🛡️ MOLDOVAN LAW NO. 133/2011 & EU REGULATION 2016/679 (GDPR) COMPLIANT
MOLDOVAN LAW 133/2011 • EU GDPR (REG. 2016/679)
1. Preamble, Scope and Applicable Legal Framework
This Privacy and Personal Data Protection Policy governs how SmartSoftArt STUDIO SRL (hereinafter referred to as "SmartSoftArt", "Controller", or "Company") collects, processes, stores, discloses, and safeguards personal data of website visitors, commercial clients, software platform users, and partners. This policy is formulated in rigorous adherence to international and national legal standards:
- Law of the Republic of Moldova No. 133 of July 8, 2011 on the Protection of Personal Data (Official Gazette No. 170-175, with subsequent amendments);
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR);
- Law of the Republic of Moldova No. 284/2004 on Electronic Commerce;
- Law of the Republic of Moldova No. 241/2007 on Electronic Communications;
- Council of Europe Convention 108/108+ for the Protection of Individuals with regard to Automatic Processing of Personal Data;
- Government Decision of the Republic of Moldova No. 1123/2010 approving the Mandatory Security Requirements for Personal Data Processing.
ART. 24 GDPR • ART. 23 LAW 133
2. Controller Identification & Data Protection Officer (DPO)
The official legal entity acting as Data Controller for processing activities conducted through SmartSoftArt platforms is:
Official Controller: SmartSoftArt STUDIO SRL
State Registration Code / IDNO: 1026023001849
Corporate Headquarters: Republica Moldova, Ungheni, Gherman
General Corporate Email: support@smartsoftart.comData Protection Officer (DPO): privacy@smartsoftart.com
ART. 4 LAW 133 • ART. 5 GDPR
4. Core Principles of Personal Data Processing
SmartSoftArt adheres strictly to the fundamental principles established under Article 5 of the GDPR and Article 4 of Moldovan Law No. 133/2011:
1. Lawfulness, Fairness & TransparencyData is processed lawfully, fairly and in a transparent manner in relation to the data subject.
2. Purpose LimitationCollected exclusively for specified, explicit, and legitimate corporate and technical purposes.
3. Data MinimizationLimited strictly to what is adequate, relevant, and necessary for the stated processing purposes.
4. Accuracy & TimelinessReasonable measures are maintained to ensure inaccurate data is erased or rectified without delay.
5. Storage LimitationKept in a form permitting identification of data subjects for no longer than necessary for the purposes.
6. Integrity & ConfidentialityProcessed in a manner ensuring appropriate security, encryption, and protection against unlawful access.
DATA CATEGORIES
5. Categories of Personal Data Processed
Depending upon your interaction with our website, cloud portals, and software services, SmartSoftArt processes the following data categories:
- Identity & Contact Data: Full name, professional title, corporate affiliation, fiscal ID / IDNO, billing address, business email address, contact telephone number;
- Financial & Transactional Records: Invoice records, transaction identifiers, payment history, IBAN and bank details for affiliate disbursements; credit card numbers are handled exclusively via Level 1 PCI-DSS tokenized payment processors;
- Technical & Telemetry Data: IP addresses, browser classification, device fingerprints, operating systems, access logs, time zone coordinates, and security audit trails;
- Customer Service & Project Inquiries: Transcripts of client service tickets, project specifications, feedback entries, and electronic correspondence.
ART. 5 LAW 133 • ART. 6 GDPR
6. Legal Bases & Specific Purposes of Processing
Every data processing operation conducted by SmartSoftArt is justified under recognized statutory legal bases:
| Operational Purpose | Statutory Legal Ground |
|---|
| Provision of software architecture, cloud hosting, web development, and support | Performance of a contract (Art. 5(1)(a) Law 133/2011; Art. 6(1)(b) GDPR) |
| Fiscal invoicing, accounting retention, and compliance with statutory audits | Compliance with legal obligation (Art. 5(1)(b) Law 133/2011; Art. 6(1)(c) GDPR) |
| Platform defense, intrusion prevention, fraud mitigation, and infrastructure resilience | Legitimate interests (Art. 5(1)(d) Law 133/2011; Art. 6(1)(f) GDPR) |
| Direct marketing dispatches, technical newsletters, and promotional announcements | Explicit consent (Art. 5(1) Law 133/2011; Art. 6(1)(a) GDPR) |
RETENTION SCHEDULES
7. Data Retention & Archiving Schedules
SmartSoftArt retains personal data exclusively for the duration necessary to fulfill the underlying operational and legal mandates:
- Active Client & User Profiles: Maintained throughout account validity plus 3 years following account termination for legal claim defenses;
- Fiscal Invoices & Accounting Ledgers: Preserved for 5 years pursuant to the Fiscal Code and Accounting Law No. 113/2007 of the Republic of Moldova;
- Server & Security Access Logs: Retained for 6 to 12 months for forensic cybersecurity analysis and compliance with GD 1123/2010;
- Marketing Subscriptions: Maintained until consent is revoked (available anytime via single-click unsubscribe links).
