services, so that they can make informed decisions.
This policy applies to the processing of personal data carried out by the Kónya Ádám Cultural Centre in connection with the administration of the Red Star Museum of Communism. It does not apply to processing carried out by other data controllers in their own name and under their own responsibility.
The Privacy Policy may be amended periodically, particularly in the event of changes to our services, the technologies used or the applicable legislation. The updated version will be published on the website.
The website of the Red Star Museum of Communism and the services associated with it are administered by the Kónya Ádám Cultural Centre.
The Kónya Ádám Cultural Centre is responsible for the processing of personal data to the extent that it processes them in its own name and for its own purposes.
Through the website, visitors can obtain information about the museum, its exhibitions and visiting options and, where the service is available, purchase tickets online and obtain information about visiting conditions.
If you have any questions regarding this Privacy Policy, the processing of your personal data or if you wish to exercise your data protection rights, you can contact us at the following address:
Data controller: Kónya Ádám Cultural Centre
Institution: Red Star Museum of Communism
Email: info@steauarosie.ro or info@voroscsillag.ro
Where possible, please specify the nature of the processing or the right you wish to exercise in your request.
We may collect personal data from the following sources:
directly from the data subject when they purchase tickets through the website, complete a form, send an email or contact us through other means;
from technical data generated automatically during the use of the website, such as log files and, in accordance with the applicable rules, cookies;
from providers involved in the operation of the website, the online sale of tickets, payment processing or the provision of other related services, to the extent that the transfer of data is lawful;
through social media platforms when the data subject interacts with us on these platforms.
We process personal data only for specific and legitimate purposes and to the extent necessary to fulfil those purposes.
Personal data may be processed in particular for the following purposes:
Providing museum services and managing online ticket purchases.
Processing ticket orders and managing related operations.
Responding to visitors’ questions, requests and complaints.
Providing information about museum visits and organised events.
Ensuring the operation, security and usability of the website, as well as improving it.
Fulfilling obligations established by applicable legislation.
Establishing, exercising or defending legal claims.
Protecting the legitimate interests and safety of visitors and the institution.
If you purchase tickets through the website, we may request the personal data necessary to process your order and issue the tickets.
Depending on the ticket sales system used and the type of purchase, the data processed may include:
first and last name;
email address;
telephone number, if providing it is necessary;
information relating to the tickets purchased, the visit date and the order;
data necessary to identify and process the transaction.
Bank card details may be processed by the provider carrying out payment processing, in accordance with its own privacy conditions and security rules. The specific manner of processing depends on the payment service provider selected.
We use these data to process the purchase, issue tickets, send purchase-related information and manage any subsequent requests.
Legal basis for processing: performance of a contract or taking steps prior to entering into a contract at the request of the data subject, as well as compliance with applicable legal obligations.
If you contact us by email, telephone, through the form available on the website or through another communication channel, we process the data necessary to respond to you.
These may include your name, email address, telephone number, the content of your message and other information necessary to handle your request.
We use these data exclusively to respond to your request, manage correspondence and complaints, and maintain records of the related operations.
Legal basis for processing: depending on the nature of the request, performance of a contract, compliance with a legal obligation or the legitimate interest of the controller, particularly in ensuring the efficient handling of visitor requests.
If the museum organises events, special programmes, competitions or other activities, we may process the personal data necessary to organise and conduct them.
Depending on the nature of the event, the data may include participants’ names, contact details, registration or participation information and other data necessary for carrying out the activity.
Photographs, video recordings or audio recordings may be made and published only under the conditions established by applicable legislation. Where consent is required, it will be obtained appropriately.
Legal basis for processing: depending on the event, performance of a contract, compliance with a legal obligation, legitimate interest or the consent of the data subject.
While operating the website, we may collect technical data that help us ensure the security of our services and improve the user experience.
Depending on the technologies used, these data may include the IP address, browser type, technical information about the device, pages accessed, date and time of the visit and server log files.
Analytical technologies or other technologies that are not strictly necessary will be used only if the conditions established by applicable legislation are met.
The data may be used to check the operation of the website, identify errors, improve security and, where the processing is lawful, analyse traffic and how the website is used.
Legal basis for processing: the legitimate interest of the controller in ensuring technical functionality and security or another applicable legal basis, depending on the circumstances. For cookies and similar technologies that require consent, the legal basis is the consent of the data subject.
In connection with ticket purchases, payments and the operation of the institution, we may be required to process and retain certain data under accounting, tax and other applicable legislation.
These data may include transaction information, data necessary for invoicing, payment records and documents relating to completed operations.
Legal basis for processing: compliance with the legal obligations applicable to the controller.
Where necessary, we may use personal data to protect the rights of the institution, visitors and other individuals, prevent abuse, and establish, exercise or defend legal claims.
Legal basis for processing: the applicable legal obligation or the legitimate interest of the controller or a third party, depending on the situation.
If legislation requires consent for a particular processing activity involving personal data, we request it before processing begins, using an appropriate method.
Consent may be given, for example, through an online interface, cookie settings or another method appropriate to the processing in question.
Consent must be freely given, specific, informed and unambiguous.
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Withdrawal of consent also does not affect processing that may continue on another legal basis, such as compliance with a legal obligation.
The website may use cookies and other similar technologies to ensure its operation, remember user preferences, maintain security and, where applicable, analyse traffic.
Cookies are small files that may be stored on the visitor’s device by the website. Some cookies are necessary for the basic operation of the website, while others may be used for analytical purposes or other functionalities.
