This is an English translation provided for convenience. The Romanian version is the legally binding text.
1. Who we are
City Twin is a platform developed and operated by the Asociația Română pentru Smart City (ARSC, the Romanian Smart City Association). Contact: [email protected], tel. +40 31 425 42 63. Registered office: Integral Business Center, Bd. Pipera nr. 1-IA, Voluntari, Ilfov, Romania.
Data Protection Officer (DPO): [email protected].
2. Two different roles
Our role under the GDPR depends on the context:
- The public demo (the Brașov model on citytwin.ro): we mainly process open, non-personal data (areas, projects, infrastructure, statistics). Here ARSC acts as controller for the limited technical data described below.
- An instance delivered to an institution: the institution (usually the city hall) is the controller of the data in its model, and ARSC is the processor, which processes data strictly in accordance with the institution's instructions, on the basis of a contract and a Data Processing Agreement (DPA).
3. What data we process
3.1 Traffic measurement: no advertising cookies, no profiling
City Twin does not use advertising cookies and does not use cookies to profile users. Strictly functional preferences may be stored locally for the interface to work (see 3.2). Infrastructure providers may, in certain situations, use mechanisms that are strictly necessary for security and the protection of the service.
To know how many visitors we have and which pages are read, we use a traffic measurement solution hosted on our own infrastructure in the European Union. We do not use Google Analytics or any advertising tool. The solution records aggregated statistics (the page visited, the referring source, the device type) without cookies, without persistent identifiers and without cross-site tracking. We cannot reconstruct the path of a particular person, we do not enrich the data from other sources and we do not sell it.
For this reason we do not display a cookie banner: we do not store or read information on your device for tracking purposes, so there is no consent to be requested for this.
3.2 Local storage (in your browser)
We save in localStorage, on your device only, functional preferences (e.g. the chosen map layer, whether you have seen the tour, the confirmation regarding uploading a model). This data does not leave the device and can be deleted from the browser at any time.
3.3 Questions to the AI assistant
To generate the answer, your question and the information from the city model needed for the answer are sent to the reasoning service: a compact form of the model, without the raw data series. We do not ask for and do not need data that identifies you. We recommend that you do not enter personal data in your questions. Models uploaded by the user remain locally in the browser and are sent to the AI service only when you ask a question.
Conversation history. Without an account (the public demo), the conversation thread is kept only in the server's memory, for at most two hours, and is not written anywhere. With an account, questions and answers are kept in your account, separately for each city, so that you can resume your work: only you can see them, they are deleted automatically after 90 days and we delete them earlier on request. Before saving, personal numeric codes (CNP), email addresses, telephone numbers and IBANs are removed from the questions. The account is provided by the institution that invited you, so here ARSC processes data as its processor, in accordance with the DPA (see section 2).
If you voluntarily send feedback on an answer (the 👍 / 👎 buttons), we keep on our server in the EU the question, the rating and limited technical information needed to improve the service. It is saved only when the button is pressed, without user identifiers: the application does not associate the feedback with the IP address, and the technical logs of the infrastructure are described on the Providers and data transfers page. We apply filters to the text to reduce the risk of accidentally storing personal data. Lawful basis: legitimate interest (improving the service), Art. 6(1)(f). Retention: 12 months. See also AI assistant transparency.
3.4 Technical logs
For security and operation, our infrastructure providers may record minimal technical data (IP address, time of the request, browser type). We use it to prevent abuse (e.g. rate limiting of requests) and to maintain the service, on the basis of legitimate interest. We do not use it for profiling.
3.4.1 Emails sent by the platform
The sign-in link and code, invitations, a scenario report sent to a colleague, the city's morning bulletin and form confirmations are sent through a transactional email provider. It receives the recipient's address and the content of the message and processes them in the USA, with GDPR safeguards (standard contractual clauses). We do not send advertising messages through it.
3.5 Images from public cameras
For the traffic feature, we display images from public cameras made available by their operators. Objects are counted locally, in the user's browser: the images are not sent to any server of ours and are not stored. The images may contain people; they come from feeds already made public by the operators and are displayed with attribution, without storage.
