Privacy Policy

Version: 1.0
Last updated: 16.09.2026
Effective date: date of publication on the website

Version history: v1.0 — replaces the privacy notice of 25 June 2024.

1. Who we are

The controller of personal data processed through the website fmd.md is the Limited Liability Company „FlagMAN-D" (FlagMAN-D SRL):

- IDNO (tax code): 1008600029969
- VAT code: 0507564
- Registered office: MD-2012, Chișinău, 65 Mitropolit Varlaam Street, office 232
- Telephone: +373 22 27 99 98, +373 68 001 787
- E-mail for requests concerning personal data: office@fmd.md

FlagMAN-D SRL is an audit entity entered in the Public Register of Audit Entities under individual number 1903044.

We process data in accordance with Law No. 195/2024 on personal data protection, in force since 23 August 2026. Processing before that date was governed by Law No. 133/2011, repealed on the same date.

This policy applies to data processed through the fmd.md website and its language versions, the contact form, the blog newsletter subscription and the contact channels indicated on the website. Processing of data under service contracts is summarised in clause 3 and described in detail in the contract with the client.

2. What data we process, for what purpose and on what legal basis

What we do	Data processed	Legal basis
Receive a request sent through the contact form, reply and prepare an offer	first name, last name, company name, telephone, e-mail address, message	Article 6(1)(b) of Law No. 195/2024 — steps taken at your request prior to entering into a contract, where you request the services in your own name; Article 6(1)(f) — our legitimate interest in communicating with the representative of a prospective client, where you act on behalf of a company
Keep a record of requests and correspondence	the same data, date and channel of the request	Article 6(1)(f) — legitimate interest in consistent communication and in replying to repeated requests
Send new blog articles and information about our services, if you have subscribed	e-mail address, name if provided, subscription and unsubscription history	Article 6(1)(a) — consent; Article 22(1) of Law No. 284/2004
Apply customer due diligence measures before a business relationship begins	identification data of the client, its representatives and beneficial owners, copies of identity documents	Article 6(1)(c) — legal obligation: Article 5 of Law No. 308/2017
Provide contracted services: audit, accounting, tax and financial advisory, HR documentation	data necessary to perform the contract, within the limits it sets	Article 6(1)(b) — performance of a contract; Article 6(1)(c) — obligations under Law No. 271/2017 and accounting and tax legislation
Ensure the operation and security of the website	IP address, device and browser type, pages accessed, date and time	Article 6(1)(f) — legitimate interest in keeping the website operational and preventing abuse
Measure website traffic	identifiers stored in cookies, browsing data and visit source	Article 6(1)(a) — consent, given through the cookie banner
Assess the effectiveness of advertising campaigns and show ads to website visitors (remarketing)	advertising identifiers from cookies, page view and request submission events — without contact details	Article 6(1)(a) — consent, given through the cookie banner
Publish the audit entity's transparency report	names and positions of management, data of shareholders and auditors to the extent required by law	Article 6(1)(c) — legal obligation: Article 29(1) of Law No. 271/2017
Manage the company's social media pages	data you provide directly on those platforms: comments, messages	Article 6(1)(f) — legitimate interest in communicating with the public

Whether providing data is mandatory. Your telephone number and e-mail address are needed to reply to you; without them the form cannot be submitted. Your name, company name and message are optional. Data requested under customer due diligence measures is mandatory by law: without it we cannot begin a business relationship (Article 5 of Law No. 308/2017).

Contact form data is not transmitted to advertising platforms — not even in hashed form. The platforms only receive the fact that a request was submitted from a device on which marketing cookies were accepted.

We do not take automated decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 of Law No. 195/2024.

3. Situations that require further explanation

Clients and anti-money laundering obligations. As a reporting entity within the meaning of Article 4(1)(l) of Law No. 308/2017, we are required to identify clients and beneficial owners before a business relationship begins and to retain the related documents. Under Article 12(1) of the same law, we may not inform clients or third parties that information has been reported to the Office for Prevention and Fight against Money Laundering. This prohibition limits, to the extent provided by law, the right of access described in clause 7 (Article 23(1)(d) of Law No. 195/2024).

Professional secrecy. Information about clients' activities obtained during audit engagements is confidential and remains so after the contract ends (Article 22(1) of Law No. 271/2017). It may be disclosed only in the cases set out in Article 22(3): at the request of a court or criminal investigation body, during external quality control, with the authorisation of the audited entity, or in other cases provided by law.

Data of clients' employees. Where, under a contract, we maintain HR records or calculate payroll for a client, we process its employees' data on behalf of and on the instructions of the client, as a processor (Article 28 of Law No. 195/2024). In such cases the client is the controller and the terms of processing are set out in the contract.

Special categories of data. We do not request health data or other special categories of data through the website. Please do not include them in your message.

Other persons' data. If you include another person's data in your message, such as a colleague's, you confirm that you are entitled to provide it and that the person has been informed.

Minors. The website is intended for companies and adults and is not directed at children.

4. Who we share data with

We do not sell your data. We share it only with the following categories of recipients, to the extent necessary:

- the provider of the website and form platform, as a processor;
- providers of e-mail, task management and document storage services through which we receive and handle requests;
- the provider of the e-mail newsletter service, for blog subscribers;
- providers of web analytics and online advertising tools — only on the basis of consent given through the cookie banner and only in respect of browsing data;
- social network operators, in respect of data you provide directly on those platforms;
- the Office for Prevention and Fight against Money Laundering and supervisory bodies, in the cases provided by Law No. 308/2017;
- the Public Audit Oversight Council, during external quality control (Article 22(3)(b) of Law No. 271/2017);
- other public authorities, courts and criminal investigation bodies, upon their request, in the cases provided by law;
- legal advisers, in the event of a dispute.

With processors we have contracts imposing confidentiality and security obligations, in accordance with Article 28 of Law No. 195/2024.

5. International transfers

Some providers process data on servers located outside the Republic of Moldova:

- the website platform is administered by a company in the United Arab Emirates, with data stored on servers in European Union member states and technical support from the Republic of Kazakhstan;
- the task management service stores data in the United States of America;
- the e-mail newsletter service stores data on servers in the European Union;
- analytics and advertising tools (Google, Meta, LinkedIn) process data in the United States of America and the European Union.

Transfers are carried out in accordance with Articles 44–49 of Law No. 195/2024, on the basis of an adequacy decision or of the appropriate safeguards provided by law and included in contracts with the providers. Further details may be requested at office@fmd.md.

6. How long we keep the data

Category	Retention period
Requests sent through the form that did not result in a contract, together with the correspondence	12 months from the last contact
Blog subscribers' data	until unsubscription; proof of consent and of its withdrawal — a further 3 years
Documents and information obtained under customer due diligence measures	for the duration of the business relationship and 5 years after it ends (Article 9(2) of Law No. 308/2017); the period may be extended by up to 5 years at the request of the authorities (Article 9(2¹))
Audit file	at least 5 years (Article 25(2) of Law No. 271/2017)
Accounting and tax documents	the periods set by accounting, tax and archival legislation
Transparency report published on the website	at least 5 years from publication (Article 29(1) of Law No. 271/2017)
Data collected through cookies	according to the lifetime of each cookie, shown in the settings panel — see the Cookie Policy
Statistical data in the web analytics tool	no more than 14 months
Remarketing lists	30 days from the last visit
Requests to exercise rights and our replies	3 years after resolution, to demonstrate compliance (Article 5(2) of Law No. 195/2024)

The 12-month period for requests without a contract is set by the company by reasoned decision under Article 10(3) of Law No. 284/2004. Upon expiry of these periods the data is deleted.

7. Your rights

Under Articles 15–22 of Law No. 195/2024 you have the right of access to your data, of rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw consent at any time, as easily as it was given, without affecting the lawfulness of earlier processing (Article 7(3)).

Objection to direct marketing. You may object at any time to the processing of your data for direct marketing; we will then stop processing it for that purpose (Article 21(2) and (3)). Every message sent to subscribers contains an unsubscribe link.

Objection to processing based on legitimate interest. Where we process data under Article 6(1)(f), you may object on grounds relating to your particular situation (Article 21(1)).

Limitations. The right to erasure does not apply to data we are required to retain by law or need to establish, exercise or defend legal claims (Article 17(3)). The right of access is limited to the extent set out in Article 12(1) of Law No. 308/2017.

Requests should be sent to office@fmd.md and are handled within one month of receipt (Article 12(3)); for complex requests the period may be extended by two months, in which case we inform you within the first month.

If you consider that the processing infringes your rights, you may lodge a complaint with the National Centre for Personal Data Protection, MD-2004, Chișinău, 48 Serghei Lazo Street, datepersonale.md, or bring the matter before a court.

8. Data security

We apply technical and organisational measures to protect data: a secure HTTPS connection, access to data according to employees' duties, staff confidentiality obligations, selection of providers with appropriate security safeguards, and deletion of data upon expiry of the retention periods. A general confidentiality and security obligation is also laid down in Article 10(1) of Law No. 284/2004.

In the event of a personal data breach we notify the National Centre for Personal Data Protection within 72 hours (Article 33), and where the breach entails a high risk to your rights we also inform you (Article 34).

9. Cookies

The rules on cookies, their categories and how to manage your preferences are described in the Cookie Policy.

10. Changes to this policy

We update this policy whenever the way we process data changes. The version in force and the date of the update are shown in the header.

11. Contact

For any question concerning the processing of personal data: office@fmd.md.

Related documents: Terms of Use, Cookie Policy.

This text is a translation. The Romanian version is the reference version; in the event of any discrepancy, the Romanian text prevails.