Privacy policy

1.1 Personal Data Controller

Within this internal regulatory document, the terms “Company” or “Microinvest” refer to the entire Microinvest Group, namely O.C.N. Microinvest S.R.L. and Microinvest Technology S.R.L., as applicable, or only to O.C.N. Microinvest S.R.L., depending on the specific context in which they are used, and to the extent that the provisions are applicable to both entities or only to O.C.N. Microinvest S.R.L., unless otherwise expressly specified in this document.

O.C.N. MICROINVEST S.R.L. is a company registered in accordance with the legislation of the Republic of Moldova with the State Registration Chamber on 29.04.2003, having the unique fiscal code 1003600053518, with its registered office at 12 Bd. Renașterii Naționale, Chisinau municipality, which processes data in the capacity of a personal data controller, in accordance with the provisions of Law No. 195 of 25 July 2024 on the protection of personal data (hereinafter referred to as Law No. 195/2024) and other legislative and regulatory acts governing the protection of personal data, with the object of activity being the provision of non-bank financial services. In specific cases, it may process personal data as a data processor appointed by Microinvest Technology S.R.L.

Microinvest Technology S.R.L. is a company registered in accordance with the legislation of the Republic of Moldova, on 14.06.2023, having the unique fiscal code 1023600031802, with its registered office at 12 Renașterii Naționale Blvd., Chisinau municipality, which processes personal data in the capacity of a data processor on behalf of the controller, acting for O.C.N. Microinvest S.R.L., as well as in the capacity of an independent data controller, in accordance with the provisions of Law No. 195/2024 and other applicable regulatory acts in the field of personal data protection.

The National Center for Personal Data Protection is the supervisory authority of the Republic of Moldova responsible for monitoring and controlling the legality of personal data processing. O.C.N. Microinvest S.R.L., as the controller, and Microinvest Technology S.R.L., as the data processor appointed by the controller, process personal data in good faith, in compliance with the applicable legislation and exclusively for the purposes specified in this Policy.

1.2 Purpose of the Policy

This Policy aims to ensure the uniform information of any natural person whose personal data is processed or may be processed as a result of interaction with the Company. The Policy establishes the principles of processing, the purposes, legal grounds for processing, recipients, as well as the technical and organizational security measures implemented by the Company and its data processors to ensure processing in compliance with Law No. 195/2024 and European best practices.

Natural persons whose personal data is processed by the Company, hereinafter generally referred to as “Data Subjects”, are classified into the following categories, depending on the nature of their relationship with the Company:

• Clients, potential clients, and former individual clients;
• Persons with whom the Company carries out occasional transactions;
• Legal or authorized representatives of corporate Clients, in cases where their personal data is collected or processed in connection with the Company’s activities;
• Guarantors, pledge debtors and/or mortgage debtors;
• Contact persons, employees and/or natural persons designated by a Client of the Company (including after termination of the contractual relationship);
• Contact persons, legal or authorized representatives, collaborators, employees and/or natural persons designated by a contractual partner of the Company;
• Employees of the Company;
• Candidates applying for positions within the Company;
• Visitors of the Company’s official websites, official social media pages, including automated remote systems and chatbots;
• Visitors to the Company’s offices where video surveillance cameras are installed;
• Users of the Personal Account/Mobile Application;
• Natural persons who have submitted a petition addressed to the Company and who do not fall into the categories listed above.

The information of the Data Subject regarding the purpose and conditions of personal data processing is ensured through:

• relevant notices included in the forms provided to the Data Subject within the services rendered (applications/contracts/questionnaires/declarations);
• the official website and automated remote service systems;
• other communication channels established within the Company.

At the same time, this Privacy Policy explains how the Company processes personal data, describes the types of personal information processed, establishes the purposes of personal data processing, describes the legal grounds based on which personal data is processed, determines the data retention period, establishes the rights of Data Subjects in relation to their personal data, describes the procedure for exercising these rights, identifies data recipients, presents the security measures implemented for the protection of such data, and provides details regarding cookies and other similar technologies.

1.3 Relevant definitions used

Relevant Definitions in the Context of Personal Data Protection:

Personal Data – any information relating to an identified or identifiable natural person (hereinafter referred to as the “Data Subject”). An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more specific elements related to their physical, physiological, genetic, mental, economic, cultural, or social identity;

Special Categories of Personal Data – data revealing racial or ethnic origin, political opinions, religious beliefs or philosophical convictions, trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation;

Biometric Data – personal data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of a natural person, which allow or confirm the unique identification of that person (e.g., facial image);

Processing – any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction;

Data Subject – any identified or identifiable natural person whose personal data is processed by the Company, directly or indirectly, including clients, potential clients, former clients, representatives, job candidates, employees, former employees, collaborators, website visitors and/or users of the Company’s application, as well as other persons whose data is processed in connection with the Company’s activities;

Controller – a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of processing are determined by regulatory acts, the controller or the specific criteria for its designation shall be provided for by such regulatory acts;

Processor – a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller;

Recipients – a natural or legal person, public authority, agency, or other body to which personal data is disclosed, whether or not it is a third party. Public authorities which may receive personal data within the framework of a specific investigation in accordance with regulatory acts shall not be considered recipients; the processing of such data by the respective public authorities shall comply with the applicable data protection rules, in accordance with the purposes of processing;

Third Party – a natural or legal person, public authority, agency, or body other than the Data Subject, the Controller, the Processor, and persons who, under the direct authority of the Controller or the Processor, are authorized to process personal data;

Direct Marketing – communication, by telephone, mail, or any other means of direct communication, of advertising or marketing messages (promoting goods or services) addressed to specific individuals;

Group – O.C.N. Microinvest S.R.L., Microinvest Technology S.R.L., B.C. Victoriabank S.A., and other entities within the Banca Transilvania Financial Group.

1.4. Principles of Personal Data Processing within the Company

The Company processes personal data based on the following principles:

a) Lawfulness, fairness, and transparency – personal data is processed in good faith and in accordance with the applicable legal provisions, in a fair and transparent manner towards the Data Subject;
b) Purpose limitation – personal data is collected for specified, explicit, and legitimate purposes and is not further processed in a manner incompatible with those purposes;
c) Data minimization – personal data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed;
d) Accuracy – personal data is accurate and, where necessary, kept up to date; the Company ensures that personal data which is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without undue delay;
e) Storage limitation – personal data is kept in a form that permits identification of Data Subjects for a period no longer than necessary for achieving the purposes for which the data is processed; data may be stored for longer periods insofar as it is processed exclusively for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, with the application of appropriate technical and organizational measures to ensure the rights and freedoms of the Data Subject;
f) Integrity and confidentiality – personal data processing must be carried out under secure conditions, including appropriate technical or organizational measures that ensure adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage;
g) Accountability – personal data is processed in such a manner that the Controller can demonstrate compliance with the applicable legal requirements.

Within the scope of its activities, the Company processes the following categories of personal data relating to an identified or identifiable natural person (Data Subject):

• Identification data – First name and surname, state identification number, series and number of the identity document, date of issuance and expiry date of the identity document, issuing authority, date and place of birth, gender, citizenship, handwritten signature.
• Contact data – telephone number, email address, home address, residence address, correspondence address.
• Identification data for remote communication means – electronic signature, IP (Internet Protocol) address(es), operating system and platform of the electronic devices used by the Data Subject to connect to the Company’s information systems, unique identification and authentication codes: client code, login, one-time password (OTP), authentication credentials (the password being stored exclusively in the form of a cryptographic hash), type of authentication (native biometric authentication of the phone and/or hashed connection PIN from the mobile application), information regarding the use of biometric authentication mechanisms available on the user’s device, without the Company accessing or storing the actual biometric data, mobile phone name (device type and brand), other information included in cookie files, etc.
• Financial data and information necessary for assessing payment capacity – types of income and expenses, information related to credit history, any other information provided by entities such as Credit Bureaus; data regarding movable/immovable assets owned (addresses, cadastral numbers, data from the Register of Movable Assets, data from the State Register of Transport).
• Social and family data – family status, profession, occupation, workplace/employer’s name, health insurance, professional training, nature of own activity.
• Data relating to the status of a politically exposed person (PEP), a family member of a politically exposed person, or a person known as a close associate of a PEP, processed only in cases provided for by the legislation on the prevention and combating of money laundering and terrorist financing;
• Data related to fraudulent activities – allegations, convictions related to offences such as fraud, as well as data from publicly available media sources that may disclose information regarding fraudulent or potentially fraudulent activities, money laundering and terrorist financing, and data regarding international sanctions.
• Biometric data – facial images (selfie/video) resulting from specific processing techniques, processed for the purpose of uniquely identifying the Data Subject remotely.
• Data related to image, voice, or geolocation – image data (contained in identity documents or captured by video surveillance cameras installed at the Company’s premises), voice data, including within recorded telephone conversations, or both in the case of the Company’s promotional materials in which both clients and employees participate. Additionally, the Company processes device location data (e.g., for displaying the nearest Secondary Offices of the Company), collected only where the Data Subject grants the necessary permission and exclusively for the requested functionalities.
• Data contained in communications with the Company – information provided by the Data Subject within requests, petitions, complaints, correspondence, and other interactions with the Company.
• Other personal data provided directly by the Data Subject or obtained from sources authorized by law, insofar as such data is necessary for achieving the purposes described in this Policy.

The Company avoids processing special categories of personal data (racial or ethnic origin, political opinions, religious beliefs, philosophical convictions, trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, as well as data relating to criminal convictions), except in cases where:

• Processing is necessary for the remote unique identification of a natural person, provided that the Data Subject has given explicit consent to the processing of biometric data for this purpose;
• Processing is necessary for the purposes of fulfilling obligations and exercising specific rights of the Controller or the Data Subject in the field of employment, social security, and social protection, insofar as this is authorized by regulatory acts;
• Processing is necessary for the establishment, exercise, or defense of a right in administrative, judicial, or extrajudicial proceedings, or when courts act in the exercise of their judicial functions;
• Processing is necessary for establishing payment incapacity (in the case of processing health data of the Data Subject), provided that the Data Subject has given explicit consent to the processing of health data for this purpose.

The refusal of the Data Subject to provide the Company with the personal data necessary for the performance of the requested/proposed activity may result in the impossibility of providing services and/or achieving other data processing purposes.

Special categories of personal data are processed in accordance with the applicable legislation.

The Company’s non-bank financial activity is regulated by the applicable legislation in most of its aspects, from client identification, confidentiality of the relationship, prudence and diligence in providing services, to security measures and even the manner in which contractual partners are selected.

The Company also applies the provisions in the field of personal data protection and processes such data only if and to the extent that at least one of the following conditions is met:

• assessing eligibility and creditworthiness for the provision of the Company’s products and services;
• assessing financial risk through the use of automated risk profiling processes;
• conducting and managing any contractual relationships (with clients, collaborators, members of the Supervisory Board, partners, or Company employees);
• ensuring the proper and secure execution of financial transactions: at the counter, through transfers, cards, POS terminals, payment terminals, etc.;
• monitoring and managing the performance of all contractual obligations assumed towards the Company;
• collection of debts arising from contractual relationships;
• establishing, exercising, or defending rights before courts or other competent authorities;
• managing requests/complaints/claims/petitions/investigations related to the Company’s activities, services/products, or employees;
• concluding and performing individual employment contracts and other legal acts relevant to the employment relationship;
• recovery of receivables resulting from the non-performance of contractual obligations;

• applying measures for the prevention and combating of money laundering, terrorist financing, proliferation of weapons of mass destruction, and fraud, in order to identify and understand clients, assess risks, and report transactions;
• providing reports and information upon the request of public authorities (e.g., courts, investigative bodies, enforcement authorities, public notaries, tax authorities, supervisory authorities, the Service for Prevention and Combating Money Laundering (SPCSB), etc.);
• managing audits, reporting activities, as well as controls and investigations conducted by national authorities;
• managing credit risk and fulfilling legal obligations regarding risk assessment and monitoring, as well as risk management through the creation of risk profiles;
• fulfilling legal obligations regarding the storage, retention, and archiving of documents;
• implementing data security measures and ensuring business continuity management in the event of unforeseen situations, including through the creation of backup copies;
• implementing mechanisms that allow any person to report discrepancies/dissatisfaction related to the services provided by the Company;
• complying with labor legislation requirements regarding employee relations.

c) Processing is necessary for the pursuit of the legitimate interests of the Company related to the proper management of its activities, provided that such interests do not prejudice the interests or fundamental rights and freedoms of the Data Subject, for purposes such as:

• design, development, testing, and use of information systems and services;
• design of credit risk assessment models (rating, scoring, etc.);
• improvement and adaptation of products and services to clients’ needs;
• provision of products/services, including online services, to the Company’s clients who benefit from the provided services;
• recording and management of communications through digital/analog channels (e.g., the Company’s website, online chat, mobile application, email, etc.);
• maintaining the reputation, integrity, and security of the business;
• conducting surveys regarding the services provided by the Company and its activities;
• identifying assets and updated contact details of clients and partners, for the purpose of exercising the Company’s rights regarding debt recovery, enforcement of amounts owed, and management of seizures;
• recruitment and human resources activities related to the Company’s candidates and employees, conducting internships, participation in training programs, and granting benefits;
• ensuring the security and protection of the Company’s buildings, assets, personnel members, and visitors through the video surveillance system;
• defending the Company’s legitimate interests before competent public authorities;
• exchange of information with credit bureau-type institutions for the purpose of assessing and monitoring credit risk;
• providing responses/information and handling requests/complaints/notifications of any nature submitted through any channel, including digital channels;
• providing information and reports to B.C. Victoriabank S.A. and Banca Transilvania S.A. for governance, risk management, and internal control purposes;
• statistical purposes;
• other purposes related to the Company’s activities, in compliance with the applicable legislation.

• employer branding and public communication;
• management of non-essential cookies for marketing and analytics purposes;
• contacting rejected candidates for future available positions within the Company;
• displaying the nearest Company offices (geolocation);
• direct marketing for the promotion of products and services;
• customer profiling based on transaction history for marketing purposes and personalization of offers.

The Data Subject’s consent is given freely, in an intelligible and easily accessible form, using clear and simple language. The Data Subject has the right to withdraw their consent at any time, and the Data Subject is informed of this right before providing consent.

In the cases described in points a)-c) above, the Data Subject’s consent is not required, as the processing is carried out under the applicable legal conditions.

For the purpose of achieving the processing purposes described in this Policy, certain technical and operational activities may be performed by the Company’s Processors, in accordance with the Company’s instructions and within the limits established by the applicable personal data protection legislation.

Personal data is processed by the Company based on the following legal grounds:

a) based on the consent of the Data Subject, pursuant to Article 6 para. (1) letter (a) of Law No. 195 of 25.07.2024 on the Protection of Personal Data. Once consent has been requested and provided for certain data processing activities, it may be withdrawn by the Data Subject at any time, free of charge, through the available channels mentioned in this Policy. Withdrawal of consent shall not affect the lawfulness of data processing carried out before the withdrawal, nor shall the contractual relationship be affected. Processing of personal data may continue only to the extent that it is based on another applicable legal ground;

b) for the conclusion and performance of a contract to which the Data Subject is a party or for taking steps at the request of the Data Subject prior to entering into a contract (e.g., provision of credit products, communication with the Data Subject for the performance of the contract, analysis required for assessing payment capacity, management of recruitment and selection processes, assessment of applications, management of the employment relationship, etc.), pursuant to Article 6 para. (1) letter (b) of Law No. 195/2024;

c) for compliance with a legal obligation incumbent upon the Company (e.g., submitting reports to competent authorities, customer due diligence for the purpose of preventing money laundering and terrorist financing, etc.), pursuant to Article 6 para. (1) letter (c) of Law No. 195/2024;

d) for the purposes of the legitimate interests pursued by the Company, subject to the requirement of conducting a balancing test (e.g., ensuring the security of persons and assets, defending the Company’s rights and interests in potential disputes, etc.), while taking into account the protection of the interests, fundamental rights, and freedoms of the Data Subject, pursuant to Article 6 para. (1) letter (f) of Law No. 195/2024.

For the purpose of achieving the processing purposes listed in Chapter 3 of this Policy, the Company may transmit personal data to the following recipients, in compliance with the processing principles and the necessary security measures:

• public supervisory institutions overseeing non-bank lending activities;
• authorities or persons authorized by law to request such information;
• organized entities such as Credit Bureaus;
• entities within the financial group (B.C. Victoriabank S.A. and Banca Transilvania S.A.);
• bailiffs, within the scope and limits provided by the enforcement document, public notaries, auditors;
• courts, for the purpose of resolving a case pending before them;
• mediators, for the purpose of amicable dispute resolution;
• contractual partners and service providers, some of which act as Processors and provide services such as: printing, IT and telecommunications services, document destruction services, debt collection or receivables recovery companies, marketing companies, providers of IT applications and systems, as well as financial institutions and payment service providers (including for salary payments), employee benefit providers, training service providers, occupational medicine service providers, and occupational health and safety service providers, etc.;
• sub-processors engaged by the Processor that provide services such as cloud services, hosting services, etc.

