# Data protection for online stores Source: https://conformitate.md/en/industries/online-stores Updated: 2026-10-17 Online stores An online store is the controller of customer data and needs a legal basis for each purpose (art. 6), usually the performance of a contract for orders and deliveries. Customers are informed at collection, and providers that process data on the store’s behalf sign a written contract. Customers may object to direct marketing at any time (art. 21). ![An online store on screen with an order ready for delivery](/_astro/magazine-online-1200.D9nhQ8_U.webp) ## Industry-specific risks ### Pixels and analytics without a legal basis Cookies and marketing pixels can collect online identifiers, that is, personal data. Where they rely on consent, the store must be able to demonstrate that it obtained it, and withdrawing consent must be as easy as giving it. [art. 4](https://conformitate.md/en/law-195-2024/article-4 "Definitions") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") ### Offers sent after an objection The store sends offers without a legal basis or after the customer has objected. Once a customer objects, their data may no longer be processed for direct marketing. [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 21](https://conformitate.md/en/law-195-2024/article-21 "Right to object") ### Providers without a contract The store platform, email service or CRM that processes data on the store’s behalf needs a written contract. For providers in states outside the European Economic Area, the Law’s conditions for transfers also apply. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") ## Data you process Name and delivery address Phone and email Order history Payment data Online identifiers and cookies Newsletter subscriptions ## Your obligations under Law No. 195/2024 1. A legal basis for each purpose: order, delivery, marketing, analysis of visits [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") 2. Informing customers at the time their data is collected [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 3. Demonstrable consent, where consent is the legal basis [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") 4. Clear and complete information before cookies are used, under art. 116(5)-(6) of Law No. 72/2025, and consent for analytics and advertising cookies [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") 5. The right to object to direct marketing, explicitly brought to the customer’s attention at the latest at the first communication [art. 21](https://conformitate.md/en/law-195-2024/article-21 "Right to object") 6. Written contracts with processors [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 7. Transfers to states outside the European Economic Area only under the conditions of the Law [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") [art. 45](https://conformitate.md/en/law-195-2024/article-45 "Transfers on the basis of a decision on the adequacy of the level of protection") [art. 46](https://conformitate.md/en/law-195-2024/article-46 "Transfers on the basis of appropriate safeguards") ## Documents we deliver Every document is tailored to your activity, not copied from a template. Privacy policy, including information on cookies [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") Record of marketing consents [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") Contracts with processors [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") Records of processing activities [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") Data subject requests policy [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 24](https://conformitate.md/en/law-195-2024/article-24 "Responsibility of the controller") How we work ## From the first conversation to a complete compliance file 1. 1 ### Free consultation 15 minutes online or by phone. We learn what your company does and what personal data it processes. 2. 2 ### Assessment We take stock of your data, processes and existing documents. You receive a gap report. 3. 3 ### Documentation We draft the records, policies and privacy notices tailored to your activity. 4. 4 ### Implementation We walk you through the documents and leave a written note for employees; on request, we hold a briefing session for them. For a typical online store The Essential package + extra work, 19,900 MDL This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data. [Calculate the exact price →](https://conformitate.md/en/tools/price-calculator?profil=magazine-online) Packages ## Fixed prices, no surprises Choose a package by how your company processes data, not by headcount. Prices start from the lawyer's work, and a package costs less than its modules bought separately. ### Essential 5,900 MDL Module value: 18,500 MDL · you save 12,600 MDL Up to 3 processing activities · 2 privacy notices · 2 processor contracts For a small company with simple processing: a shop, an office, an accounting firm, a homeowners' association. - Data inventory and gap report - Records of processing activities, with the legal basis and retention period of each - Data protection policy and a description of the security measures - Privacy notices for each group of people: clients, employees, patients - Contracts with processors, new or reviewed - Internal rules for data subject requests and for personal data breaches - The confidentiality commitment and the written note for employees Online · delivered in 10 working days · 1 round of revisions · 14 calendar days of email questions [Choose Essential →](https://conformitate.md/en/industries/online-stores?pkg=essential#oferta) ### Extended Most popular 19,900 MDL Module value: 44,000 MDL · you save 24,100 MDL Up to 8 activities · 5 notices · 5 contracts · website, cameras, sensitive data For a small or medium company with varied processing: a clinic, an online shop, surveillance cameras, cloud services abroad. - Everything in Essential, with higher limits - Website privacy policy and cookie review - Video surveillance: notice, sign text, internal rules - Sensitive data in one activity (for example, medical records) - Transfers outside Moldova, one group of destinations - We check whether you need an impact assessment and a data protection officer Online · delivered in 20–30 working days · 2 rounds of revisions · 45 calendar days of email questions [Choose Extended →](https://conformitate.md/en/industries/online-stores?pkg=extended#oferta) ### Custom from 45,000 MDL No limits · analysis at your premises For clinic networks, banks and microfinance companies, groups of companies, public bodies, or companies that must appoint a data protection officer. - Everything in Extended, with no limits - Data protection impact assessments, as many as needed - Review of data flows and IT systems - Joint controller agreements, profiling, complex transfers Priced after analysis, at module prices [Request a quote →](https://conformitate.md/en/industries/online-stores?pkg=custom#oferta) Not sure which package fits? [Calculate the price →](https://conformitate.md/en/tools/price-calculator) [Request a free 15-minute consultation →](https://conformitate.md/en/industries/online-stores?pkg=consult#oferta) Documents are drafted in Romanian; an authorised translation into Russian or English is charged separately, at the translator's rate. ## Case studies and checklist [ Case study Illustrative example ### Case study: online store An online cosmetics store with around 3,000 orders a month. A social network's tracking pixel collected data on visitors with no established legal basis and without informing them, and the newsletter went to every customer, none of whom had been told of the right to object. The customer list was uploaded to an email marketing platform with servers outside the European Economic Area. Result The store now has an established legal basis for each purpose, direct marketing included, checked also against the rules on electronic commercial communications, a published privacy policy, a configured cookie banner, a contract with its email marketing platform and a cleaned-up subscriber list. ](https://conformitate.md/en/case-studies/online-store) FAQ ## What clients ask us ### Do I need a cookie banner? Yes, if the site uses cookies or pixels for analytics or advertising. Art. 116(5) and (6) of Law No. 72/2025 on electronic communications allows information to be stored on a visitor's device, or read from it, only after clear and complete information about the purposes, except where this is strictly necessary for transmitting a communication or for a service the visitor has expressly requested. Law No. 195/2024 does not regulate cookies separately, but the online identifiers they collect are personal data, and for analytics and advertising the defensible legal basis is consent: you obtain it before switching these tools on, you can demonstrate it, and visitors can withdraw it as easily as they gave it. [art. 4](https://conformitate.md/en/law-195-2024/article-4 "Definitions") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") ### Can I send a newsletter to existing customers? It depends on the legal basis you rely on and on how the data was collected. In any case, customers have the right to object to direct marketing at any time, and this right must be explicitly brought to their attention at the latest at the first communication. After an objection, the data is no longer used for that purpose. [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 21](https://conformitate.md/en/law-195-2024/article-21 "Right to object") ### What conditions must consent to a newsletter meet? Consent is a freely given, specific, informed and unambiguous indication of wishes, by a statement or a clear affirmative action. If it is requested in a document that also concerns other matters, the request is clearly distinguished from them. The store must be able to demonstrate it, customers are told beforehand that they can withdraw it at any time, withdrawing is as easy as giving it, and making an order conditional on subscribing casts doubt on whether consent was freely given. [art. 4](https://conformitate.md/en/law-195-2024/article-4 "Definitions") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") ### What do we do with the data after delivery? Keep it only for as long as the purposes for which it was collected require, including legal obligations such as accounting. Once it is no longer needed, you are obliged to erase it without undue delay. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 17](https://conformitate.md/en/law-195-2024/article-17 "Right to erasure (‘right to be forgotten’)") --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing