Privacy Policy
Online store acoperispentrufiecare.md
Version 1.2 — August 19, 2026
1. Personal Data Controller
This Privacy Policy describes how your personal data is processed when you use the acoperispentrufiecare.md website (hereinafter referred to as the "site").
The personal data controller is:
| Name | ACOPERIS PENTRU FIECARE SRL |
| IDNO | 1021600050881 |
| VAT Code | 0509124 |
| Registered Office | mun. Chișinău, str. Alba-Iulia nr. 200, bl. 1, ap. 141, Republic of Moldova |
| E-mail for data protection | [email protected] |
The controller has not appointed a Data Protection Officer (DPO), as, according to legal criteria, such an appointment is not mandatory for the activity performed. For any aspect related to data protection, the responsible contact person can be reached at the details indicated above.
2. Applicable Legal Framework
The processing of personal data is carried out in accordance with:
- Law no. 195/2024 on the protection of personal data, which enters into force on August 23, 2026 — this Policy is drafted in accordance with its requirements (in particular, Art. 13–14 regarding information, Art. 12–22 regarding the rights of the data subject, Art. 6–8 regarding the grounds for processing and consent, Art. 44–49 regarding international transfers);
- Law no. 133/2011 on the protection of personal data, which remains applicable until August 23, 2026, the date on which it is repealed by Law no. 195/2024.
3. What data we process, for what purposes, and on what grounds
We collect only the data that you provide directly through the site's forms or that are necessary for the operation of the requested services. We do not process special categories of personal data.
| Purpose | Legal Basis | Data Categories | Retention Period | Recipients |
|---|---|---|---|---|
| Contact form / call request — contacting you regarding the submitted request | Pre-contractual steps at the request of the data subject (Art. 6 para. (1) let. b) of Law no. 195/2024) | Name, phone, message | 12 months | Authorized personnel of the Controller |
| Request via roof calculator — contacting you with the calculated offer | Pre-contractual steps at the request of the data subject (Art. 6 para. (1) let. b)) | Name, phone, e-mail, roof parameters | 12 months | Authorized personnel of the Controller |
| Placing and executing orders (checkout) | Execution of the contract (Art. 6 para. (1) let. b)); subsequently — legal obligation for accounting records (Art. 6 para. (1) let. c)) | Name, phone, e-mail, delivery address, order content | 6 years (accounting obligation — Standard Document Indicator, State Archival Service Order no. 57/2016, pos. 228, and Art. 266 of the Tax Code), after which the data is anonymized | 1C accounting system (Moldova); Resend Inc. (transactional emails) |
| Customer account (direct registration or authentication via Google) | Execution of the contract (Art. 6 para. (1) let. b)) / consent (Art. 6 para. (1) let. a)) | Name, surname, e-mail, phone, password (stored exclusively as a hash), delivery addresses, order history | Accounts inactive for more than 3 years are anonymized | Authorized personnel of the Controller; Google (only when authenticating via Google, at your choice) |
| AI roof visualizer — generating an image of your house with the chosen roof | Consent / provision of the requested service (Art. 6 para. (1) let. a) and b)) | Uploaded photo of the house, technical data (IP address, device type) | 90 days | Google (Gemini API — see section 4.1) |
| Marketing communications (newsletter, offers) | Exclusively your separate consent, expressed by checking the opt-in box (Art. 6 para. (1) let. a), Art. 7) | Name, e-mail | Until withdrawal of consent | Resend Inc. (sending emails) |
| Online advertising and measurement of its performance — showing relevant ads on Meta platforms (Facebook, Instagram), TikTok and across the Google network, including to people who visited the site (remarketing), and measuring conversions | Exclusively your consent for the "Marketing" category in the cookie banner (art. 6 para. (1) let. a), art. 7) | Cookie and device identifiers, IP address, pages viewed and actions on the site (e.g., adding to cart, submitting an order) — without your name, phone number or e-mail | Until consent is withdrawn; the cookies themselves — for the periods stated in the Cookie Policy | Meta Platforms Ireland Limited; TikTok Technology Limited; Google Ireland Ltd. / Google LLC |
Internal notifications sent to the Controller's authorized personnel (e.g., upon receiving an order or request) contain the client's contact data strictly to the extent necessary for processing the respective order or request; personnel are bound by confidentiality.
4. Details regarding certain processing
4.1. AI Visualizer and Google Gemini
For the roof visualization function, the photo uploaded by you is processed through the Google Gemini API service (paid tier). In this relationship, Google acts as a data processor, based on a Data Processing Agreement (DPA) that incorporates the European Union's Standard Contractual Clauses (EU SCCs). Important clarifications:
- Google does not use your photos to train its artificial intelligence models;
- Google may retain the transmitted content for up to 55 days, exclusively for the purpose of monitoring abuse;
- processing by Google may take place, among others, in the United States of America (see section 6 regarding international transfers).
Photos and related technical data are kept by the Controller for 90 days, after which they are deleted.
4.2. Authentication via Google (Google OAuth)
You can choose to create your account and authenticate via your Google account. This option is used exclusively at your choice; in this case, Google transmits to us the account identification data necessary for authentication (name, e-mail address).
4.3. Marketing communications
We send marketing communications only if you have expressed your separate consent by checking a dedicated box (opt-in). Consent does not condition the placing of orders or the use of the site. You can withdraw your consent at any time, free of charge, via the unsubscribe link included in every email or by contacting us at the details in section 1. Withdrawal of consent does not affect the legality of the processing carried out before the withdrawal.
4.4. Online advertising (Meta, TikTok, Google Ads)
If you allow the "Marketing" category in the cookie banner, the advertising measurement tools Meta Pixel, TikTok Pixel and Google Ads may be loaded on the site, as well as the Google Signals feature of Google Analytics — each from the moment the corresponding advertising campaign is launched. They transmit to the respective providers cookie and device identifiers, your IP address and your actions on the site, in order to measure advertising performance and to show relevant ads (remarketing). In relation to this processing, the Controller and the listed providers act, under their contractual terms, as joint controllers for the collection and transmission stage, while further processing for the providers' own purposes is carried out by them as independent controllers.
These tools involve advertising profiles created by the providers. We do not use them for automated decisions producing legal effects concerning you (see section 13). You may withdraw your consent at any time via the "Cookie Settings" button in the site footer — upon withdrawal, the cookies of this category are deleted from your browser and transmission ceases. Full details about each tool, the cookies placed and their lifetimes are in the Cookie Policy.
5. Data recipients. Processors
Your data may be transmitted to the following categories of recipients, strictly to the extent necessary for the described purposes:
| Recipient | Role / Purpose | Location | Guarantees |
|---|---|---|---|
| 1C accounting system | Processing and recording of orders | Republic of Moldova | Data processing agreement |
| Resend Inc. | Sending transactional and marketing emails | USA | DPA with EU Standard Contractual Clauses (EU SCCs) |
| Gemini API — processing photos from the visualizer; Google OAuth — authentication at user's choice; Google Analytics 4 (via Google Tag Manager) — site usage statistics, only with your consent to analytics cookies; Google Ads and Google Signals — advertising, remarketing and conversion measurement, only with your consent to marketing cookies | including USA | DPA with EU Standard Contractual Clauses (EU SCCs) | |
| Meta Platforms Ireland Limited | Meta Pixel — measuring the performance of Facebook and Instagram ads and remarketing, only with your consent to marketing cookies | Ireland; including USA (Meta Platforms, Inc.) | Meta's data processing terms, with EU Standard Contractual Clauses (EU SCCs) |
| TikTok Technology Limited | TikTok Pixel — measuring the performance of TikTok ads and remarketing, only with your consent to marketing cookies | Ireland; including USA and Singapore | TikTok's data processing terms, with EU Standard Contractual Clauses (EU SCCs) |
| Cloudflare Inc. | CDN / site traffic protection | USA | DPA with EU Standard Contractual Clauses (EU SCCs) |
| Oracle Cloud | Hosting the site and database | Frankfurt, Germany (EEA) | Hosting in the European Economic Area |
We do not sell or transmit your data to third parties for purposes other than those described in this Policy. Data may be disclosed to public authorities only in cases provided by law.
6. International data transfers
Data is hosted on servers located in the European Economic Area (Frankfurt, Germany), to which the transfer is free.
Certain providers indicated in section 5 (Resend Inc., Google, Cloudflare Inc., Meta Platforms and TikTok) may process data outside the European Economic Area, in particular in the United States of America and, in TikTok’s case, also in Singapore. These transfers are carried out based on the standard contractual clauses adopted by the European Commission (EU SCCs), included in the data processing agreements concluded with these providers:
- from August 23, 2026 — pursuant to Art. 46 para. (2) let. c) of Law no. 195/2024, which recognizes the standard contractual clauses adopted by the European Commission as adequate guarantees, without the need for specific authorization from the supervisory authority;
- until August 23, 2026 — pursuant to Art. 32 para. (5) of Law no. 133/2011.