All the above-mentioned recipients are contractually and/or legally required to comply with the legal requirements and security and confidentiality measures applicable to personal data. Some of these entities act as Processors and process personal data exclusively based on the Company’s instructions and are responsible, in accordance with the applicable legislation and contractual obligations, for ensuring compliance with such requirements.

The Company performs an appropriate prior assessment when selecting service providers and requires them to implement adequate technical and organizational security measures in order to protect personal data and process personal data only in accordance with applicable data protection legislation.

Where the Data Subject provides the Company with personal data belonging to third parties (for example: guarantors, co-debtors, contact persons, security providers, former owners of assets presented in documents related to a credit application, or other persons involved in the processes carried out by the Company), the Company processes such data only to the extent necessary for achieving the purposes provided for in this Policy and in compliance with the applicable personal data protection legislation.

The Data Subject is responsible for ensuring that the data provided to the Company has been obtained lawfully and, where possible and reasonable, for informing the respective persons about the transmission of their data to the Company and the purposes of such processing.

For the purposes described in this Policy, personal data shall be processed by the Company throughout the entire contractual relationship with the Data Subjects and after its completion in order to comply with applicable legal obligations, including those related to archiving or based on the legitimate interest of the Controller. Legal archiving periods vary depending on the type of data and, in certain special cases, may be up to 75 years.

In general, data related to transactions must be retained for 5 years from the termination of the business relationship with the client or from the date of an occasional transaction. Personal data shall also be retained for a period of 5 years in the case of rejected clients who have submitted a credit application. However, data may be retained for a longer period upon the request of authorities, which may not exceed an additional 5 years, or for the protection of legitimate interests.

Personal data completed in the credit application and data processed for customer due diligence purposes in order to prevent and combat money laundering, terrorist financing, and the proliferation of weapons of mass destruction shall be stored in the Company’s record-keeping systems for a period of 5 years from the date of signing the credit application, if the application is rejected, and respectively for a period of 5 years from the date of termination of the credit relationship, if a credit agreement is concluded following the approval of the credit application.

For personal data processed based on the consent of Data Subjects, including for direct marketing purposes/commercial communications, the Company shall continue processing the data until the Data Subject withdraws the consent provided for this purpose. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to withdrawal. Following withdrawal of consent, the Company may retain certain limited information, such as identification and contact data, to the extent necessary to demonstrate compliance with applicable obligations, including proof that the request to withdraw consent has been complied with, as well as for the defense of the Company’s legitimate rights and interests. The retention period shall be determined depending on the purpose of retention, applicable legal requirements, and limitation periods.

For the purpose of proving that petitions/notifications/complaints/requests for information/measures have been received and that responses have been provided, including for quality control of the responses provided by the Company, such messages received through any channel shall be retained in the Company’s record-keeping systems in paper and/or electronic format, depending on the method of receipt and response, for the duration of the business relationship in the case of clients, respectively for the period necessary to achieve the purpose for which they were processed (providing a response/providing information), plus a period of 3 years – the statutory limitation period, where the data does not belong to persons with whom the Company has an established business relationship.

Employees’ personal data shall be retained throughout the employment relationship and, after its termination, for the period provided by applicable legislation. For certain categories of data, the retention period may be up to 75 years, in accordance with archival requirements.

Data of candidates rejected during the recruitment process shall be retained until completion of the recruitment process for the position for which the application was submitted.

Where the candidate provides consent, their data may be actively processed for the purpose of direct contact regarding other available positions. In this case, the Company shall retain the CV and other application-related data for a period of 18 months from the date consent is granted. Providing such consent is optional and does not affect the candidate’s participation in the recruitment process for the position applied for. Upon expiry of the retention period, the Company shall request renewal of consent for a new period of 18 months. In the absence of renewed consent, personal data shall be deleted or anonymized, except where retention is required based on a legal obligation.

