Privacy Policy

PRIVACY POLICY

on the processing and protection of personal data through the website https://bpm.md/

1. General provisions

S.R.L. “BPM-TRADE”, hereinafter referred to as the “Company” or the “Controller”, respects the rights of natural persons to privacy and to the protection of personal data.

This Policy explains how the Company collects, uses, retains and protects personal data through the website https://bpm.md/, as well as the rights of data subjects.

The Policy applies to website visitors, persons requesting information or quotations, customers, representatives of legal entities, and persons sending messages or documents through the available contact channels.

Processing is carried out in accordance with Law No. 195/2024 on Personal Data Protection and other applicable legislation.

The Policy is supplemented by the Cookie Policy and specific notices relating to the forms or services used.

Consulting the website or this Policy does not, in itself, constitute consent to all processing activities. Each activity has its own purpose and legal basis.

2. Personal data controller

The Controller is:

S.R.L. “BPM-TRADE”

Address: 78 Uzinelor Street, Chișinău Municipality, Republic of Moldova

Email: info@bpmplus.md

Telephone: +373 79 480 480

Website: https://bpm.md/

Data subjects may use these contact details for questions concerning data processing and the exercise of their rights.

3. Sources and categories of data

The Company obtains data directly from data subjects through forms, enquiries, correspondence and documents supplied. Certain technical data are generated while the website is being used.

Depending on the service used, the following may be processed:

• first name and surname;

• email address and telephone number;

• the position and professional details of an organisation's representative;

• information about products and quantities requested;

• information about pre-orders, orders and related communications;

• delivery address and details necessary for contracting or invoicing, where relevant;

• contents of enquiries, complaints and documents submitted;

• IP address, date and time of access, pages accessed, browser type, operating system and other technical data, to the extent collected by the service used;

• cookie choices and information necessary to demonstrate consent.

Where job applications are submitted, relevant information from CVs and documents concerning education, experience and skills may be processed.

The Company limits collection to necessary data. Users are asked not to submit complete copies of identity documents, full bank details, medical information or other data not needed for the request through general forms.

Voluntary provision of special categories of data does not, by itself, constitute a sufficient basis for processing them.

Where a representative's data are received from their organisation or another source, the Company provides the information required under Article 14 of Law No. 195/2024, subject to the applicable conditions and time limits.

4. Purposes and legal bases

Data are processed for the following purposes:

a) Requests for information and quotations

Data are used to examine the request, prepare a quotation and communicate a response.

For a natural person requesting steps prior to entering into their own contract, the basis is Article 6(1)(b). For representatives of legal entities, the basis may be the legitimate interest in communicating and managing the business relationship under point (f).

b) Pre-orders, orders and contractual relationships

Necessary data are used to verify requests, communicate, enter into contracts, deliver and perform obligations undertaken.

The bases are performance of a contract or pre-contractual steps, applicable legal obligations and, for representatives' data, the legitimate interest in managing the relationship with the organisation.

c) Enquiries and complaints

Data are used to examine the circumstances, prepare a response and take necessary measures.

The basis is determined according to the nature of the request: performance of a contract, compliance with a legal obligation or the legitimate interest in remedying the situation and defending the Company's rights.

d) Website operation and security

Necessary technical data are used for server communications, operation of services, diagnosing errors and preventing abuse.

The basis is the legitimate interest in ensuring the secure operation of the website and protecting services and persons.

e) Cookies and optional services

Article 6(1)(a) and the conditions of Article 7 apply to optional processing based on consent.

f) Legal obligations and defence of rights

Data may be processed to comply with accounting, tax or other applicable obligations, as well as to establish, exercise or defend a right.

When relying on legitimate interests, the Company assesses the necessity and proportionality of processing and takes into account individuals' rights and reasonable expectations.

5. Provision of data

Mandatory fields are marked in the forms. Data are mandatory only insofar as they are necessary for the requested operation.

Failure to provide indispensable information may prevent submission of a form, preparation of a response or fulfilment of the request. Additional data should be provided only where relevant.

Viewing pages does not require the provision of a name or contact details, but may entail the processing of technical data necessary for communications and security.

Rejecting analytics or marketing cookies does not prevent the submission of an enquiry or use of the functions necessary for the shopping cart.

6. Pre-orders, orders and correspondence

Data relating to selected products and enquiries are used for the commercial transaction and the communications necessary for it.

The terms governing the conclusion and performance of contracts are established by the applicable commercial documents.

Messages and documents are accessible to authorised personnel and, where necessary, to recipients involved in handling them. An enquiry is not automatically converted into a subscription to advertising.

7. Job applications and promotional communications

Where a person submits a job application, relevant data are used for assessment, communication and organisation of the selection process.

Retention of an application for future opportunities requires a separate choice. The proposed period for this purpose does not exceed 12 months from the date consent is given, unless the specific notice establishes a shorter period.

Communications necessary for an enquiry or contractual relationship are distinct from marketing.

If a service for subscribing to promotional communications is introduced, the terms and legal basis will be explained separately. A person may object to direct marketing at any time, free of charge and without giving reasons.

8. Cookies and technical services

The website uses cookies and similar technologies according to the purposes and choices described in the Cookie Policy.

Google Tag Manager, a tag management tool, is integrated into the website. The data processed depend on the services configured through it. Its presence alone does not establish the use of Google Analytics or advertising.

Optional services must be classified by purpose and effectively controlled through “Cookie Settings”, without activation before consent where consent is required.

