Association of Walnut Growers of the Republic of Moldova
Search

GDPR Policy

Last updated: 20 October 2026

This policy explains what personal data we collect about you, why we collect it, how long we keep it and what you can ask of us in respect of it. It applies to the site moldovanuts.org, to the members' area and to any communication you have with us through the site's forms or by e-mail.

It is written in accordance with Law no. 195/2024 on the protection of personal data, applicable from 23 August 2026, which replaced Law no. 133/2011 and brought the standards of Regulation (EU) 2016/679 — known as the GDPR — into the law of the Republic of Moldova.

1. Who processes the data

The controller of personal data is:

  • Name: Public Association "Walnut Growers Association of the Republic of Moldova"
  • Fiscal code: 1022620009109
  • Registered office: 79A Mateevici str., Stăuceni, Chișinău municipality, MD-4839, Republic of Moldova
  • E-mail: asociatianucicultorilor@gmail.com
  • Legal representative: Andrei Lozan, executive director

For any question or request about your data write to the address above, use the contact form, or send us a written request at our office.

2. What data we process

The data you send through the contact form. Your first name, surname, e-mail address, telephone number and the content of your message. The name and the message are required, and your e-mail address or telephone — at least one of them — is needed so that we can answer you.

The data in a membership application. In addition to the above: the company's address, website, the products and services it offers, and the documents you attach — the signed application, the registration certificate, the logo and other documents. The files are kept on a private disk, reachable only through the application and only by the people entitled to examine applications.

Member account data. If you hold an account: your e-mail address and sign-in identifier (both encrypted in the database), your password (kept solely as an irreversible digest), your first name and surname, and — if you choose to fill them in — your telephone number and national identification number, encrypted as well, your date of birth and your profile picture. Your display preferences belong here too: the language, the time zone and the date formats.

The member company's data and that of the people who act for it. The company's name, fiscal code, VAT code, address, phone, email and website; its orchards (locality, point on the map, area, varieties, irrigation, year planted), its certificates (with the attached document, kept on a private disk), its seasonal offers, the services it offers and the places it works in — the company's data, not a person's. For each of them the company chooses who may see it on its public page — anybody, any member, active members only or nobody outside the company — never wider than the limit the association sets. We keep the link between an account and the company and the person's role. The company's administrator decides whether a person appears as a contact on the public page and, for each person, who may read their email and who their phone, on the same four levels and under the association's limit. A person whose account somebody else adds is seen by the company through their email address only — no name, no phone — and cannot be a contact until they accept, on the company's page; they may decline there too. Membership periods and payment notes keep the payer's name, fiscal code, VAT code and address as they stood on the day of issue.

Invitations. When a company's administrator adds a person who has no account yet, we keep their email address (encrypted), the name given in the invitation, the role and who invited them. The link sent by email is kept only as an irreversible fingerprint and stops working after 14 days.

Requests for access to the public tools. Whoever asks for access to the results of the "Lot consolidation" or "Processing services exchange" tools sends us their name, email address, phone, company and the search they ask access for. The request is kept as a message received through the contact form.

The tools' search log. The searches made by those who have access to the two tools' results are kept with the search criteria, the number of results, the searcher's account and company, the IP address and the browser type.

The history of changes to companies' data. Every save that changes a member company's data keeps which record and which fields changed (never their values), the account that made it, where it came from (the company's page or the admin panel) and the IP address.

Data recorded automatically with a form. When a form is submitted we keep the IP address it was sent from, the browser type and the moment of sending. We keep them so that we can establish where a message came from and defend ourselves against automated submissions.

The site's technical data. The authentication journal records sign-in attempts — the identifier used, the IP address, the browser and the outcome. The request journal records incidents: refused requests, rate limits, unauthorised access attempts, with sensitive parameters redacted before they are written. We do not keep a log of the pages each visitor reads.

Searches on the site. The terms searched for are kept, together with the number of results, so that we can understand what visitors look for and complete the content.

Your cookie decision. Your choice from the banner is kept together with the IP address, the browser type and the date of the decision, as evidence of consent. The details are in the Cookies Policy.

The source of your visit. If you arrive from a campaign, we record the source, the landing page, the address you came from, the IP address and the session. Nothing is recorded if the address you enter through carries no campaign parameters.

We neither ask for nor deliberately collect data from special categories — concerning health, beliefs, trade union membership or the like. Please do not include such data in messages sent through the form.

3. For what purposes and on what basis

To answer the message you sent through the form. The basis is taking steps at your request.

To examine a membership application and administer membership — the register of members, membership periods, payment notes, the company's public page. The basis is the performance of the membership relationship and the association's own statutory obligations.

To keep your account and give you access to the members' area. The basis is the performance of that relationship and, for the data filled in optionally in your profile, your consent.

For cookies that are not strictly necessary — measurement, advertising, social networks. The basis is your consent, which you may withdraw at any time.

For the security of the site — preventing automated submissions, abuse and unauthorised access, and the authentication and incident journals. The basis is our legitimate interest in keeping the service working and protected.

To know who changed a member company's data and who consults the results of the members-only tools — the change history and the tools' search log. The basis is our legitimate interest in protecting the members' data and being able to answer a question about it.

To understand how the site is used — the searches made and the source of visits. The basis is our legitimate interest in developing content that matches what growers need.

To meet legal obligations — accounting, tax and archiving, together with the obligations arising from the externally funded projects we work within.

4. How long we keep the data

  • Messages and membership applications received through the form, together with the technical data of the submission — 2 years from receipt, after which they are deleted automatically;
  • Member account data — for as long as the account exists; after the account is deleted the archive is kept for 30 days and then removed;
  • Member company data — for the duration of membership and, for accounting records, the periods the law prescribes;
  • The authentication journal — 1 year;
  • The incident journal — 90 days in the database, 30 days in the file;
  • Searches on the site — 90 days;
  • The record of cookie decisions — 1 year;
  • The source of visits — 2 years;
  • Withdrawn or expired invitations — 90 days from their end; an accepted invitation becomes an account and follows the account;
  • Requests for access to the tools — 2 years from receipt, like messages;
  • The tools' search log — 720 days; the IP address and browser type are erased after 90 days, the row staying;
  • The history of changes to companies' data — 2 years; when an account is deleted, its rows lose their author and IP address;
  • The data of a company removed from the register — the archive is kept 30 days, then deleted.
  • Contractual, accounting and tax documents — the periods prescribed by the legislation in force.

Deletion at term happens automatically, through scheduled tasks that run daily.

5. Who we pass the data to

We neither sell nor rent data to anyone. It may reach, strictly to the extent needed for the purposes above:

  • the hosting provider and the contractor who maintains the site technically, as processors, bound by contract to confidentiality and to the security of the data;
  • the providers of measurement or advertising tools, only if you have consented to the corresponding cookie category;
  • the funders of projects within which an activity you took part in is carried out, where reporting requires it and only to the extent strictly necessary;
  • public authorities, where the law obliges us to pass it to them.

Where the data is. The site and its database are hosted on infrastructure located in the Republic of Moldova (host.md). Messages received through the form, the documents submitted and the technical journals therefore do not leave the country.

With one exception, which is yours to choose. If you accept the Measurement category in the cookie banner, your browser contacts Google (Google Analytics 4), and Google receives your IP address and browser type and processes them on its infrastructure outside the Republic of Moldova. The transfer takes place under the safeguards provided by Law no. 195/2024 and only after your consent for that category; if you refuse or choose nothing, no request goes to Google at all. You can withdraw your agreement at any time, from the same window.

6. Your rights

You have the right of access to your data, to rectification of inaccurate data, to erasure, to restriction of processing, to object to processing based on our legitimate interest, and to portability — that is, to receive your data in a machine-readable format. Where processing is based on consent, you may withdraw it at any time, without this affecting the lawfulness of the processing carried out beforehand.

If you hold an account on the site, two of those rights are exercised directly from your profile, without writing to us: downloading your own data as a file, and deleting your account, confirmed with your password. For the rest, write to us at asociatianucicultorilor@gmail.com; we answer within the period the law prescribes.

7. The right to complain

If you consider that we have breached your rights, you may address the National Centre for Personal Data Protection of the Republic of Moldova (48 Serghei Lazo str., Chișinău, datepersonale.md) or the courts.

8. How we protect the data

The site works exclusively over a secure connection (HTTPS). Passwords are kept as irreversible digests, and e-mail addresses, sign-in identifiers, telephone numbers and national identification numbers are encrypted in the database. Access to the administration panel is limited by rights, may require two-step verification, and sign-in attempts are counted and temporarily blocked after too many failures. Documents submitted with a membership application sit on a private disk that cannot be read directly from a browser. Every form submitted without signing in passes an anti-robot check.

9. Visitors from the European Union

If you read us from the European Union, the rights Regulation (EU) 2016/679 gives you are the same as those listed above, and we handle your requests in the same way.

10. Minors

The site addresses professionals in the walnut sector and does not deliberately collect data about minors. If we learn that we have received such data without a basis, we delete it.

11. Changes to this policy

We update this page whenever the data processed, the purposes or the periods change. The applicable version is the one published here, with the date of the last update shown at the top.