Privacy policy

1. Who processes the data and what this policy covers

The data controller is S.R.L. «DIGITME», IDNO 1018600031574, Chișinău, str. Meșterul Manole 5, trading as Arctica Service (“we”). The website is arcticaservice.md.

This policy explains what the site collects, why, who we pass it to, how long we keep it and what you can do about it. It covers the website and the enquiries that start there: requests, bookings for a survey, installation or service, calls and correspondence.

Processing follows Law of the Republic of Moldova No. 195/2024 on personal data protection, which transposes Regulation (EU) 2016/679 (GDPR). The terms of the transaction itself are set out separately, in “Terms of sale, delivery and installation”.

Data questions: [email protected], +373 79 995 511.

2. What data we process

How much depends on what you do on the site.

• You tell us yourself: name, phone number; for a business quote — e-mail and company name; the address we travel to (locality, street, house, flat, floor), preferred date and time, preferred way to reach you (call, Telegram, WhatsApp), language, a comment, and whether you intend to use instalments.
• Comes from the order itself: the model and service chosen, installation type, extra work and amounts, date and time window, status, assigned crew, records of reminders already sent.
• A review, if you leave one: name, text and, optionally, photos of the work.
• Technical data: IP address, browser and device type, pages viewed and time on site, where you came from, campaign tags (utm, gclid, fbclid), first page visited, cookie identifiers. Without your consent, only the campaign tags from the link you followed (utm) are attached to a request — they describe the ad, not you; click identifiers (gclid, fbclid) and cookies are kept only with consent. The exception is a phone call: if you came to the site from a Google ad, the gclid click identifier from the landing page address is kept in the browser tab’s memory (sessionStorage) until the tab is closed. If you tap the phone number on any page of the site during that time, we pass the gclid to Google Ads together with the fact of the call, so the advertising knows which ad worked. Your phone number and other data about you are not passed; other identifiers and cookies are not kept without consent.

Please fill the free-text “comment” and “message” fields only with what relates to the order. We do not collect special category data — health, beliefs, origin — and ask you not to send it. The site is not intended for children under 16 and we do not knowingly collect their data.

3. Why we do it

• To take and fulfil the order: contact you, agree the scope, set a date, come out for the survey, carry out the installation or service, issue documents and warranty.
• To support the order: an SMS confirming the booking and a reminder the day before, a request to rate the work, a reminder about annual servicing.
• Warranty and complaints: keeping a record of work done and enquiries received.
• Keeping the site working and safe: form protection, access logs, recovery after failures.
• Understanding what works: anonymised visit statistics and measuring which advertising pays off. With cookies and identifiers — only with your consent; without it — anonymous signals only, see section 5.

4. Legal basis

• Contract and pre-contractual steps — everything needed to accept the request, come out and do the work. Without a name, phone and address we simply cannot.
• Legal obligation — accounting and tax records, responding to lawful requests from public authorities.
• Legitimate interest — site security, spam protection, records of enquiries, defending our rights in disputes. We weigh this against your rights and keep it to what is necessary.
• Consent — analytics and advertising cookies, sending hashed contacts to advertising systems, marketing messages. Consent can be withdrawn at any time; withdrawal does not make earlier processing unlawful.

5. Cookies and similar technologies

Until you answer the banner, and if you decline, no analytics or advertising cookies are set and no identifiers are stored in your browser. Google Analytics and Google Ads do receive anonymous signals through our server: that a page was opened and that a request was sent — no cookies, no visitor identifier, no name or phone. If you came from a Google ad, the ad-click marker from the page address is attached to the request signal: it points to the ad, not to you. Google uses such signals to assess advertising as a whole (Google Consent Mode). Meta (Facebook, Instagram) receives nothing without your consent. “Decline all” sits next to “Accept all”, the same size and on the same screen — declining is as easy as accepting.

• Necessary — always on: your cookie choice (arctica_consent, 365 days), interface language, form protection, the admin login session for our staff.
• Analytics — only after consent: _ga and _ga_QVGN9ZN1DP, FPID, FPLC (Google Analytics 4, up to 400 days) and sbjs_* (traffic source, up to 180 days).
• Advertising — only after consent: _gcl_au (Google Ads, 90 days), _fbp and _fbc (Meta, 90 days), _gtmeec (90 days).

Analytics runs through our own server, sgtm.arcticaservice.md: data reaches us first and only then the services. You can change your choice at any time on the “Cookies and analytics” page or by clearing cookies in your browser.

6. Who we share data with

We do not sell personal data and do not pass it to third parties for their own purposes. We share only with those without whom the order cannot be carried out, and only as much as needed:

• Bitrix24 (CRM) — name, phone, service address, order contents and amount: this is what the managers work from.
• sms.md — phone number and message text, to send the booking confirmation and reminder.
• Telegram — a notification about a new request to the company work group (name, phone, order contents).
• IUTECREDIT SRL — only if you chose instalments yourself: from then on you deal with them directly and the contract is with them.
• Google (Analytics 4, Ads) and Meta — where you consented to analytics and advertising. Personal parameters (phone, e-mail, name) do not reach the statistics reports — they are stripped out on our server. What goes to the advertising systems for conversion matching is an irreversibly hashed phone or e-mail: the contact cannot be reconstructed from it.
• Hosting and communications — our server in Chișinău (StarNet), and the operators carrying SMS and calls.
• Public authorities — on lawful request.

7. The “Help us with advertising” consent

The booking form and the request forms have a separate “Help us with advertising” checkbox. It is not ticked in advance and is not needed for the order: without it we accept and carry out the order exactly the same way. If you allowed “Marketing” in the cookie window, the checkbox is not shown: you have already given this consent there.

If you tick it, we pass your phone number and, if given, your name to Google (Google Ads) and Meta (Facebook, Instagram) — only in encrypted form: an irreversible SHA-256 hash that cannot be turned back into the number. Together with the hash we pass the fact of the request or completed order and its amount.

• Why: so that advertising systems can see which ads led to real orders and show them to people who find them useful, not to everyone.
• What happens next: Google and Meta compare the hash with their own users. If there is no match, the record is discarded. The data is used to measure and tune our advertising under the Google Ads and Meta Business Tools data processing terms.
• When: when you send the request and after the order is marked completed.
• Retention: the consent mark is kept with the order; Google and Meta keep the data they receive under their own rules.
• How to withdraw: email [email protected] or call +373 79 995 511. From then on we stop passing your data. Withdrawal does not affect the order.

8. Transfers outside the Republic of Moldova

Our site, database and analytics server are in Chișinău. Some recipients are foreign:

• Bitrix24: the company portal is hosted on servers in Russia. Name, phone, service address and order contents go there. We are moving the CRM to our own server in Moldova — until that move is finished this transfer exists, and we owe you a plain statement of it.
• Google and Meta: servers in the EU and the USA; transfers rely on your consent and on those companies’ standard contractual clauses.

If you would rather your data did not go into the CRM, tell the manager when you get in touch — the request can be handled without it.

9. How long we keep data

• A completed order — the warranty period plus three years: that is how long we must answer complaints and keep accounting records.
• A request that did not become an order — 12 months, then deleted or anonymised.
• Reviews — while published; we take them down at your request.
• Site technical logs — up to 12 months.
• Visit statistics — up to 26 months, anonymised.

If the period has expired but the data is still needed for a dispute or an inspection, we keep it until that ends.

10. How we protect it

The connection to the site is encrypted (HTTPS). Access to the CRM and the admin panel is by named accounts, only for staff who need it for their work. Database backups are made automatically and kept on the same server with restricted access. Service keys and tokens are stored in protected files on the server and never reach page code. System health is watched around the clock by a monitor, and failures are sent to the responsible person as a notification.

11. Your rights

You can: obtain confirmation that we process your data and a copy of it; correct anything inaccurate; ask for erasure (“the right to be forgotten”) where there is no lawful reason to keep it; restrict processing; object to processing based on legitimate interest and to direct marketing; withdraw consent; receive your data in a portable form.

We take no decisions based solely on automated processing that produce legal effects for you: every request is seen by a manager.

Send your request to [email protected] or call +373 79 995 511. We reply within 30 days; if the matter is complex we will tell you about the extension. If our answer does not satisfy you, you may complain to the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md).

12. Changes to this policy

We update this page when our mechanisms or the law change. The version date is shown at the top. Material changes affecting your rights are additionally shown in the banner on your next visit.