Privacy & Data Protection Policy

Under Law No. 195/2024, all data processing operations conducted by COFFEESHOP S.R.L. adhere strictly to the following principles:

• Lawfulness, Fairness, and Transparency: Data is collected fairly, legally, and transparently.
• Purpose Limitation: Collected strictly for specified, explicit, and legitimate business purposes.
• Data Minimization: Restricted to what is strictly necessary in relation to processing purposes.
• Accuracy: Kept accurate and, where necessary, updated upon user notification.
• Storage Limitation: Retained only for as long as necessary to fulfill legal or commercial requirements.
• Integrity and Confidentiality: Protected against unauthorized processing, loss, destruction, or damage using appropriate technical controls.

We process different categories of personal data depending on your interaction with www.coffeeshop.md:

A. E-Commerce Order Fulfillment & Delivery

• Data Collected: First and Last Name, Delivery Address, Phone Number, Email Address, Order History.
• Legal Basis: Contract Performance — Processing is required to complete, deliver, and bill your purchases.

B. Fiscal & Legal Compliance

• Data Collected: Invoicing Details, Payment Records, Transaction Identifiers.
• Legal Basis: Legal Obligation — Compliance with tax, accounting, and financial laws of the Republic of Moldova.

C. Commercial Communications (Newsletters & SMS Marketing)

• Data Collected: Name, Email Address, Mobile Phone Number.
• Legal Basis: Explicit Consent (Opt-In) — We send marketing communications only if you have voluntarily subscribed through a separate, un-prechecked consent box. Consent can be withdrawn at any time.

D. User Account Management

• Data Collected: Username, Encrypted Password, Communication Preferences, Saved Addresses.
• Legal Basis: Contract Performance & Legitimate Interest — Facilitating seamless client management and order tracking.

E. Technical & Browsing Data (Cookies)

• Data Collected: IP Address, Device Type, Browser Type, Session Logs, Referral URLs.
• Legal Basis: Legitimate Interest (for essential website security and operation) and Explicit Consent (for analytical pixels such as Google Analytics or Meta Pixel).

COFFEESHOP S.R.L. never sells or leases your personal data. Data is shared exclusively with verified third-party processors necessary for operations under strict contractual confidentiality agreements:

• Payment Gateways & Banks: BC Moldova Agroindbank SA (MAIB ECOMM), MIA Instant Payment infrastructure for encrypted transaction handling.
• Courier & Delivery Partners: Specialized postal and courier services for order delivery across Chisinau and the Republic of Moldova.
• IT, Hosting & Accounting Infrastructure: Cloud hosting providers, database software (1C Enterprise), and system maintenance technicians.
• Analytics & Digital Marketing Providers: Google Analytics 4, Meta Pixel (active only upon explicit cookie consent).
• Public Authorities: State agencies, courts, or law enforcement authorities, solely where required by mandatory legal obligations in the Republic of Moldova.

Personal data is retained only for as long as necessary to achieve the purpose for which it was collected or to fulfill statutory obligations:

• Invoices & Financial Transaction Logs: Retained for 5 years following fiscal year closure, as mandated by accounting law.
• User Accounts: Retained as long as the account remains active, or deleted within 30 days of a valid account closure/deletion request.
• Marketing Subscriptions: Retained until the user clicks "Unsubscribe" or formally revokes consent.
• Session Cookies & Logs: Retained according to specific cookie life cycles (ranging from session duration up to 24 months for analytics).

Our website utilizes cookies and similar tracking technologies to optimize browsing performance and analyze user interactions.

A. Essential Cookies (Strictly Necessary):

Required for basic shopping cart functionality, login authentication, and website security. These are active by default under Legitimate Interest.

B. Non-Essential Cookies (Analytics & Marketing):

Performance tools like Google Analytics 4 or Meta Pixel help us understand user navigation and display relevant promotions. These tools are activated only if you grant explicit consent via our Cookie Consent Banner.

Managing Cookie Preferences: You can modify or withdraw your cookie choices at any time by clicking the Cookie Settings link in our website footer or by clearing your browser cache.

Under Law No. 195/2024, you hold comprehensive rights regarding your personal data:

• Right to Information & Access: Request confirmation on whether your personal data is processed and obtain a copy of held records.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): Request full deletion of your personal records, subject to mandatory legal retention overrides.
• Right to Restriction of Processing: Request temporary restriction of data processing in legally defined circumstances.
• Right to Data Portability: Request your data in a structured, standard, machine-readable format (JSON/CSV) or direct transfer to another controller.
• Right to Object & Revoke Consent: Object to processing based on legitimate interests or withdraw direct marketing consent at any time without negative consequences.
• Right to File a Complaint: You have the right to lodge a formal complaint with the supervisory authority:
  National Centre for Personal Data Protection of the Republic of Moldova (CNPDCP)
  Website: https://datepersonale.md/

You can request the deletion of your account and personal records at any time using one of the following methods:

Method 1: Email Request

Send an email to [email protected] with the subject line "Personal Data Deletion Request". Please state your full name, username, and associated email address. Deletion requests are processed free of charge within 30 calendar days.

Method 2: Meta / Facebook Single Sign-On Deletion

If you signed in or registered using Meta/Facebook credentials, you can remove application permissions and initiate automated data deletion directly via Facebook Account Settings:
Facebook Settings & Privacy > Settings > Apps and Websites > Coffeeshop.md > Remove / Request Data Deletion.

COFFEESHOP S.R.L. implements advanced physical, administrative, and technical controls (including SSL encryption, secure servers, access restrictions, and regular database audits) to prevent unauthorized data access, loss, or misuse.

We reserve the right to update this Privacy Policy periodically to reflect legal or technical changes. Any modifications will be posted directly on this page with an updated revision date.

For any questions or requests regarding your personal data, please contact our Data Protection team at [email protected].