Privacy Policy

1. General provisions

1.1. This Privacy Policy (the "Policy") sets out how S.R.L. "BUSINESS PROCESE", IDNO 1019600047127, registered office: Bulevardul Iuri Gagarin 10, MD-2001, Chișinău (the "Provider"), processes personal data in connection with the https://cookieyes.md website and the CookieYes platform (the "Service"), in accordance with Law No. 195/2024 on personal data protection.

1.2. The Provider acts as controller for the data listed in section 2.

1.3. For the data of Visitors to the websites on which Clients install the Script of the Service, the Provider acts as processor and the Client acts as controller. That processing is governed by the Data Processing Agreement.

2. Categories of data, purposes and legal bases

2.1. Account data: name, email address and password, which is stored only as a cryptographic hash. Purpose: creating and managing the account, authentication and communication about the Service. Legal basis: performance of the contractual relationship established by the Terms and Conditions.

2.2. Configuration data: the domains of the Sites, the Google Tag Manager container ID, the banner wording and settings, and screenshots of the public pages of the Sites. Purpose: providing the Service. Legal basis: performance of the contractual relationship.

2.3. Technical session data: IP address, browser type (user agent), session identifier, date and time of last activity. Purpose: keeping the website and the panel running and secure, and preventing unauthorised access. Legal basis: the Provider's legitimate interest in securing the Service.

2.4. Correspondence: the data contained in messages sent to the Provider. Purpose: handling and resolving requests. Legal basis: performance of the contractual relationship or, as the case may be, the Provider's legitimate interest in responding to requests.

2.5. The Provider does not process special categories of personal data and does not take decisions based solely on automated processing, including profiling.

3. Recipients

3.1. The Provider does not sell, rent out or pass on personal data for marketing purposes.

3.2. Data may be disclosed only:

• to infrastructure and electronic communications service providers acting as processors for the Provider, under contractual obligations of confidentiality and security;
• to public authorities, in the cases and within the limits provided by law.

4. Cross-border transfers

4.1. Data are stored on the infrastructure the Provider uses to provide the Service. Should it become necessary to transfer data to a country that does not ensure an adequate level of protection, the transfer will take place only with the safeguards provided by Law No. 195/2024.

5. Retention

5.1. Account data and configuration data are kept for as long as the account exists. After the account is closed, they are deleted within 30 days, except for data that must be kept by law.

5.2. Technical session data are kept for the duration of the session, which expires after 120 minutes of inactivity, and are then deleted periodically by automated means.

5.3. Correspondence is kept for as long as necessary to resolve the request and any related claims.

6. Rights of the data subject

6.1. Under Law No. 195/2024, the data subject has the following rights:

• the right of access to the data;
• the right to rectification of inaccurate data;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability;
• the right to object, including to processing based on the Provider's legitimate interest;
• the right not to be subject to a decision based solely on automated processing;
• the right to withdraw consent, where the processing is based on consent.

6.2. Requests to exercise these rights should be sent to the Provider at info@bpro.md. The Provider will respond within one month of receiving the request. Taking into account the complexity and number of requests, this period may be extended by up to two further months, in which case the requester will be informed of the extension and the reasons for it.

6.3. The data subject has the right to lodge a complaint with the National Center for Personal Data Protection (datepersonale.md) and to bring proceedings before a court.

6.4. Visitors to Clients' websites exercise their rights against the relevant Client as controller. Any such requests received by the Provider are forwarded to the Client without delay.

7. Security of processing

7.1. The Provider applies appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction or alteration, including:

• transmission of data over encrypted connections (HTTPS);
• storage of passwords only as cryptographic hashes;
• restriction of access to data on a need-to-know basis;
• separation of data belonging to different accounts.

8. Cookies

8.1. Information about the cookies used on the website and in the panel is set out in the Cookie Policy.

9. Changes to this Policy

9.1. The Provider may amend this Policy. The version in force is published on this page, together with the date of the last update.

10. Contact

10.1. For any question about the processing of personal data, the Provider can be contacted at info@bpro.md or by post at: Bulevardul Iuri Gagarin 10, MD-2001, Chișinău.