Privacy Policy
PERSONAL DATA PROTECTION POLICY
General Provisions
Who Are We?
B&B LIDER COMPANY SRL, IDNO 1016600018810, with its registered office at 3 Vorniceni Street, Office 101, Chisinau Municipality, is a personal data controller in accordance with the applicable legislation of the Republic of Moldova (Law No. 195 of 25 July 2024 on the Protection of Personal Data), as well as with European standards in this field (GDPR).
Purpose and Scope
This Policy regulates the manner in which the data controller collects, processes, stores, and protects the personal data of data subjects (clients – sellers, buyers, tenants, landlords), potential clients, partners, and employees, in accordance with Law No. 195/2024 on the Protection of Personal Data.
Categories of Data Processed
As a data controller, the following categories of personal data are processed:
Contact details: telephone number, email address.
Communication data: correspondence, history of requests.
Purpose: the need to communicate available real estate offers or to contact clients again in order to update information regarding offers or transactions.
Identification data: name, IDNP (personal identification number), series/number of identity document, address.
Property-related data: title documents, extracts from the Real Estate Register.
Financial data: declared income, sources of funds (also relevant for AML/CFT obligations).
Purpose: data in this category are requested for the conclusion of the Brokerage Agreement, for providing consultations, or for preparing the documents required for the completion of a sale and purchase transaction.
Chapter II – Principles of Processing
The Agency processes personal data in compliance with the following principles:
Lawfulness, fairness, and transparency;
Purpose limitation;
Data minimization;
Accuracy of data;
Storage limitation;
Integrity and confidentiality;
Accountability.
Chapter III – Legal Basis for Processing
Article 4 – Data is processed on the basis of:
Consent – personal data provided in forms or in any request for an offer completed by the client constitutes the client's consent to the processing of their personal data by the data controller.
Necessity for entering into the Brokerage Agreement – the conclusion and performance of contracts or taking steps at the request of the data subject prior to entering into a contract.
Legal obligation – compliance with legislation applicable to the real estate sector, banking sector, tax matters, cadastral matters, registration of real estate, and other areas related to real estate transactions.
Legitimate interest of the Agency – ensuring security, managing risks, administering client/partner relationships, and protecting the Agency's rights and legitimate interests.
Rights of Data Subjects
Clients (data subjects) have the following rights:
Right to information: the client may request information regarding what data is collected, why it is collected, and how long it will be archived by the data controller.
Right of access to personal data: the client may request information regarding the personal data concerning them that is held by the data controller.
Right to rectification: the client may request that their personal data be rectified, corrected, or updated.
Right to erasure: the client may request the deletion of their personal data held by the data controller, except for data that the data controller is legally required to retain.
Right to restriction of processing: the client may request that the processing of their personal data be suspended for a certain period, provided that such a request does not affect the legal obligations of the data controller.
Right to data portability: the client may request to receive the personal data concerning them that they have provided to the data controller.
Right to object: after their data has been collected, the client may object to the manner in which their personal data is managed and may request that further processing activities be stopped.
Right not to be subject to automated individual decision-making: you have the right not to be subject to a significant decision made solely by an automated system, without the possibility of human intervention.
The above rights may be exercised by contacting the Agency. If you consider the Agency's response to be unsatisfactory, the client (data subject) may lodge a complaint with the competent public authority responsible for personal data protection:
National Center for Personal Data Protection (NCPDP)
Address: 48 Serghei Lazo Street, Chisinau Municipality
Email: centrul@datepersonale.md
Telephone: (+373) 22 820 801
Transfer of Data to Third Parties
In the course of its activities, the Agency may transfer personal data to:
Notaries – for the purpose of verifying documents or preparing the documentation package required for a transaction;
Banks – for the purpose of verifying the client's eligibility for financing/credit;
Partners – for the purpose of ensuring the proper management of business activities and on the basis of appropriate safeguards;
Other agents/partners – only with the client's consent or on the basis of a legal obligation;
Public authorities – for the purpose of complying with the requirements applicable to brokerage activities and fulfilling the data controller's legal obligations.
Data Retention Period
The Agency retains personal data strictly for the period necessary to fulfill the purposes for which the data was collected, ensuring compliance with the principle of storage limitation and data minimization. After the applicable retention periods expire, the data is deleted, destroyed, or pseudonymized in accordance with the data controller's internal procedures.
Data processed in the context of the contractual relationship is retained:
a) For the duration of the business relationship;
b) Thereafter, for the periods prescribed by applicable legislation in the real estate and financial-accounting sectors, namely 5 years from the termination of the business relationship or from the date of an occasional transaction, a period which may be extended up to 10 years.
Data Security
The data controller implements appropriate technical and organizational measures to ensure the security of the personal data in its possession. These measures include, but are not limited to: IT security mechanisms, physical access controls and digital access controls, encryption and protection against unauthorized access, as well as system auditing and monitoring.