7. Data retention periods
We keep data only as long as necessary for the purposes for which they were collected, as follows:
- requests via contact and calculator forms — 12 months from submission;
- data related to orders — 6 years, pursuant to the legal obligation to keep primary accounting documents (Standard Document Indicator, Order no. 57/2016, pos. 228; Art. 266 of the Tax Code); upon expiration of the term, identification data is anonymized;
- customer accounts — for the duration of account usage; accounts inactive for more than 3 years are anonymized;
- photos and technical data from the AI visualizer — 90 days;
- data for marketing communications — until withdrawal of consent;
- data collected through marketing cookies (online advertising, remarketing) — until consent is withdrawn; the cookies themselves expire within the periods stated in the Cookie Policy (as a rule, between 90 days and 13 months);
- log of consents and acceptances (proof — who, when, and for what gave or withdrew consent, including the associated e-mail address; Art. 7 of Law no. 195/2024) — for the duration of the consent's validity, and after account deletion — for another 3 years, for the establishment, exercise, or defense of legal claims (Art. 17 para. (3) let. e) of Law no. 195/2024; general statute of limitations — Art. 391 of the Civil Code), after which the records are permanently deleted.
After the expiration of the terms, the data is deleted or irreversibly anonymized; anonymized data no longer constitutes personal data.
8. Your rights
In accordance with Art. 12–22 of Law no. 195/2024 (until August 23, 2026 — the corresponding rights from Law no. 133/2011), you benefit from the following rights:
- right of access — to obtain confirmation of processing and a copy of your data;
- right to rectification — to request the correction of inaccurate data or the completion of incomplete data;
- right to erasure ("right to be forgotten") — to request the deletion of data, under the conditions of the law;
- right to restriction of processing;
- right to data portability — to receive the provided data in a structured, commonly used, and machine-readable format;
- right to object — to object to processing, including, at any time and unconditionally, processing for direct marketing purposes;
- right to withdraw consent — at any time, without affecting the legality of processing prior to withdrawal.
How to exercise your rights. Send a request:
- by e-mail: [email protected];
- by mail: ACOPERIS PENTRU FIECARE SRL, mun. Chișinău, str. Alba-Iulia nr. 200, bl. 1, ap. 141, Republic of Moldova.
We will respond within at most one month from receiving the request; in complex cases or in the event of a large number of requests, the term may be extended by at most two months, with information provided to you about the reasons for the extension (Art. 12 para. (3) of Law no. 195/2024). Exercising your rights is free of charge. In case of reasonable doubts regarding the identity of the requester, we may request additional information to confirm identity.
9. Right to lodge a complaint
If you believe that the processing of your data violates data protection legislation, you have the right to lodge a complaint with the supervisory authority:
National Center for Personal Data Protection of the Republic of Moldova (CNPDCP)
Address: MD-2004, mun. Chișinău, str. Serghei Lazo nr. 48, Republic of Moldova
Site: datepersonale.md
You also have the right to address the court.
10. Data security
We apply appropriate technical and organizational measures for data protection, including:
- traffic encryption (HTTPS) throughout the site;
- storing passwords exclusively as a cryptographic hash (passwords are not stored in plain text);
- restricting and differentiating access to data based on roles — access is limited to authorized personnel;
- hosting data on servers located in the European Economic Area.
11. Cookies
The site uses:
- own cookies, strictly necessary for the site's operation (session, security, language preferences) — these do not require consent;
- functional and analytics cookies (Google) — placed only with your consent, expressed through the cookie banner;
- marketing cookies (Meta, TikTok, Google Ads) — placed only with your consent for the "Marketing" category; you may withdraw it at any time from "Cookie Settings".
Detailed information about the cookies used, their durations, and how to manage preferences are available in the Cookies Policy: /politica-de-cookies/.
12. Minors
The site's services, as information society services, are addressed to persons who have reached the age of 14 (Art. 8 of Law no. 195/2024). For persons under 14, processing based on consent is legal only with the consent or authorization of the legal representative. The products sold are intended, by their nature, for adult buyers.
13. Automated decision-making
We do not make decisions based solely on automated processing which would produce legal effects concerning you or similarly significantly affect you.
If you allow marketing cookies, the advertising platforms listed in sections 4.4 and 5 create advertising profiles based on your browsing behaviour in order to show you relevant ads. The sole effect of this processing is the selection of the ads you see; it does not affect access to the site, prices, product availability or the fulfilment of orders, and it produces no legal effects concerning you. You may object at any time by withdrawing your consent from "Cookie Settings".
14. Modification of this Policy
We may periodically update this Policy, including to reflect legislative changes or changes to our services. The updated version, with the version number and publication date, will be available on this page. In case of substantial changes, we will ensure appropriate information to users.
15. Contact
For any questions regarding this Policy or the processing of your personal data:
- E-mail: [email protected]
- Mail: ACOPERIS PENTRU FIECARE SRL, mun. Chișinău, str. Alba-Iulia nr. 200, bl. 1, ap. 141, Republic of Moldova
Version 1.2 — August 19, 2026.