ART. 12-18 LAW 133 • ART. 15-22 GDPR
8. Fundamental Rights of Data Subjects
Pursuant to Moldovan Law No. 133/2011 and the EU General Data Protection Regulation, you possess enforceable legal rights:
1. Right of Access (Art. 13 Law 133 & Art. 15 GDPR)Obtain confirmation of processing and a full structured copy of your personal data dossier.
2. Right to Rectification (Art. 14 Law 133 & Art. 16 GDPR)Require immediate correction of inaccurate or incomplete records without undue delay.
3. Right to Erasure / "To be Forgotten" (Art. 17 GDPR)Request total deletion of personal records where legal justification or necessity no longer exists.
4. Right to Restriction (Art. 18 GDPR)Temporarily restrict data operations pending verification of accuracy or legitimacy of processing.
5. Right to Data Portability (Art. 20 GDPR)Receive data in a structured, commonly used, machine-readable format (JSON/CSV) for third-party transfer.
6. Right to Object (Art. 16 Law 133 & Art. 21 GDPR)Object at any time to direct marketing operations or processing reliant upon legitimate interests.
STATUTORY DPO WORKFLOW
9. Rights Exercise Protocol & DPO Request Desk
To exercise any statutory data right, submit a formal request without cost to our Data Protection Officer at privacy@smartsoftart.com or utilize our secure digital submission module below. The statutory maximum response window is 15 calendar days (Moldovan Law 133/2011) or 30 calendar days (EU GDPR).
ART. 28 GDPR • SUB-PROCESSORS
10. Data Recipients & Authorized Sub-Processors
SmartSoftArt does not sell, rent, or trade your personal data. Disclosures to third parties occur exclusively under strict Data Processing Agreements (DPAs):
- Certified Payment Gateways: Stripe Inc., PayPal Inc. (holding Level 1 PCI-DSS security compliance);
- Cloud & Datacenter Providers: Tier-III / Tier-IV ISO 27001 certified facilities situated within the European Union and Moldova;
- Domain Registrars & SSL Certificate Authorities: ICANN accredited registrars and Let's Encrypt / DigiCert;
- Public & Regulatory Authorities: State Tax Inspectorate and law enforcement agencies exclusively pursuant to binding judicial orders.
ART. 32 LAW 133 • CHAPTER V GDPR
11. International & Cross-Border Data Transfers
Data transfers outside the Republic of Moldova or the European Economic Area (EEA) are executed in strict accordance with statutory transfer mechanisms:
- Transfers to jurisdictions recognized as providing adequate statutory protection by CNPDCP and the European Commission;
- Implementation of Standard Contractual Clauses (SCCs) approved by the European Commission;
- Supplementary technical protections including end-to-end payload cryptography.
GD RM 1123/2010 • ART. 32 GDPR
12. Enterprise Technical & Organizational Safeguards
SmartSoftArt deploys enterprise-grade security controls conforming to Government Decision No. 1123/2010:
- High-Grade Cryptography: All public transmissions enforce TLS 1.3 encryption, and credentials utilize irreversible argon2id / bcrypt hashing;
- Multi-Factor Authentication (2FA): Mandatory for all engineering, administrative, and operations personnel;
- Encrypted & Geographically Redundant Backups: Automated snapshots stored in physically separated data centers;
- Continuous Security Auditing: Regular vulnerability scanning, penetration assessments, and staff compliance certifications.
LAW 284/2004 • E-PRIVACY DIRECTIVE
13. Web Cookies & Tracking Technologies
Our web platform utilizes session and preference cookies for essential site navigation, load balancing, and authenticated session integrity. For comprehensive categorization, please review our standalone Cookie Policy.
ART. 8 GDPR
14. Protection of Minors' Personal Data
SmartSoftArt services are directed exclusively to commercial entities and individuals of legal age (at least 16 or 18 years of age depending on national jurisdiction). We do not knowingly harvest information concerning minors without parental consent.
ART. 33-34 GDPR
15. Security Incident Management & Breach Notifications
In the unlikely event of a personal data breach posing a risk to rights and freedoms, SmartSoftArt commits to notifying the supervisory authority (CNPDCP) within 72 hours and informing affected data subjects without undue delay.
SUPERVISORY AUTHORITY
16. Right to Lodge Complaints with Supervisory Authorities
Should you believe your statutory privacy rights have been infringed, you maintain the legal entitlement to file a formal complaint with the competent supervisory body:
National Centre for Personal Data Protection (CNPDCP)📍 Address: MD-2004, Republic of Moldova, Chișinău, 48 Serghei Lazo Street
🌐 Portal:
www.datepersonale.md📧 Email:
centru@datepersonale.md | ☎️ Phone: +373 (22) 820-801
