PRIVACY POLICY

IDNO / Code: 1024600086083

Company registration date: 2024-11-26

Legal form: Limited Liability Company

Administrator: DARACCI ANDREI

Personal Data Controller: “LIVE MOMENT GROUP” S.R.L.

The Controller's contact details (legal/postal address, email address and telephone number) are published in the Platform's contact section and kept up to date. If the appointment of a data protection officer is mandatory under Article 37 of Law No. 195/2024 or such officer is appointed voluntarily, their contact details are also published on the Platform.

This Privacy Policy explains how the operator of the Moment.md platform collects, uses, stores, transfers and protects the personal data of users, persons who create or administer memorial pages, persons who submit messages or multimedia content, and other persons whose data may appear when using the service. This Policy applies in accordance with Law of the Republic of Moldova No. 195 of 25.07.2024 “On the Protection of Personal Data”, effective from 23.08.2026. Processing is carried out in compliance with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, as well as the Controller's accountability (Article 5 of Law No. 195/2024).

This Policy applies to all data processing operations carried out through the website, online forms, electronic communications, orders, user accounts and related platform services.

The Policy shall be interpreted together with the Website Terms of Use, Cookie Policy and other documents published by the operator.

This Policy also applies to data processing within moderation mechanisms, complaints, requests from relatives, heirs, users, rights holders and public authorities.

Law No. 195/2024 applies to information concerning identified or identifiable natural persons. Information relating exclusively to a deceased person is, in itself, not personal data of that person for the purposes of that Law; however, data of living relatives, authors of messages, page administrators and other persons contained on a memorial page or in related materials are processed in accordance with this Policy and Law No. 195/2024.

• identification and contact data (first name, surname, email, telephone number, address, etc.);
• account and service-use data (IP address, logs, browser, device, online identifiers, interaction history);
• uploaded content data (photos, texts, videos, biographies, messages, comments, etc.);
• order and payment data (selected plan, payment history, invoices, transaction status);
• third-party data (deceased persons, relatives, authors of messages, etc.);
• complaint and request data (identity of the applicant, contact details, relationship to the deceased, grounds, evidence, correspondence, technical logs, moderation history).

Sources of data: directly from the user/data subject; from the memorial page administrator, applicant, relative, representative or other person providing materials; from publicly available sources — only where there is a lawful basis; from payment and other service providers or competent authorities within applicable legislation. If data are not obtained from the data subject, the Controller provides the information required by Article 14 of Law No. 195/2024, in the cases and within the periods established by law.

If uploaded content contains special categories of personal data of living persons or data concerning convictions and offences, their processing is permitted only where the corresponding additional condition provided for respectively by Articles 9 and 10 of Law No. 195/2024 is present; in the absence of such a basis, the Controller may restrict processing or delete the relevant information.

• creation, management and publication of memorial pages;
• account management and performance of contractual relations;
• processing of orders, payments, invoices and refunds;
• provision of services and related products (including QR codes);
• provision of technical support, communications and security;
• fraud prevention and protection of the Controller's rights;
• compliance with legal, tax and other obligations;
• handling complaints and moderating content;
• processing requests from users, relatives and rights holders;
• interaction with public authorities.

Providing data necessary for account creation, conclusion and performance of the contract, payment and compliance with mandatory legal requirements is mandatory to the relevant extent; without such data, certain services cannot be provided. Providing data for optional functions, marketing and non-essential cookies is voluntary, unless otherwise expressly provided by law.

• consent of the data subject;
• performance of a contract or pre-contractual measures;
• compliance with legal obligations;
• legitimate interest of the Controller or a third party — in particular, ensuring the security and stable operation of the Platform, preventing fraud, protecting rights and handling substantiated complaints, subject to assessment and balancing against the interests, rights and freedoms of the data subject (Article 6(1)(f) of Law No. 195/2024);
• establishment, exercise or defence of legal claims — on the applicable basis under Article 6 of Law No. 195/2024, and in relation to special categories of data, where the condition provided for in Article 9(2) of Law No. 195/2024 is present;
• transfer of data to competent public authorities — where there is a legal obligation or another legal basis provided by law, and only to the necessary and proportionate extent.

For account management, orders, payment and provision of ordered services, the primary basis is performance of the contract or taking steps prior to entering into a contract; for accounting, tax and other mandatory requirements — legal obligation; for security, prevention of abuse, moderation and protection of rights — legitimate interest, following the necessary balancing assessment; for non-essential cookies, marketing and other operations where consent is required — valid consent. Where processing is based on consent, it may be withdrawn at any time as easily as it was given, without affecting the lawfulness of processing carried out before withdrawal (Article 7 of Law No. 195/2024).

• employees and authorised persons of the Controller;
• contractors (hosting, IT, payments, accounting, delivery, etc.);
• public authorities;
• memorial page administrators (within the framework of complaints);
• lawyers, consultants and partners.

Recipients' access to personal data is limited to the extent necessary for the relevant purpose. Persons processing data on behalf of the Controller are engaged under terms consistent with Article 28 of Law No. 195/2024, including processing on documented instructions, confidentiality and appropriate security measures.

If personal data are transferred to a recipient in a third country or to an international organisation, such transfer is carried out only in accordance with Chapter V of Law No. 195/2024 — on the basis of an adequacy decision or where appropriate safeguards/another mechanism provided by law exists. Information about the relevant transfer and applicable safeguards is provided to the data subject to the extent required by law.

• data are stored for the duration of service provision and performance of obligations;
• content is stored according to the selected plan until deletion or termination of the service;
• after the period expires, data are deleted, anonymised or archived;
• complaint and dispute data are stored until resolution and within applicable limitation periods.

In all cases, the storage limitation principle applies: data are retained only for the period necessary for the stated purposes, performance of the contract, compliance with legally established retention periods (including accounting and tax obligations) and protection of rights within applicable limitation periods. After the relevant period expires, data are deleted or irreversibly anonymised unless further retention is required by law.

• right to information;
• right of access;
• right to rectification;
• right to erasure;
• right to restriction and objection;
• right to data portability — in the cases and to the extent provided for by Article 20 of Law No. 195/2024;
• right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the person, except in the cases and subject to the safeguards provided for in Article 22 of Law No. 195/2024;
• right to withdraw consent — at any time, without prejudice to the lawfulness of processing before withdrawal;
• right to lodge a complaint with the National Center for Personal Data Protection (CNPDCP) and right to judicial protection.

The Controller applies reasonable technical and organisational measures to protect data.

The user is responsible for maintaining the confidentiality of their account credentials and reporting unauthorised access.

The Controller applies technical and organisational measures appropriate to the level of risk, including, where necessary, access controls, backups, encryption/pseudonymisation, logging and periodic review of the effectiveness of security measures (Article 32 of Law No. 195/2024).

In the event of a personal data breach capable of creating a risk to the rights and freedoms of natural persons, the Controller shall notify the CNPDCP without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach; where a high risk is likely, the data subject shall be informed without undue delay in accordance with Articles 33–34 of Law No. 195/2024. The Controller documents security breaches and measures taken.

The Platform may use cookies for functionality, preferences, analytics and security.

Strictly necessary cookies are used without consent; other cookies are used only with the user's consent.

Details are set out in a separate Cookie Policy.

Consent to non-essential cookies must comply with the requirements of Article 7 of Law No. 195/2024 and may be withdrawn at any time with effect for the future through the preference-management mechanism.

Requests shall be submitted through the contact details indicated on the website.

The Controller provides information on measures taken without undue delay and no later than one month from receipt of the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a maximum of two additional months; the data subject shall be informed of the extension and its reasons within the first month (Article 12 of Law No. 195/2024).

For identity verification, the Controller may request only additional information necessary and proportionate to establish the identity of the applicant; excessive documents shall not be requested.

Access to third-party data is provided only where there is a lawful basis.

Requests from public authorities are checked for legality.

Information and actions in response to data subject requests are generally provided free of charge; in the case of manifestly unfounded or excessive requests, in particular repetitive requests, the Controller acts within the limits permitted by Article 12 of Law No. 195/2024.

The Controller may periodically update this Policy.

The updated version enters into force upon publication, unless otherwise provided by law.

If the Controller intends to further process personal data for a purpose different from the purpose for which they were collected, the data subject shall, before such further processing, be provided with information about the new purpose and other information required by Articles 13–14 of Law No. 195/2024. If consent is required for the new processing, it shall be requested before such processing begins.