3.6 The contact and pilot forms
If you write to us through the contact form or through the pilot form on the home page, we process the data you voluntarily provide: name, email, telephone (optional), position/role, institution, county, type of community and the message. We use it exclusively to contact you about your request (a City Twin pilot or implementation). The lawful basis is your consent, given by ticking the confirmation box in the form (Art. 6(1)(a) GDPR); you may withdraw it at any time by writing to [email protected].
Form data is stored on the City Twin infrastructure in the European Union (Germany). Communication with the server may pass through the security and distribution providers described on the page on providers and data transfers. Form data is not used for profiling, is not sold and is kept only for as long as necessary to reply to you and to manage any pilot relationship, after which it is deleted on request or when the purpose has been achieved (see section 6).
4. Lawful basis (GDPR Art. 6)
| Processing | Lawful basis |
|---|---|
| AI answers to your questions | Legitimate interest: providing the requested service (Art. 6(1)(f)) |
| Data from the contact / pilot forms | Consent (Art. 6(1)(a)): voluntary, may be withdrawn at any time |
| Feedback on an AI answer (👍/👎, when pressed) | Legitimate interest: correcting weak answers (Art. 6(1)(f)) |
| Local preferences (localStorage) | Necessary for the functioning you requested |
| Technical / anti-abuse logs | Legitimate interest: network and information security (Art. 6(1)(f)) |
| Data in an institution's model | Determined by the institution (controller); we process as processor (Art. 28) |
For processing based on legitimate interest (Art. 6(1)(f)) we have carried out a balancing test: the interest in providing and securing the requested service does not override your rights, since the data is minimised, non-personal as a rule, not used for profiling and not sold. You may object at any time (see section 7).
5. Our providers and data transfers
We use third-party providers for hosting, maps, traffic, weather and AI reasoning. Their categories, with the region of processing, are listed on Providers and data transfers.
6. How long we keep data
- Local preferences: until you delete them from your browser.
- AI questions: processed to generate the answer. Without an account, the conversation thread is kept in the server's memory for at most two hours. With an account, the working history is kept for 90 days, then deleted automatically. Retention by the AI provider is governed by its own policy (see the page on providers).
- Feedback on an answer (only if you press 👍/👎): the question, the rating and the limited technical information, kept for at most 12 months, without user identifiers.
- Data from the contact / pilot forms: kept for as long as necessary to reply to you and to manage any pilot relationship; deleted when consent is withdrawn or when the purpose has been achieved.
- Technical logs: a short period, according to the settings of the infrastructure providers.
- Data in a City Twin space dedicated to an institution: in accordance with the DPA concluded with the institution.
7. Your rights (GDPR Art. 15-22)
Depending on the applicable processing, you may have the right of access, rectification, erasure, restriction, objection and portability. For data in a City Twin space dedicated to an institution, address your request to the institution (the controller); we can assist as processor. Write to us at [email protected].
You may lodge a complaint with the supervisory authority, which in Romania is ANSPDCP (the National Supervisory Authority for Personal Data Processing, dataprotection.ro).
8. Personal data included by mistake
The platform is not intended for personal data. If you notice that a model contains personal data by mistake, let us know at [email protected]: we will remove it and, where applicable, notify the incident in accordance with the GDPR (to the authority within 72 hours, where required). See also the Terms, the section on uploaded content.
9. Security (GDPR Art. 32)
Under Art. 32 GDPR we apply technical and organisational measures appropriate to the risk. A public description of the main categories of measures is available on the Information security page. Documentation intended for institutional assessments is made available on request, within the contractual framework.
10. Record of processing activities (ROPA)
Where applicable, we maintain a record of processing activities in accordance with Art. 30 GDPR. For a City Twin space dedicated to an institution, the record is aligned with that of the controller through the DPA.
11. Applicable legal framework
- GDPR: Regulation (EU) 2016/679;
- Law No. 190/2018 (on measures implementing the GDPR in Romania);
- NIS2: Directive (EU) 2022/2555 and the Romanian transposing legislation (cybersecurity);
- AI Act: Regulation (EU) 2024/1689 (see the Terms);
- ePrivacy Directive 2002/58/EC (cookies): we do not store or read information on your device for tracking purposes, so we do not request consent for this purpose.
12. Changes
We may update this policy. The current version, with its date, is always available here. Significant changes will be flagged in the platform.