Privacy policy

RIGHT CONSULT COMPANY, the controller of conformitate.md, processes the data you send us through its forms and technical data from your visit only for the purposes described below, on the legal bases laid down in Law No. 195/2024. Here you will find what we collect, who receives it, how long we keep it and how to exercise your rights.

The controller and contact details

The controller of the personal data processed through this website is RIGHT CONSULT COMPANY, IDNO 1022600002005, registered office at MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57, Republic of Moldova art. 13(1)(a). The website operates under the conformitate.md brand.

• Telephone: +373 767 27 667
• Email for clients: contact@conformitate.md
• Email for requests concerning personal data: dpo@conformitate.md

We have not yet designated a data protection officer art. 13(1)(b). Their contact details will be published on this page once they are designated. Until then, you may send requests concerning your data to dpo@conformitate.md.

What data we process and where we obtain it

Quote requests. Through the request form (in the quote section of the pages, in the window a package opens, under the price calculator’s result and under the industry checklists) we receive your name, the company’s name, your telephone number and email address, what interests you (for example, a package, a service or the free consultation), if you choose it, and your message, if you write one. When you send the request from the price calculator, we also receive the calculator’s answers (which data the company works with, who processes it on the company’s behalf, where it goes, whether the company has a website and surveillance cameras, roughly how many people work with the data, the special situations ticked, such as public body, group of companies or profiling, and whether you need the documents in Russian or English as well); until then, the answers stay in your browser. When you send the request from a checklist, we also receive which checklist you completed and which questions you did not tick; until then, the ticks stay in your browser. The form also sends the page it was submitted from and the language of the website.

Clients. If we conclude a contract, we process the data of the client’s contact persons that is needed for the contract and for invoicing.

Technical data. On every visit, your browser sends technical data such as your IP address, browser type and the page requested. This data is used to deliver the website, for security and to limit the number of requests sent from the same address. When you submit a form, the Cloudflare Turnstile service checks that the request comes from a person and not from an automated program. Turnstile loads only when you start using a form. The website’s technical logs contain only the outcome of each request (for example, sent or rejected), with no personal data and none of the data entered in the forms.

Cookies. Until you make your choice, we use only the necessary cookies and technologies: the cmd_consent cookie, which stores your choice, the ticks in the checklists, which your browser keeps only once you tick a question, and the protection of the website and its forms (Turnstile and Cloudflare’s security cookies __cf_bm and cf_clearance, which Cloudflare may set on any page). We use analytics cookies only if you accept them. Storage in the browser is governed by art. 116(5) and (6) of Law No. 72/2025 on electronic communications. The details are in the Cookie policy.

We obtain this data directly from you, and the technical data from your browser. If a colleague submitted a request naming you as the contact person, your data comes from that colleague art. 14(2)(f).

Purposes and legal bases

We process data only for the purposes below, each with its own legal basis art. 13(1)(c):

• Preparing the quote, replying to your request and holding the free consultation, where you submit the request on your own behalf: steps taken at your request prior to entering into a contract art. 6(1)(b).
• Replying to requests submitted on behalf of a company and managing the business relationship, for the person who submits the request on the company’s behalf and for clients’ contact persons: our legitimate interest art. 6(1)(f).
• Providing the contracted services, where you are party to the contract: performance of the contract art. 6(1)(b).
• Accounting and tax records for clients: compliance with a legal obligation to which we are subject under Law No. 287/2017 on accounting and financial reporting and the Tax Code art. 6(1)(c).
• Google Analytics statistics (analytics cookies): your consent art. 6(1)(a), given in the cookie consent window.
• Protecting the forms against automated messages and abuse through Cloudflare Turnstile and Cloudflare’s security cookies: our legitimate interest art. 6(1)(f). It does not depend on consent: without this protection, the forms cannot be offered safely.
• Website security, limiting the number of requests sent from the same address, aggregate visitor statistics: our legitimate interest art. 6(1)(f).

We use the data in a quote request only to reply to your request and, if you wish, to conclude and perform the contract; we do not use it for marketing messages.

The legitimate interests we pursue are to reply to requests we receive from companies and manage the business relationship with our clients, to keep the website available and secure, and to know, from aggregate statistics without cookies, which pages are useful art. 13(1)(d). Protecting the forms serves our interest in receiving only genuine requests and preventing abuse; Turnstile loads only when you use a form, and we use the data of the check for no other purpose.

You may withdraw your consent at any time, as easily as you gave it: through ‘Cookie settings’ in the website footer or by emailing dpo@conformitate.md. Withdrawal does not affect the lawfulness of processing carried out before it art. 7(3).

Recipients of the data

We disclose data only to the providers that help us offer the website and the services, acting as processors, and only to the extent necessary art. 13(1)(e):

• Cloudflare: hosting and delivery of the website, security, the Turnstile check and the security cookies, and the aggregate statistics of Cloudflare Web Analytics.
• Zoho (Zoho Corporation B.V., the Netherlands): the provider of the applications through which we receive your requests and our email correspondence. We use Zoho’s data centre in the European Union.
• Google: Google Analytics 4, only if you have accepted analytics cookies. Google Analytics keeps visit data for 2 months; the aggregate reports contain no data that identifies you. Google signals and ad personalisation are switched off.

