Personal Data Processing Policy

1. Controller and contact details

1.1. This Policy is drawn up in accordance with Law No. 195 of 25.07.2024 on personal data protection (in force since 23.08.2026), which transposes Regulation (EU) 2016/679 (GDPR) into the law of the Republic of Moldova.

1.2. The data controller is „NEXGEN LINE” S.R.L., IDNO 1025600024323:

• registered office: 6/5 Trifan Baltă St., Chișinău, MD-2021, Republic of Moldova;
• website: nexgen-line.dev.

1.3. Person responsible for data protection matters: Nicolae Druța, email: nicolae.druta@nexgen-line.dev.

1.4. We have not appointed a Data Protection Officer (DPO), as this is not mandatory for our activity (art. 37 of Law No. 195/2024). All requests should be sent to the person named in clause 1.3.

1.5. This Policy fulfils the obligation to inform data subjects under art. 13 and 14 of Law No. 195/2024.

2. What data we collect

2.1. We only collect the data you give us and the technical data strictly needed for the website to work. Marketing data (Meta Pixel) is collected only if you have consented:

2.2. The website does not let you create an account and does not process payments.

2.3. We do not ask for special categories of data (for example, health data, ethnic origin or religious beliefs — art. 9 of Law No. 195/2024). Please do not include such information in the problem description.

2.4. The form fields are required because without them we cannot review your request or reply to you. Giving us your data is voluntary: you can also write to us directly by email.

3. Purposes and legal bases

3.1. We process data only for the purposes below, each with a legal basis under art. 6(1) of Law No. 195/2024:

3.2. We do not send newsletters or promotional messages. We only contact you about the request you sent.

3.3. We do not sell your data or share it with third parties for their own purposes, except with Meta, and only if you accepted the Meta Pixel — see section 6.

4. Children's data

4.1. Our services are aimed at companies and the people who represent them. We do not knowingly collect children's data. Under Law No. 195/2024, a child can give consent online on their own from the age of 14.

4.2. If we learn that we have received the data of a child under 14 without the consent of a parent or legal guardian, we delete it without delay.

5. How long we keep data

5.1. We keep data only as long as needed for the purpose it was collected for, after which we delete or anonymise it:

6. Who we share data with

6.1. Only the people at NEXGEN LINE who need your request to reply to you have access to it.

6.2. We use service providers (processors, art. 28 of Law No. 195/2024) to host the website, deliver the form and host our email. They process data only on our instructions and under data protection contract terms. The full list is in Annex 1.

6.3. Meta Pixel — only with your consent. For collecting and transmitting data through the Meta Pixel we are joint controllers with Meta; after that, Meta processes the data as an independent controller under its privacy policy. For Meta's own processing at that stage, you can contact Meta directly.

6.4. We only share data with public authorities when the law requires it.

7. International data transfers

7.1. The providers in Annex 1 are companies based in the USA or the European Union, and data may be stored or accessed on servers outside the Republic of Moldova, including in the European Union and the USA.

7.2. These transfers take place only with the safeguards provided by Law No. 195/2024 — mainly the standard contractual clauses included in the providers' data processing terms. The Meta Pixel transfer takes place only after you consent. You can ask us for details of these safeguards using the contact details in clause 1.3.

8. Cookies

8.1. We only use strictly necessary storage and, only if you accept it, the Meta Pixel. Until you choose, the Meta Pixel does not load. Details and the full list are in the Cookie Policy.

9. Data security

9.1. We apply technical and organisational measures appropriate to the risks (art. 32 of Law No. 195/2024), including:

• encrypted connection (HTTPS, HSTS) across the whole website;
• form data is not stored on the website: it is sent encrypted, straight to the controller's mailbox;
• access to data only for authorised people, through protected accounts;
• infrastructure providers with internationally recognised security standards;
• collecting only the data that is strictly necessary.

10. Your rights

10.1. As a data subject, you have the following rights under Law No. 195/2024:

• the right of access to the data we process about you (art. 15);
• the right to have inaccurate data rectified (art. 16);
• the right to erasure (“right to be forgotten”), under the conditions of the law (art. 17);
• the right to restriction of processing (art. 18);
• the right to data portability (art. 20);
• the right to object to processing based on our legitimate interest (art. 21);
• the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you (art. 22);
• the right to withdraw consent at any time, as easily as you gave it (from “Cookie settings”), without affecting the lawfulness of processing before the withdrawal;
• the right to lodge a complaint with the National Center for Personal Data Protection (clause 13.2) or to go to court.

10.2. You can exercise your rights by sending a request to nicolae.druta@nexgen-line.dev. We may ask for additional information to confirm your identity.

10.3. We reply within one month of receiving the request. For complex or numerous requests, this may be extended by two further months, in which case we tell you about the extension and the reasons for it within the first month.

10.4. Exercising your rights is free. For manifestly unfounded or excessive requests, the law allows us to charge a reasonable fee or to refuse the request.

11. Automated decisions

11.1. We do not make decisions based solely on automated processing and we do not profile users. If you accept the Meta Pixel, Meta may use the data to show you ads; you can refuse or withdraw this consent at any time.

12. Personal data breaches

12.1. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we notify the National Center for Personal Data Protection within 72 hours of becoming aware of it (art. 33). If the risk is high, we also inform you without undue delay (art. 34).

13. Changes and final provisions

13.1. We may update this Policy from time to time to reflect changes in the law, recommendations of the supervisory authority or changes to the website. The version in force is always published at nexgen-line.dev/en/privacy-policy. We announce substantial changes on the website at least 30 days before they take effect.

13.2. The supervisory authority in the Republic of Moldova is the National Center for Personal Data Protection: 48 Serghei Lazo St., Chișinău, MD-2004; tel. (022) 820 801; email: centru@datepersonale.md; website: datepersonale.md.

13.3. This Policy is governed by the law of the Republic of Moldova. Any disputes are settled amicably or, failing that, by the competent courts of the Republic of Moldova.

13.4. The Policy is available in Romanian, English and Russian. In case of any discrepancy, the Romanian version prevails.

Annex 1 — Processors and recipients

Providers that may have access to data, strictly for the purposes shown: