Roles of the Parties
16.1. This Section governs the processing of personal data carried out by the Provider on behalf of the Beneficiary in the course of providing the Services and is drawn up in accordance with Article 28 of Law No. 195/2024 on personal data protection (the “Law”). Where Regulation (EU) 2016/679 (GDPR) applies to the Beneficiary, this Section also applies for the purposes of Article 28 GDPR.
16.2. The Beneficiary is the controller of the personal data of the website’s customers and visitors. The Beneficiary alone decides which data to collect, for what purpose, on what legal basis and for how long to keep them. The Provider supplies the Platform and processes these data solely as a processor, to the extent necessary for the Platform to operate.
16.3. The Provider is an independent controller only of the data of the Beneficiary itself and of the users of its Account: accounts, logins and passwords for the admin panel, contact and payment details, and data needed for tax invoicing and technical support. The Provider processes these data to conclude and perform the Agreement, issue tax invoices, provide technical support and comply with legal requirements. They are kept for the term of the Agreement and thereafter for the period required by accounting legislation. Recipients may include the Provider’s service providers (hosting, email, support tools). Details are set out in the Privacy Policy published at https://ecom.md/en/privacy-policy. This Section does not apply to these data.
16.4. The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in the Law.
Subject matter, nature, purpose and duration of processing
16.5. The subject matter of processing is the personal data that the Beneficiary and the website’s customers and visitors enter on the Platform or that arise from its use.
16.6. Nature of processing: collection through website forms, recording, storage, display in the Account, backup, transfer to integrations connected by the Beneficiary, export and deletion.
16.7. The purpose of processing is the provision of the Services: operation of the website and the Account, hosting, technical maintenance, technical support and Platform security. The Provider does not use these data for its own purposes, including advertising, and does not share them with other Beneficiaries.
16.8. Processing lasts for the term of the Agreement and the period of return and deletion under clauses 16.32–16.35. While the Agreement is in force, the Provider does not delete data on its own initiative: retention periods are set by the Beneficiary, who deletes data using the Account.
16.9. The Beneficiary’s instructions are this Agreement, the Beneficiary’s settings and actions in the Account, and its written requests to technical support.
Categories of data and data subjects
16.10. The Provider processes the following categories of data (the actual scope depends on the Beneficiary’s settings):
| Data subjects | Personal data |
|---|
| Website customers | Order data: name, email, phone, delivery address, comment, items and total, payment and delivery method, IP address, traffic source tags. Customer account: name, email, phone, addresses, favourites, social login identifier. Data entered in the checkout form before an order is placed. Reviews: name, email, text |
| Website visitors | IP address, browser technical data, Platform cookies, cookie consent log (choice, date, IP address, browser) |
16.11. Customer passwords are stored only as an irreversible hash. Customers enter bank card data on the page of the bank or payment system: the Platform neither receives nor stores card data and keeps only the transaction identifier and status. If the Beneficiary has enabled sending login credentials in the email to the customer, the password is sent to the customer by email (clause 16.25).
16.12. The Platform is not intended for special categories of personal data (health, biometric, criminal records, etc.). The Beneficiary undertakes not to place or collect such data through the Platform.
Obligations of the Provider
16.13. The Provider undertakes:
a) to process personal data only on the Beneficiary’s documented instructions (clause 16.9), including with regard to transfers to other countries. Where processing is required by law, the Provider informs the Beneficiary before processing unless the law prohibits such information;
b) to inform the Beneficiary without delay if, in the Provider’s opinion, an instruction infringes the Law;
c) to give access to personal data only to staff who need it to provide the Services and have committed in writing to confidentiality;
d) to take the technical and organisational security measures required by Article 32 of the Law and described in Annex 2;
e) to engage sub-processors only under clauses 16.17–16.19;
f) to assist the Beneficiary in responding to data subject requests (clauses 16.29–16.30);
g) to assist the Beneficiary in ensuring security of processing, notifying personal data breaches, data protection impact assessments and consultations with the supervisory authority, within the information available to the Provider;
h) after termination of the Agreement, to return and delete personal data under clauses 16.32–16.35;
i) to make available to the Beneficiary the information demonstrating compliance with this Section and to contribute to audits (clauses 16.36–16.37).
16.14. The Provider’s staff log into the Beneficiary’s Account and see customer data only to configure the website, provide technical support and fix malfunctions. Changes they make are recorded in a log.
Obligations of the Beneficiary
16.15. As controller, the Beneficiary:
a) determines in the Account settings which data the website collects (checkout form fields, customer registration, reviews), for what purpose and how long they are kept, and ensures a legal basis for processing;
b) publishes a privacy policy and a cookie policy on the website and keeps them up to date;
c) obtains customers’ consent where required by law, including for marketing messages and analytics cookies;
d) decides which third-party services, counters, pixels and scripts to connect to the website and is responsible for their use;
e) responds to data subject requests and, where required, notifies the supervisory authority and data subjects of personal data breaches;
f) is responsible for the lawfulness of the instructions it gives to the Provider;
g) manages its staff’s access to the Account and is responsible for the security of access credentials under clause 9.3.
16.16. Third-party services connected to the website at the Beneficiary’s choice (payment systems, lenders, delivery services, CRM and accounting systems, mailing services, analytics, advertising pixels) are not sub-processors of the Provider. Data are transferred to them on the Beneficiary’s instruction, and the Beneficiary governs its relationship with them independently. The Provider does not send marketing messages to the Beneficiary’s customers on its own behalf and does not install analytics or advertising scripts on the website. If the Beneficiary has not set its own sender address, order emails to customers are sent from the Platform’s address on behalf of and as instructed by the Beneficiary.
Sub-processors
16.17. The Beneficiary gives the Provider general authorisation to engage other processors (“sub-processors”) listed in Annex 1.
16.18. The Provider concludes with each sub-processor a contract imposing data protection obligations no less protective than those in this Section and is liable to the Beneficiary for the sub-processor’s acts as for its own.
16.19. The Provider gives notice of adding or replacing a sub-processor by publishing an updated Annex 1 under Section 12 at least 14 calendar days before the change. Within this period the Beneficiary may send a reasoned written objection. If the Parties do not find a solution, the Beneficiary may withdraw from the Agreement before the date of the change without observing the notice period in clause 13.1 a).
Data location and international transfers
16.20. The main database containing personal data, files and backups are stored on the servers of the hosting provider listed in Annex 1, in the Republic of Moldova.
16.21. Some sub-processors listed in Annex 1 process data outside the Republic of Moldova — in the European Union and the USA. Such transfers take place only with the safeguards provided in Articles 44–50 of the Law, including contractual data protection clauses concluded with the sub-processor.
16.22. The Provider gives notice of any change in the country of data storage under clause 16.19.
Security measures
16.23. The Provider applies the technical and organisational measures described in Annex 2.
16.24. The Provider may change these measures as the Platform evolves, provided the level of protection is not reduced.
16.25. The Beneficiary is responsible for security on its side: strength and safekeeping of passwords, Account user permissions, protection of the devices used to log in, and enabling the security features available in the Account (two-factor authentication, sign-out from all devices, IP address restrictions), as well as for the choice of customer notification settings, including sending login credentials by email.
Personal data breaches
16.26. The Provider notifies the Beneficiary of a security breach affecting its data under Section 17, without undue delay and no later than 48 hours after becoming aware of it.
16.27. The notification contains: a description of the breach; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken and planned; a contact point. Information not yet available is provided as it becomes known.
16.28. The Provider takes measures to remedy the breach and its consequences. Notifying the supervisory authority and data subjects remains the Beneficiary’s obligation; the Provider does not do so on its behalf without instruction.
Requests from data subjects and authorities
16.29. If a data subject contacts the Provider directly, the Provider forwards the request to the Beneficiary within 5 working days and does not respond to it on the merits.
16.30. The Beneficiary handles data subject requests itself: export of orders and customers is available in the Account, and customers can delete their own accounts. If this is not sufficient, the Provider, upon the Beneficiary’s written request, exports or deletes the data of a specific customer within 15 working days. On deletion, orders are anonymised where the Beneficiary must keep them for accounting purposes.
16.31. The Provider informs the Beneficiary of a public authority’s request to disclose the Beneficiary’s personal data before disclosure, unless the law prohibits such information.
Return and deletion of data
16.32. Within 30 calendar days after termination of the Agreement, the Beneficiary may, free of charge, export data from the Account (orders — XLSX or CSV, customers — CSV, via API — JSON) or request a full export of personal data. Migration of the website is carried out under clause 11.4.
16.33. After this period, the Provider deletes personal data from the production database within a reasonable time and from backups as they are rotated; in any case, the data are fully deleted no later than 12 months. Until deleted from backups, the data are not used.
16.34. Before termination of the Agreement, the Beneficiary may request deletion of data without return. The Provider keeps data beyond these periods only when and to the extent required by law.
16.35. Upon the Beneficiary’s written request, the Provider confirms the deletion in writing.
Audits
16.36. Upon the Beneficiary’s written request, but no more than once a year, the Provider provides within 20 working days information on compliance with this Section: a description of security measures, the list of sub-processors and answers to the Beneficiary’s questions. Detailed infrastructure information is provided on a confidential basis. The frequency limit does not apply after a security breach or at the request of the supervisory authority.
16.37. If this information is not sufficient, the Beneficiary may carry out an audit itself or through an independent auditor bound by confidentiality. The Beneficiary gives 30 calendar days’ notice of the audit. The audit takes place during working hours, without access to other Beneficiaries’ data and at the Beneficiary’s expense.
Liability and relation to other Sections
16.38. The Provider is liable only for performing the processor obligations set out in the Law and this Section and for the acts of its sub-processors. The Beneficiary is responsible for the lawfulness of collecting and using customer data, the website’s privacy policy, services and scripts it connects, responses to data subjects and notifications to the supervisory authority. Otherwise, the Parties’ liability is governed by Section 10.
16.39. In matters of personal data processing, this Section prevails over the other provisions of the Agreement.
16.40. Requests concerning personal data should be sent to the Provider at help@ecom.md.