Privacy policy

PRIVACY POLICY OF THE ALVASHOP.MD PLATFORM

Version: 1.0

GENERAL PROVISIONS

This Privacy Policy is drafted in accordance with Law No. 133/2011 on the Protection of Personal Data of the Republic of Moldova and the standards of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (GDPR), applied as a reference standard for consumers in the European area.

The personal data controller is the Limited Liability Company "ALVA ENTERPRISES", with its registered office at MD-4301, str. Dimitrie Cantemir 34, or. Căușeni, Republic of Moldova, IDNO 1024608002049, hereinafter referred to as the "Operator".

This policy applies to all personal data collected through the alvashop.md platform and related services. By using the platform, the User confirms that they have become acquainted with this policy and, where applicable, grants consent for the processing described below.

ARTICLE 1. CATEGORIES OF PERSONAL DATA COLLECTED AND SOURCES OF COLLECTION

1.1. Data provided directly by the User:

a) upon account registration: first and last name, email address, password (stored exclusively in an irreversible hashed form, never in clear text); b) upon authentication via Google OAuth: the display name and email address transmitted by Google LLC, in accordance with its own terms; c) upon placing an order: first and last name, full delivery address, phone number; d) upon subscription to the newsletter: email address; e) during communications with the ALVA team: the content of the correspondence, including complaints, requests, and reports.

1.2. Data collected automatically through the technical operation of the platform:

a) technical access data: IP address, browser type and version, operating system, screen resolution; b) navigation data: pages accessed, session duration, traffic sources, interactions with platform elements — collected through Google Analytics 4, with IP anonymization applied.

ARTICLE 2. PURPOSES OF PROCESSING AND LEGAL BASIS

2.1. Execution of the contract (Art. 6 par. 1 lit. b GDPR / Art. 5 Law 133/2011): processing, confirmation, shipment, and management of orders; creation and administration of the user account; communication with the User regarding their orders; handling complaints and exercising the right of return.

2.2. Legal obligation (Art. 6 par. 1 lit. c GDPR): keeping accounting and fiscal documents for periods imposed by the fiscal and commercial legislation of the Republic of Moldova.

2.3. Consent (Art. 6 par. 1 lit. a GDPR): transmission of commercial communications and newsletters, exclusively based on the express and freely expressed agreement of the User. Consent can be withdrawn at any time, without consequences, by accessing the unsubscribe link in any received email or by notifying the Operator at alvashop.md@gmail.com.

2.4. Legitimate interest (Art. 6 par. 1 lit. f GDPR): improving the functionality and user experience of the platform, based on anonymized navigation data; fraud prevention and ensuring the security of the platform.

ARTICLE 3. DURATION OF PROCESSING AND DATA STORAGE

3.1. Data necessary for the execution of orders and the fulfillment of legal accounting and fiscal obligations: 5 (five) years from the date of the transaction, according to the applicable fiscal legislation.

3.2. Data related to the active user account: for the entire duration of the account's existence. Upon deletion of the account, the data is anonymized or deleted, with the exception of those retained under the legal obligation mentioned in item 3.1.

3.3. Newsletter data: until the withdrawal of consent.

3.4. Anonymized navigation data (Google Analytics): maximum 14 (fourteen) months, according to the retention settings configured in the Google Analytics 4 platform.

ARTICLE 4. RECIPIENTS OF PERSONAL DATA

4.1. The Operator does not sell or transfer personal data to third parties for marketing purposes or for other purposes incompatible with those declared.

4.2. Data is transmitted exclusively to the extent necessary to the following recipients, as authorized processors or independent controllers:

a) Nova Posta SRL — for the purpose of shipping and delivering orders; transmitted data is limited to: recipient's first and last name, delivery address, phone number; b) Resend Inc. (USA) — transactional email service provider, used for sending order confirmations, password reset emails, and other technical communications. The transfer is carried out with adequate safeguards in accordance with the mechanisms provided by the GDPR for international transfers; c) Google LLC (USA) — through Google Analytics 4, for the purpose of anonymized traffic analysis, and through Google OAuth, for the purpose of authentication. Google LLC holds the Privacy Shield certification (its successor, the EU–US Data Privacy Framework) and processes data in accordance with its own data protection terms; d) UploadThing (USA) — storage service for product images.

4.3. The Operator may disclose personal data to competent public authorities if this is required by law or a valid court order.

ARTICLE 5. RIGHTS OF DATA SUBJECTS

5.1. In accordance with applicable legislation, the User benefits from the following rights, exercisable by sending a written request to alvashop.md@gmail.com:

a) Right of access — to obtain confirmation that their data is being processed and, if so, access to it and information regarding the processing; b) Right to rectification — to request the correction of inaccurate data or the completion of incomplete data; c) Right to erasure ("right to be forgotten") — to request the deletion of data when it is no longer necessary for the purpose for which it was collected, consent has been withdrawn and there is no other legal basis, or the processing is illegal, subject to legal retention obligations; d) Right to restriction of processing — under the conditions provided for by Art. 18 GDPR; e) Right to data portability — to receive the provided data in a structured, commonly used, and machine-readable format; f) Right to object — to object to processing for direct marketing purposes, with immediate effect, or to processing based on legitimate interest, under the conditions of Art. 21 GDPR.

5.2. The Operator responds to requests within a maximum of 30 (thirty) calendar days. The deadline may be extended by a maximum of 60 days in situations of particular complexity, with prior notification of the applicant.

5.3. The User has the right to file a complaint with the National Center for Personal Data Protection of the Republic of Moldova (CNPDCP), located in Chisinau, str. Serghei Lazo, 48, www.datepersonale.md.

ARTICLE 6. DATA SECURITY

6.1. The Operator applies appropriate technical and organizational measures for the protection of personal data against unauthorized access, disclosure, modification, or destruction, including: encryption of passwords through irreversible hash functions; transmission of data through secure protocols (HTTPS/TLS); restriction of access to customer data exclusively to authorized personnel.

6.2. In the event of a security incident of a nature to affect the rights and freedoms of the data subjects, the Operator will notify the competent authority and, if applicable, the affected persons, within the terms provided by applicable legislation.

ARTICLE 7. MODIFICATION OF THE POLICY

7.1. The Operator may update this policy whenever necessary. The updated version will be published on the platform with an indication of the date of entry into force. Registered users will be notified by email regarding essential changes.

CONTACT AND DATA PROTECTION OFFICER

Email: alvashop.md@gmail.com MD-4301, str. Dimitrie Cantemir 34, or. Căușeni, Republic of Moldova