Detailed conditions regarding the use of cookies, their categories, storage periods and management methods are presented in the separate Cookie Policy published on the website and/or in the cookie settings interface, if available.
For the use of cookies that are not strictly necessary, we request prior consent in cases provided for by applicable legislation. Visitors can manage cookie settings through the interface available on the website and through their browser settings.
Disabling cookies may limit the functionality of certain website features.
We disclose personal data only to the extent necessary and where an appropriate legal basis exists.
Personal data may be accessed by the controller’s authorised staff, within the scope of their duties, as well as by providers supplying services on behalf of the controller and acting as data processors.
Depending on the services used, data may be transferred to the following categories of recipients:
providers of online ticket sales and management systems;
payment processors and providers involved in carrying out transactions;
web hosting, server and IT infrastructure providers;
providers ensuring the maintenance and technical operation of the website;
accounting, invoicing and professional consultancy service providers;
communication, email delivery and visitor support service providers;
analytical service providers or other technology service providers, if used;
competent authorities and other institutions, where the transfer of data is required by law or permitted on an appropriate legal basis.
In our relationships with data processors, we ensure that personal data are processed only for the specified purposes and in compliance with the applicable contracts and data protection requirements.
We do not transfer personal data to third parties for their own purposes without an appropriate legal basis.
If a provider processes personal data outside the European Economic Area, we ensure that the transfer takes place under the conditions established by applicable data protection legislation.
We retain personal data only for as long as necessary to fulfil the purpose for which they were collected or for as long as their retention is justified by legal obligations or the need to exercise or defend legal claims.
The retention period depends on the type of data, the purpose of processing and the applicable legal requirements.
Accordingly:
data relating to ticket purchases and transactions are retained for as long as necessary to process the purchase, handle requests and fulfil applicable accounting and tax obligations;
data relating to visitor requests are retained for as long as necessary to resolve them and carry out any subsequent operations;
technical data and security logs are retained for as long as necessary for the operation and security of systems and for investigating incidents;
data processed on the basis of consent are retained for as long as necessary for the stated purpose or until consent is withdrawn, except where another legal basis exists for retaining them.
Upon expiry of the retention period, personal data are deleted or anonymised unless there is a legal reason for retaining them further.
The Kónya Ádám Cultural Centre implements appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful use, alteration, disclosure, destruction or accidental loss.
Depending on the nature of the data processed and the risks identified, protective measures may include access controls, IT security measures and other appropriate measures.
Employees and authorised providers involved in processing personal data are required to comply with data protection requirements and the confidentiality of information.
No method of transmitting information over the internet can guarantee absolute security. Nevertheless, we make efforts to protect the personal data we manage through measures proportionate to the risks.
Under the General Data Protection Regulation (GDPR) and applicable legislation, data subjects have the following rights. The exercise of these rights depends on the circumstances of the processing and the conditions established by law.
You have the right to request confirmation as to whether or not we process your personal data. If we do, you have the right to access them, obtain the information concerning the processing required by law and receive a copy of your personal data.
You have the right to request the correction of inaccurate personal data and the completion of incomplete data.
In certain situations, you may request the erasure of your personal data, for example if they are no longer necessary for the purpose for which they were collected or if you have withdrawn your consent and there is no other legal basis for continuing the processing.
The right to erasure is not absolute. We may retain data where this is required by law or where the data are necessary for establishing, exercising or defending legal claims.
In the cases provided for by law, you may request the restriction of the processing of your personal data. This right may be exercised, for example, when you contest the accuracy of the data, when the lawfulness of the processing is contested or when we no longer need the data but you need them for the exercise of legal claims.
Under certain conditions, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format. Furthermore, if the legal conditions are met, you may request that these data be transmitted to another controller.
You have the right to object to the processing of your personal data when the legal basis is the legitimate interest of the controller or a third party and the conditions established by law are met.
In the case of processing personal data for direct marketing purposes, you may object at any time to the use of your data for this purpose.
If the processing of your personal data is based on your consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
If you believe that the processing of your personal data violates the applicable data protection rules, you may lodge a complaint with the competent supervisory authority.
In Romania, the competent authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).
Website: https://www.dataprotection.ro/
You also have the right to bring a claim before the courts under the conditions established by applicable legislation.
You may send requests concerning the exercise of the above rights to the following email address:
info@steauarosie.ro or info@voroscsillag.ro
If necessary, before handling your request, we may verify your identity to prevent the unauthorised disclosure of personal data.
Requests will be handled within the time limits established by the GDPR. If the deadline may be extended due to the complexity of the request or the number of requests, we will inform you in accordance with the applicable rules.
Providing certain personal data may be necessary for purchasing tickets online, issuing tickets, processing payments or providing the requested service.
If you do not provide the necessary data, we may be unable to complete the purchase or provide the requested service.
Providing other data may be voluntary, where there is no legal or contractual obligation to provide them. We will inform you about the data required for each processing activity at the time of collection or through the relevant interface.
We may periodically update this Privacy Policy, particularly when our services, data processing practices, technologies used or applicable legislation change.
The updated version will be published on the museum’s website. We recommend that you review this policy periodically to stay informed about the rules applicable to the processing of your personal data.
The date indicated at the beginning of this document represents the date of the latest update.
Data controller: Kónya Ádám Cultural Centre
Institution: Red Star Museum of Communism
Contact: info@steauarosie.ro or info@voroscsillag.ro