Continuing to browse does not constitute consent to optional processing. A choice may be changed or withdrawn through “Cookie Settings”.

9. External content and platforms

The website may include or provide access to content and services supplied by third parties, such as:

• the Company's presentation hosted on Google Drive, including through an embedded preview;

• links to materials or pages on YouTube and other content distribution platforms;

• links to the Company's pages or profiles on social networks such as Facebook, Instagram and LinkedIn;

• contact links through WhatsApp, Viber, Telegram or other communication applications.

Embedded content. Loading a preview, video or another service embedded in a website page may result in the transmission of technical data, such as an IP address and browser or device information, to the provider of the relevant platform. If such a service is optional and processing is based on consent, it will be loaded only after the corresponding choice has been made.

External links. Accessing an external link is different from loading a service embedded in a website page. When opening a link to an external platform, the user may be redirected to the provider's website or application. From that point, the provider may process data in accordance with its own privacy policy and terms of use.

Communication through external applications. If the user contacts the Company through WhatsApp, Viber, Telegram or another communication application, the Company processes the message and information supplied to consider the enquiry and provide a response. The message is not automatically used to subscribe the user to promotional communications. Users are asked not to transmit sensitive information or data unnecessary for the request.

Providers' policies explain their processing activities and supplement the Company's information. They do not replace the Company's obligations regarding the data it processes.

10. Recipients of data

To the extent necessary for the purpose, data may be disclosed to:

• authorised personnel;

• hosting, maintenance, security and email service providers;

• partners involved in delivery or performance of the transaction;

• legal or accounting advisers involved;

• authorities and institutions having a legal basis;

• providers of external services actually activated.

The Company does not sell personal data.

For providers processing data on its behalf, the Company establishes the contractual terms required by Article 28. Each provider's role is assessed according to the service; providers do not all automatically have the same legal status.

11. Transfers to other countries

External services may involve the transmission, storage or access of data outside the Republic of Moldova.

The actual destinations, applicable mechanism and means of obtaining a copy of the safeguards must be explained in the notice specific to the service. Further information may be requested at info@bpmplus.md.

12. Retention periods

Data are not retained indefinitely.

• Enquiries and correspondence: until examination and communication are completed; thereafter, only to the extent necessary for a legal obligation or an identifiable claim.

• Commercial and contractual documents: for the duration of the transaction and thereafter for the statutory periods applicable to the category of document.

• Complaints: during examination and remediation and, where applicable, for the period necessary to manage the related obligations or claims.

• Technical data: for the period necessary for operation, security and investigation of incidents, in accordance with the documented configuration.

• Job applications: until the selection process is completed; for future opportunities, no more than 12 months on the basis of a separate choice or until withdrawal.

• Consent records: for as long as the choice applies and, where applicable, as long as necessary to demonstrate compliance.

A cookie's lifetime is not automatically the retention period for data on the server.

Upon expiry of the period, data are erased, effectively anonymised or restricted in accordance with the law. Where litigation exists, only relevant information is retained.

13. Data security

The Company implements technical and organisational measures appropriate to the risks, including access controls, confidentiality obligations, protection of communications, system updates and backup management, according to the infrastructure used.

The measures are intended to prevent unauthorised access, loss, alteration and unauthorised disclosure.

Where an incident requires notification under the law, the Company informs the authority and, where applicable, the affected persons.

14. Rights of data subjects

Under the conditions prescribed by law, individuals have the rights to:

• information and access;

• rectification;

• erasure;

• restriction of processing;

• data portability, where applicable;

• object;

• withdraw consent;

• safeguards concerning decisions based solely on automated processing that produce legal effects or similarly significant effects;

• lodge a complaint and seek judicial redress.

Withdrawal of consent does not affect the lawfulness of prior processing. Erasure does not remove statutory retention obligations.

Objection to direct marketing is free of charge and requires no justification.

15. Exercise of rights

Requests should be sent to info@bpmplus.md or in writing to the Controller's address.

Individuals should specify the right they wish to exercise and provide sufficient information to identify the relevant data. The Company does not automatically request a copy of an identity document; additional proportionate checks are carried out only where there are reasonable doubts.

A response is provided without undue delay, within one month. The period may be extended by up to two months under the conditions prescribed by law, provided that the person is informed of the reasons within the first month.

Exercising rights is, in principle, free of charge. Exceptions apply only as permitted by law and must be justified.

Complaints may be addressed to the National Centre for Personal Data Protection:

Website: https://datepersonale.md/

Email: centru@datepersonale.md

Address: 48 Serghei Lazo Street, Chișinău Municipality

Telephone: +373 22 820 801

Contacting the Company beforehand is not a mandatory condition for lodging a complaint.

16. Automated processing and minors

Calculating quantities or values in the configurator and shopping cart does not, in itself, constitute a decision based solely on automated processing that produces legal effects or similarly significant effects.

If such a process is introduced, the Company will provide the applicable information and safeguards before its use.

The website is not designed to collect children's data for marketing purposes. If a minor's data are received, the Company checks the necessity and legal basis for processing and applies the specific rules.

17. Updates to the Policy

The Policy is updated when services, purposes, recipients or legal requirements change.

Processing for a new purpose is preceded by the necessary information and determination of the applicable legal basis. If new consent is required, it is obtained before processing.

Publication of changes and continued browsing do not replace consent.

Last updated: 06.10.2026.