Privacy Policy

Last updated: 19.09.2026

1. Controller and scope

This Policy describes how SC „ECOLUX” SRL processes the personal data of persons who
access or use the ecolux.md website, in accordance with Law No. 195/2024 on the protection
of personal data and the principles set out in art. 5 of this law.

The controller of personal data is SC „ECOLUX” SRL, IDNO 1004600018022,
with its registered office in Chișinău, str. 31 August 1989, no. 79/1, apt. 29, central
office in Chișinău, str. Sfântul Gheorghe 3, e-mail: office@ecolux.md, tel.: +373 22 500 963.

This Policy concerns processing carried out through the website. Information on processing
carried out by ECOLUX within commercial and contractual relationships, delivery, installation,
service, invoicing or debt recovery is provided separately on the
“Personal Data Protection” page.

2. Categories of data processed

Depending on how you use the website, ECOLUX may process the following categories of data:

• identification and contact data provided by the data subject, such as name and surname,
  phone number, e-mail address, company and position, if provided;
• the content of messages, requests for quotes, contact requests, complaints or other
  communications sent through the website;
• data relating to orders, products or services about which the person requests information
  through the website;
• technical data generated when using the website, such as IP address, device type,
  browser, operating system, date and time of access, pages visited, online identifiers and
  information associated with cookies.

The IP address and other online identifiers may constitute personal data when they allow
the direct or indirect identification of a person. ECOLUX does not request special categories
of personal data through the website, except where their provision is necessary and permitted
by law.

3. Sources of data

Data may be obtained directly from the data subject, through the forms or communication
channels available on the website, as well as automatically, through the website’s technical
logs and through cookies or similar technologies, under the conditions described in the
Cookie Policy.

4. Purposes and legal bases of processing

ECOLUX processes data only to the extent necessary and on the basis of a legal ground
provided in art. 6 of Law No. 195/2024. Mainly:

• to respond to requests, requests for quotes and questions, as well as to carry out
  pre-contractual steps requested by the data subject – performance of a contract or
  pre-contractual steps (art. 6 para. (1) let. b));
• for the operation, administration and technical security of the website, prevention of
  abuse and protection of systems – the legitimate interest of ECOLUX (art. 6 para. (1) let. f));
• for fulfilling the legal obligations applicable to ECOLUX – legal obligation
  (art. 6 para. (1) let. c));
• for commercial communications, newsletters or promotions, when sent on the basis of the
  person’s consent – consent (art. 6 para. (1) let. a));
• for establishing, exercising or defending a right and preserving evidence – the
  legitimate interest of ECOLUX and, where applicable, other grounds provided by law.

Consent is not requested when the processing has another valid legal basis. When processing
is based on consent, it may be withdrawn at any time, without affecting the lawfulness of
processing carried out before withdrawal (art. 7 para. (3) of Law No. 195/2024).

5. Cookies and analytics services

The website uses strictly necessary cookies for its operation. Analytics and statistics
cookies, including services such as Google Analytics, are activated only under the conditions
and on the basis of the options expressed through the website’s consent mechanism, to the
extent that consent is required.

Details on cookie categories, purposes, duration and how to change preferences are provided
in the Cookie Policy available on
the website.

6. Recipients of data

Data may be accessed or disclosed, strictly to the extent necessary for the purpose of
processing, to:

• authorized employees and collaborators of ECOLUX;
• providers of IT, hosting, cloud, e-mail, website maintenance, security and web analytics
  services;
• professional consultants, when disclosure is necessary to defend the rights of ECOLUX;
• public authorities or other entities, when disclosure is required or permitted by law.

When a provider processes data on behalf of ECOLUX, the relationship is governed under the
conditions of art. 28 of Law No. 195/2024.

7. Transfers to other states

To the extent that the providers used for the operation of the website involve transfers of
data to other states or international organizations, transfers are carried out only under the
conditions of Chapter V (art. 44–49) of Law No. 195/2024. Transfers to Member States of the
European Economic Area do not require special authorizations (art. 44 para. (2)). For other
states, the mechanisms and safeguards provided by law apply, as appropriate.

8. Retention period

Data is kept only for as long as necessary for the purpose for which it was collected and
for fulfilling the applicable legal obligations. Requests and correspondence are kept for the
time necessary to resolve them and, where applicable, for establishing, exercising or
defending a right. Data used for marketing is processed until consent is withdrawn or until
the right to object is exercised. Technical logs and data associated with cookies are kept
according to security needs and the periods indicated in the Cookie Policy.

9. Rights of the data subject

Under the conditions of Law No. 195/2024, the data subject benefits, where applicable, from
the following rights:

• the right to be informed about the processing (art. 12–14);
• the right of access to data (art. 15);
• the right to rectification (art. 16);
• the right to erasure of data (art. 17);
• the right to restriction of processing (art. 18);
• the right to data portability, in the cases provided by law (art. 20);
• the right to object, including to direct marketing (art. 21);
• the right not to be subject to a decision based solely on automated processing, under
  the conditions of art. 22;
• the right to withdraw consent at any time, when processing is based on consent
  (art. 7 para. (3));
• the right to lodge a complaint with the National Center for Personal Data Protection
  (art. 72).

To exercise these rights, requests may be sent to office@ecolux.md or to the central office
of ECOLUX. ECOLUX will respond within the time limit and conditions provided by art. 12 of
Law No. 195/2024.

10. Data security

ECOLUX applies technical and organizational measures appropriate to the risk to protect
data against unauthorized access, loss, destruction, alteration or unauthorized disclosure,
in accordance with art. 32 of Law No. 195/2024. In the event of a personal data breach, the
obligations provided by art. 33–34 of the same law apply.

11. The right to lodge a complaint

If the data subject considers that the processing of their data infringes the applicable
legislation, they may contact the National Center for Personal Data Protection: MD-2004,
Chișinău, str. Serghei Lazo 48, e-mail: centru@datepersonale.md, tel.: (022) 820 801, as well
as the competent court under the conditions of the law.

12. Updating the Policy

ECOLUX may update this Policy when relevant legislative, technical or operational changes
occur. The updated version is published on the website, indicating the date of the last
update. If the change concerns processing based on consent and a new consent is required, it
will be requested before continuing that processing.