Messengers. If you write to us on Viber, WhatsApp or Telegram, the messenger’s provider processes the message under its own terms and policy, as a separate controller. There we reply only to your request, and we do not send documents or other people’s personal data through these channels; for documents we use email.

We disclose data to public authorities only where the law requires us to. We do not sell or rent out personal data.

Transfers to other states

Data processed through Zoho is stored in the data centre in the European Union. Storage in a member state of the European Economic Area is not a transfer to a third country: the Law’s rules on transfers do not apply to it art. 44(2). Zoho group entities outside the European Union (in India and the United States of America) may access the data only for technical support, and that access is covered by the standard contractual clauses in Zoho’s data processing agreement art. 46(2)(c).

Cloudflare, Inc. and Google LLC may also process data in other states, including the United States of America, through their global infrastructure. The National Centre for Personal Data Protection has issued no decision on the adequacy of the level of protection in the United States of America art. 45(3). Transfers to Cloudflare, Inc. and Google LLC therefore rest on appropriate safeguards art. 46(1): the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914), included in their data processing agreements art. 46(2)(c). We do not rely on the EU–US Data Privacy Framework.

You may obtain a copy of these safeguards by writing to dpo@conformitate.md art. 13(1)(f).

How long we keep the data

We keep data only for as long as necessary for the purpose for which we received it art. 13(2)(a):

• Quote and consultation requests that do not lead to a contract: 12 months from receipt.
• Client data: for the duration of the contract and then for the retention periods for accounting documents laid down by law.
• The website’s technical logs: at most 7 days.
• Turnstile check data: as set out in Cloudflare’s Turnstile privacy policy.
• Visit data in Google Analytics: 2 months.
• Cookies: for the periods stated in the Cookie policy.

Your rights

With regard to the data concerning you, you have art. 13(2)(b):

• the right of access: to find out whether we process your data and to receive a copy of it art. 15(1);
• the right to rectification: to have inaccurate data corrected and incomplete data completed art. 16;
• the right to erasure: in the cases provided for by the Law, for example where the data is no longer necessary or where you withdraw your consent art. 17(1);
• the right to restriction of processing: in the cases provided for by the Law, for example while we verify the accuracy of data you contest art. 18(1);
• the right to data portability: to receive the data you provided to us in a structured, commonly used and machine-readable format, where the processing is based on consent or on a contract and is carried out by automated means art. 20(1);
• the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you art. 22(1);
• the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal art. 7(3);
• the right to lodge a complaint with the National Centre for Personal Data Protection (MD-2004, Republic of Moldova, mun. Chișinău, str. Serghei Lazo nr. 48; email centru@datepersonale.md; phone (022) 820 801; datepersonale.md) art. 13(2)(d). The limitation period for lodging the complaint is one year from the date on which you could have become aware of the alleged infringement, but not later than 3 years from the date of the alleged infringement art. 72(2);
• the right to bring an action before the competent court, where you consider that your rights have been infringed as a result of the processing of your data in non-compliance with the Law art. 74.

If we rectify or erase data or restrict processing, we communicate this to the recipients to whom we disclosed the data, unless this proves impossible or involves disproportionate effort. On request, we tell you who those recipients are art. 19.

The right to object. You may object at any time, on personal grounds, to processing based on our legitimate interest, including the processing of your data as a person who submitted a request on behalf of a company or as a client’s contact person. We then no longer process the data, unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of a right in administrative, judicial or out-of-court proceedings art. 21(1). You may object at any time to the processing of your data for direct marketing, after which we no longer process it for that purpose art. 21(2) art. 21(3).

You may send your requests to dpo@conformitate.md. We reply without undue delay and in any event within one month of receipt of the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two months, and we inform you of any extension and the reasons for it within one month art. 12(3). Our reply is free of charge; only for manifestly unfounded or excessive requests, in particular repetitive ones, may we charge a reasonable fee or refuse to act on the request art. 12(5). If we have reasonable doubts about your identity, we may ask you for additional information to confirm it art. 12(6).

Whether you are required to provide the data

Providing the data is not a legal obligation art. 13(2)(e). However, the fields marked as required in the quote form are necessary to prepare the quote: without them we cannot reply to your request. Analytics cookies are optional, and refusing them does not limit your access to the website. For clients, the data needed for the contract and for invoicing is a condition for concluding the contract.

Automated decisions

We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you art. 13(2)(f) art. 22(1). The estimated package and price shown by the price calculator and the quote form are indicative: the quote is prepared by a member of our team.

Data security

We apply technical and organisational measures appropriate to the risk of the processing art. 32(1). The connection to the website is encrypted, and the requests we receive can be viewed only by the members of our team who handle them.

Changes to this policy

The current version of this policy is published on this page, with the date of the last update. If we intend to process the data for a purpose other than that for which it was collected, we will inform you before that processing art. 13(3).