Privacy and Personal Data Protection Policy

1. General provisions

This Policy describes how GRIMGALA S.R.L., operating under the Veritas Advisory brand, processes personal data submitted through eugeniasavina.md.

Personal data is processed in accordance with Law No. 195/2024 on Personal Data Protection and other applicable legislation of the Republic of Moldova.

2. Data controller

The personal data controller is:

GRIMGALA S.R.L.
Commercial brand: Veritas Advisory
Representative: Eugenia Savina
Tax code: 1002600049017
Email: [email protected]
Website: eugeniasavina.md

For personal data protection requests:

[email protected]

3. Personal data processed

Depending on the use of the website, the following data may be processed:

• first and last name;
• email address;
• company;
• position or professional role;
• field of activity;
• information submitted through forms;
• appointment date and time;
• information required to organize the Clarity Session;
• correspondence with Veritas Advisory;
• technical data required for the operation and security of the website, where such data is collected.

Where a contractual relationship is established, additional data required for contracting, invoicing and compliance with legal obligations may also be processed.

4. Purposes of processing

Data may be processed for:

• managing and assessing requests;
• scheduling and organizing the Clarity Session;
• communicating with the person submitting the request;
• preparing a potential collaboration;
• providing and administering contracted services;
• complying with accounting, tax and legal obligations;
• website security;
• protecting the legitimate rights and interests of the controller.

Data is not used for purposes incompatible with those for which it was collected.

5. Legal basis

Depending on the purpose, processing may be based on:

• steps taken at the request of the individual before entering into a contract;
• performance of a contract;
• compliance with a legal obligation;
• the legitimate interests of the controller;
• consent, where required by law.

6. Appointment scheduling

To schedule a Clarity Session, the individual selects an available date and time and provides the information necessary to organize the meeting.

Google Calendar and Google Meet may be used to manage the calendar and conduct online meetings.

The data strictly necessary for scheduling may be processed through the technology providers used.

7. Recipients of data

Data may be accessible, only to the extent necessary, to providers involved in:

• website hosting and maintenance;
• IT services;
• email services;
• calendar and videoconferencing;
• accounting;
• payment processing, where used;
• other professional services required for business operations.

Data may be disclosed to public authorities where required by law.

Veritas Advisory does not sell users' personal data.

Where a service provider involves processing outside the Republic of Moldova, the transfer is carried out in accordance with applicable legislation.

8. Retention period

Data relating to requests that do not result in a collaboration is retained for 6 months and is then deleted or anonymized unless another lawful basis requires further retention.

Data relating to contractual relationships is retained during the collaboration and thereafter for the periods required by applicable legislation.

Technical data is retained only for as long as necessary for system operation and security.

9. Data security

Veritas Advisory applies appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, destruction or improper use.

Access is limited to persons and service providers for whom it is necessary.

10. Rights of the data subject

Subject to applicable law, the individual may request, as appropriate:

• access to personal data;
• rectification;
• erasure;
• restriction of processing;
• objection to processing;
• data portability;
• withdrawal of consent where processing is based on consent.

Requests should be sent to:

[email protected]

The individual also has the right to lodge a complaint with the National Centre for Personal Data Protection of the Republic of Moldova, in accordance with applicable law.

11. Information submitted through the form

The “What would you like to clarify?” field is intended for a general description of the business matter.

Unless specifically requested, do not submit passwords, full banking details, copies of identity documents, medical data, third-party personal data or confidential commercial documents through the form.

Where additional documents are required, the method of transmission will be agreed separately.

12. Policy updates

This Policy may be updated to reflect changes in legislation, services used or data processing practices.

The current version and the date of the latest update are published on the website.