The candidate may withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

The storage period of data obtained through the video surveillance system is proportionate to the purposes for which the data is processed, namely ensuring the security of persons, protecting the Company’s assets and premises, preventing fraud, establishing, exercising, or defending the Company’s rights and legitimate interests, and shall not exceed 90 days. After this period, recordings shall be automatically deleted through an automated procedure, in the order in which they were recorded. In the event of a security incident, the retention period of relevant recorded footage may exceed the normal limits, depending on the time required for further investigation of the security incident.

Any other personal data processed by the Company for other indicated purposes shall be retained for the period necessary to achieve the purposes for which it was collected, plus any non-excessive retention periods established in accordance with applicable legal obligations in the relevant field, including but not limited to archival requirements.

For complete information and in accordance with the provisions of Law No. 195 on the Protection of Personal Data, Data Subjects benefit from the following rights regarding the personal data processed by the Controller.

Right to information – the right of the Data Subject to receive information, in a transparent, clear, and easily understandable manner, regarding the personal data processing activities carried out by the Company as the Controller or as the Processor acting on behalf of the Controller.

According to the Article 29 Working Party – Guidelines on transparency under Regulation (EU) 2016/679, the exceptions to the obligation to provide information are the following:

• The Data Subject already has the information, the provision of information is impossible, or it would involve disproportionate efforts (especially for data obtained indirectly);
• There are legal restrictions (e.g., fraud prevention, investigations, public security);
• The data is not obtained directly from the person, and providing information would affect the purpose of the processing (e.g., anti-fraud investigations).

Right of access to data – Data Subjects have the right to access their personal data, namely to obtain confirmation as to whether or not the Company processes their personal data and to obtain access to such data and to the following information, pursuant to Article 15 of Law No. 195/2024, including: the purposes of processing, the legal grounds for processing, the categories of personal data concerned, the recipients or categories of recipients to whom the data is disclosed, as well as any available information regarding the origin of such data, so that they have the possibility to verify whether their data is processed by the Company in compliance with the applicable data protection legislation.

The right of access may be restricted in cases where: it could affect the rights and freedoms of another person or where access could breach specific legal provisions provided by the applicable legislation.

Right to rectification – the Data Subject has the right to obtain from the Company, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes for which the data was processed, the Data Subject has the right to obtain the completion of incomplete personal data, including by providing an additional statement;

Right to erasure (“right to be forgotten”) – the Data Subject has the right to obtain from the Company the erasure, without undue delay, of personal data concerning them, and the Company is obliged to erase personal data without undue delay in one of the following cases:

• the personal data is no longer necessary for the purposes for which it was collected or processed;
• the Data Subject withdraws their consent on which the processing is based, and there is no other legal ground for the processing;
• the Data Subject objects to processing based on legitimate interest or public interest, and there are no overriding legitimate grounds for the processing, or the Data Subject objects to the processing of personal data for direct marketing purposes;
• the personal data has been processed unlawfully;
• the personal data must be erased in order to comply with a legal obligation incumbent upon the Company under applicable regulatory acts.

Right to restriction of processing – the Data Subject has the right to obtain from the Company the restriction of the processing of their data in one of the following cases:

• the Data Subject contests the accuracy of the personal data – for a period that allows the Company to verify the accuracy of the data;
• the processing is unlawful, and the Data Subject opposes the erasure of personal data, requesting instead the restriction of its use;
• the Company no longer needs the personal data for the purpose of processing, but the Data Subject requests it for the establishment, exercise, or defense of a right in administrative, judicial, or extrajudicial proceedings;
• the Data Subject objects to processing based on legitimate interest or public interest – for the period during which it is verified whether the legitimate rights of the Company prevail over the rights of the Data Subject;

Right to object – the right of the Data Subject to object, at any time and free of charge, on grounds relating to their particular situation, to the processing of personal data for direct marketing purposes, as well as to processing based on the legitimate interest of the Company and public interest, except where the Company demonstrates that it has compelling legitimate grounds that justify the processing and override the rights, freedoms, and legitimate interests of the Data Subject, or where the purpose of the processing is the establishment, exercise, or defense of a right in administrative, judicial, or extrajudicial proceedings.

Right to withdraw consent – the Data Subject has the right to withdraw their consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out based on consent before its withdrawal. Before providing consent, the Data Subject shall be informed of this right. Withdrawal of consent shall be as simple as giving consent. Processing of personal data may continue only where another legal ground for processing exists.

In situations where the processing of personal data is based on the consent of a person, such consent may be provided through one of the following methods:

• submitting a request to the Company through the communication channels indicated in this section;
• contacting the Company by telephone call;
• ticking a checkbox in the Client’s Personal Account on the website or in the mobile application;
• signing a form containing a separate consent clause.

Withdrawal of consent may be carried out through the same methods by which it was provided, including by submitting a request to the Company using the contact details indicated on the official website or in this Policy. The Company shall process the request for withdrawal of consent within a reasonable period and shall cease processing data for purposes based exclusively on consent, except in cases where another legal ground justifies the continuation of processing.

Right not to be subject to an individual decision – the Data Subject has the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects them, except in the cases provided for under Article 22 para. (2) of Law No. 195/2024. Where such a decision is permitted, the Data Subject has the right to request human intervention, to express their point of view, to contest the decision, and to request its reassessment.For example, in certain cases, a credit application may be automatically approved or rejected without the intervention of a human operator. The use of such means is necessary for the rapid analysis of the application and, where applicable, for the conclusion of the credit agreement. In such cases, the Data Subject may request human intervention for the reassessment of the decision.

Right of access to justice – the Data Subject has the right to lodge a complaint with the National Center for Personal Data Protection and, where applicable, with the court, in order to seek compensation for material and non-material damages, in cases where they consider that they have suffered damage as a result of unlawful processing of personal data or that their rights and interests guaranteed by Law No. 195/2024 have been infringed.

Right to data portability – the Data Subject has the right to receive the personal data concerning them, which they have provided to the Company, in a structured, commonly used, and machine-readable format, and has the right to transmit such data to another Controller without hindrance from the Company, where the processing is based on consent or a contract and is carried out by automated means. This right may be exercised where the transmission of data to another Controller is technically feasible.

To exercise these rights, or if they consider that the processing of personal data by the Company violates the applicable data protection legislation, the Data Subject may submit a complaint or send a written request, dated and signed either handwritten or electronically, to the Company’s contact address indicated in the “Contacts” section on the official website https://microinvest.md/contacte/ or by e-mail at protectiadatelor@microinvest.md. The request shall be analyzed and resolved without undue delay, in accordance with the Company’s internal procedures and applicable legislation.

Unsubscribing from the “newsletter” may be performed independently, voluntarily, and free of charge at any time by accessing the dedicated unsubscribe link available at the end of the received newsletter.

8.1 Notion of cookies

Cookies – the website www.microinvest.md, as well as the online Personal Account made available to clients by the Company, may set and read cookies and other technologies when accessed and used by visitors. In both cases, cookie files may be stored on the terminal equipment used by users to access the services.

“Cookies” are small files consisting of letters and numbers, created by the browser when accessing a website and stored on the user’s terminal equipment (e.g., computer, mobile phone, tablet, or other devices used to access the internet).

Through these files, the website may retain certain information about a user’s visit to the website, such as the preferred language and other settings, thus facilitating the use of the website during subsequent visits and improving the browsing experience. Cookies play an important role, as without them, using the internet would be a much more frustrating experience.

In most cases, cookies do not directly contain personal data that allows the identification of the user.

However, depending on the type and purpose of their use, certain cookies may be associated with personal data or may allow the indirect identification of the user.

8.2 Types of cookies used by the company and related settings

The Company uses the following categories of cookies:

• Strictly necessary cookies – these cookies are essential for the functioning of the website and the online Personal Account. They enable the use of basic functionalities, including the identification procedure, user authentication, maintaining an active session, ensuring service security, and accessing the Company’s website. These cookies are necessary for the operation of the website, including the provision of services requested by the user, and cannot be disabled through the cookie preference management mechanism. In the browser used by the user, they may set the blocking of or receive a warning regarding these cookies; however, in such a case, certain parts of the website may not function properly.
• Analytics, measurement and functionality cookies – analytics and measurement cookies are used for statistical purposes and allow the analysis of how users interact with the website, while functionality cookies store certain user preferences, such as the selected language. The information collected is used to improve the performance, functionality, and user experience of the website.
• Advertising cookies – these cookies are set on the website based on agreements concluded by the Company with advertising partners (e.g., social media platforms, Google, etc.). Through these cookies, partners may create a profile of website visitors, allowing them to subsequently display advertisements related to the Company’s website on other websites accessed by such visitors.

Based on the information collected, advertisements and offers tailored to the user’s interests may be displayed. Except for strictly necessary cookies, the use of the above-mentioned categories of cookies takes place only based on the options expressed by the user through the cookie preference management mechanism available on the Company’s website.

More detailed information about the cookies used, as well as their manual management, can be accessed when visiting the Company’s website www.microinvest.md. The decision to retain or delete cookie files belongs to each user.

The purpose of cookies is to improve the browsing experience and to assist, through statistical data collected from visits to the website www.microinvest.md, in improving the products and services offered by the Company.

These files do not represent a threat to the security of users’ data. Their size is negligible and does not affect the performance of the computer, mobile phone, or other terminal equipment on which they are stored. Deleting these files may result in difficulties when browsing the website www.microinvest.md, limiting the user’s ability to view certain content.

Except for strictly necessary cookies, the use of other categories of cookies is based on the options expressed by the user through the cookie preference management mechanism available on the Company’s website.

At any time, the user may modify the settings related to cookies or delete these cookie files through the settings of the browser used. Details regarding the modification of browser settings can be found on the websites of browser developers, in the “Settings” section, as presented below:

Google Chrome
Mozilla Firefox
Microsoft Edge
Opera
Apple Safari

Data collected through cookies does not generally allow the direct identification of the user. However, depending on the type of cookie used and the information associated with it, certain data may be linked to an identified or identifiable natural person.

Persistent cookies are stored on the user’s device and are not automatically deleted when the browser is closed, unlike session cookies, which are deleted when the browser is closed. In cases where cookies process personal data capable of identifying the person, the Data Subject benefits from the rights provided for in this Policy.

The Company has a comprehensive personal data security system in place and continues to develop technical and organizational measures in order to ensure an adequate level of data protection through data leakage prevention systems (Data Loss Prevention), security incident monitoring systems (Security Information and Event Management), remote access to internal resources (Virtual Private Network), and other security and monitoring systems that contribute to ensuring security within the Company.

The Company uses advanced security methods and technologies, together with strict policies applicable to employees and work procedures (including antivirus solutions, firewall systems, and information encryption systems). All operational and data processing systems operate in secure environments, ensuring that information is protected against unauthorized access. Access to the Company’s information/systems is granted only to authorized persons and for clearly defined purposes, in strict accordance with internal security policies. The Company has established a procedure for granting access to information systems containing personal data, ensuring compliance with the principles of data minimization and least privilege.

Individual identification and authentication of users accessing information from the personal data record-keeping system is performed in accordance with the provisions of the Company’s internal regulatory documents.

Technologies and means for detecting access to information within the personal data record-keeping system are used.

Backup copies of personal data from the components related to personal data record-keeping systems are created in accordance with the provisions of the Company’s internal regulatory documents.

At the same time, the Company enters into personal data processing agreements with contractual partners acting as Processors. These data processing agreements establish a set of rules for the processing of personal data applicable to all participants in the processing chain and define their liability in the event of non-compliance with the instructions established by the Controller.

The Company organizes training sessions on personal data protection and information security in order to inform employees about the potential risks of unlawful personal data processing and the mandatory rules that each employee must follow to ensure the security of internal systems and minimize the risk of data compromise.

This Policy enters into force on the date of approval. From the date of entry into force of this Policy, the previous versions of the Policy on the Protection and Confidentiality of Personal Data and Cookies within the Microinvest Group are repealed, and this Policy becomes mandatory for all relevant employees of the Company.

The provisions of this Policy shall be subject to periodic amendment or review at least once every 3 years, as well as whenever there is a relevant change in the applicable legal framework, internal processes, personal data processing activities, or any other circumstance requiring its update. The Company reserves the right to amend this Policy whenever necessary, in accordance with the applicable legal and operational requirements.

This Policy, as well as any proposed amendments, shall be communicated to the User and Data Subjects by publishing the updated version on the Company’s website, as well as on the information boards located within the Company’s offices.

If one or more provisions of this Policy conflict with the provisions of the legislation in force of the Republic of Moldova, the normative act issued/adopted by the competent public authority shall apply directly.