# Case study: online store Source: https://conformitate.md/en/case-studies/online-store Updated: 2026-10-16 Case study Illustrative example An online store needs a legal basis for each purpose for which it processes its customers' data (art. 6), must inform them when the data are collected (art. 13) and must explicitly bring to their attention the right to object to direct marketing (art. 21). In this illustrative example, all three were missing. ## The situation An online cosmetics store with around 3,000 orders a month. A social network's tracking pixel collected data on visitors with no established legal basis and without informing them, and the newsletter went to every customer, none of whom had been told of the right to object. The customer list was uploaded to an email marketing platform with servers outside the European Economic Area. ## What was missing 1. The pixel sent the social network data on the pages viewed and the products added to the basket, with no established legal basis. For this marketing purpose, the store could not demonstrate any consent. [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") 2. The site had no privacy policy, and when placing an order customers did not learn the purposes and legal basis of the processing, the recipients, the storage period or their rights. [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 3. The right to object to direct marketing was not explicitly brought to customers' attention, clearly and separately from other information, at the latest at the first communication. [art. 21](https://conformitate.md/en/law-195-2024/article-21 "Right to object") 4. The email marketing platform received the customer list with no processing contract, and the store had not checked the conditions for transferring the data to a state outside the European Economic Area. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") 5. Customer data and inactive accounts were kept with no time limit. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") ## The risks ### A fine for basis and rights Running the pixel with no legal basis and disregarding the right to object carry fines of up to 2,000,000 lei or, for an enterprise, of up to 2% of total turnover in the year preceding the sanction, whichever is higher. In setting the fine, the Centre also takes into account the number of people affected, which is large at thousands of orders a month. [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 21](https://conformitate.md/en/law-195-2024/article-21 "Right to object") [art. 87](https://conformitate.md/en/law-195-2024/article-87 "General conditions for imposing fines") [art. 88](https://conformitate.md/en/law-195-2024/article-88 "Infringements punishable by a fine") ### Emails sent after an objection Once a customer objects to direct marketing, his or her data are no longer processed for that purpose. Every email sent after the objection can become the subject of a complaint to the Centre, which may order the store to comply with the customer's request. [art. 21](https://conformitate.md/en/law-195-2024/article-21 "Right to object") [art. 60](https://conformitate.md/en/law-195-2024/article-60 "Powers of the Centre") [art. 72](https://conformitate.md/en/law-195-2024/article-72 "Right to lodge a complaint with the Centre") ### A transfer without safeguards Data are transferred to a recipient in another state only under the conditions the law lays down. Infringing those conditions carries the same ceiling of 2,000,000 lei or 2%, and the Centre may order the suspension of data flows to that recipient. [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") [art. 60](https://conformitate.md/en/law-195-2024/article-60 "Powers of the Centre") [art. 88](https://conformitate.md/en/law-195-2024/article-88 "Infringements punishable by a fine") ## What is in place now 1. An established legal basis for each purpose: performance of the contract for orders and delivery, consent for the marketing pixel and, for the newsletter sent to existing customers, a basis checked also against the special rules on electronic commercial communications (the legislation on e-commerce and advertising), which may require the recipient's prior consent. Customers may object at any time. [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") 2. A cookie banner that does not start the pixel before consent is given and lets visitors withdraw consent as easily as they gave it. [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") 3. A published privacy policy, reachable from the order form, so that customers are informed when their data are collected. [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 4. A mention of the right to object in every newsletter and a subscriber list with everyone who objected removed. [art. 21](https://conformitate.md/en/law-195-2024/article-21 "Right to object") 5. A contract with the email marketing platform as a processor, and a verified basis for transferring the data. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 46](https://conformitate.md/en/law-195-2024/article-46 "Transfers on the basis of appropriate safeguards") 6. Retention periods for orders and for inactive accounts. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") ## Result The store now has an established legal basis for each purpose, direct marketing included, checked also against the rules on electronic commercial communications, a published privacy policy, a configured cookie banner, a contract with its email marketing platform and a cleaned-up subscriber list. For a typical online store The Essential package + extra work, 19,900 MDL This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data. [Calculate the exact price →](https://conformitate.md/en/tools/price-calculator?profil=magazine-online) FAQ ## Questions about this case ### Can a social network pixel run on legitimate interests? Legitimate interests require that the store's interests are not overridden by the interests or rights of its visitors, and tracking behaviour on the site for targeted advertising rarely passes that test. In this example, the store chose consent, which it must be able to demonstrate and which the visitor may withdraw at any time. [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") ### How should the right to object be presented in a newsletter? Explicitly, clearly and separately from any other information, at the latest at the first communication with the customer. After an objection, the data are no longer processed for direct marketing, including profiling related to it. [art. 21](https://conformitate.md/en/law-195-2024/article-21 "Right to object") ### Can we use a newsletter platform based abroad? Yes, if the platform provides sufficient guarantees and has a written contract with the store. If the servers are in a state of the European Economic Area, the rules on transfers do not apply; outside it, the transfer usually rests on a decision of the Centre on the adequacy of the level of protection or on appropriate safeguards. Customers must be told of the intention to transfer their data. [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") [art. 45](https://conformitate.md/en/law-195-2024/article-45 "Transfers on the basis of a decision on the adequacy of the level of protection") [art. 46](https://conformitate.md/en/law-195-2024/article-46 "Transfers on the basis of appropriate safeguards") ### What does the store risk in the law's first year? The ceilings are those in art. 88, but of the final amount of the fine set by the Centre, 10% applies in the first year after the law enters into force, 40% in the second and 100% from the third. A fine is imposed only if the infringement was intentional or negligent, and for a minor infringement the Centre may issue a warning instead. [art. 87](https://conformitate.md/en/law-195-2024/article-87 "General conditions for imposing fines") [art. 88](https://conformitate.md/en/law-195-2024/article-88 "Infringements punishable by a fine") [art. 90](https://conformitate.md/en/law-195-2024/article-90 "Transitional provisions") Related pages [Online stores](https://conformitate.md/en/industries/online-stores) [Data access request](https://conformitate.md/en/situations/data-access-request) [Inspection by the Centre](https://conformitate.md/en/situations/inspection-by-the-centre) [Data subject rights](https://conformitate.md/en/law-195-2024/data-subject-rights) [Transfers to other states](https://conformitate.md/en/law-195-2024/transfers-to-other-states) [Fines](https://conformitate.md/en/law-195-2024/fines) --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing