Privacy Policy

Your privacy matters to us. This policy explains what personal data we collect through upm.md, for which purposes and on which legal basis we process it, with whom we share it, how long we keep it and what rights you have over it.

Last updated: 28 June 2026

Data controller

The controller that determines the purposes and means of processing your data is:

• Name: „Union of Furniture Manufacturers” NGO (UPM).
• Legal form: public association (non-commercial organisation), Republic of Moldova.
• IDNO (fiscal code): 1012600023553.
• Address: bd. Dacia 35, Chișinău, MD-2060, Republic of Moldova.
• Email: contact@upm.md — Website: upm.md.
• Data-protection contact point: contact@upm.md (please write „data protection” in the subject line).

Applicable legal framework

We process data in accordance with the personal-data legislation of the Republic of Moldova — Law no. 133/2011 (currently in force), which will be replaced by Law no. 195/2024 as of 23 August 2026 — and, because the platform also addresses partners in the European Union, with Regulation (EU) 2016/679 (GDPR), applicable by virtue of Art. 3(2).

EU representative

Because we invoke the application of the GDPR by virtue of Art. 3(2), we have also assessed the obligation to designate a representative in the European Union under Art. 27 GDPR. We fall within the exemption set out in Art. 27(2): our processing is occasional, does not involve large-scale processing of special categories of data and is unlikely to result in a risk to the rights and freedoms of data subjects. Accordingly, we have not appointed a representative in the European Union, and EU data subjects may contact the controller directly at contact@upm.md.

What data we collect and from which sources

• Identification and contact data — name, company, email, country and the content of your message, provided directly by you via the contact form.
• Newsletter subscription data — your email address (and name, if you provide it), given directly by you only if you subscribe.
• Technical data — IP address, browser type, date and time of access and pages visited, collected automatically by the hosting server and the anti-spam mechanism for the operation and security of the site.
• Essential cookies — for example your language preference and cookie consent. We do not currently use statistics or marketing cookies.

We do not collect sensitive data (for example about health, ethnic origin or political opinions) and we do not ask you for such information.

Purposes of processing and legal basis

• To respond to requests sent via the contact form and to facilitate export partnerships (B2B). Basis: our legitimate interest in communicating with partners and answering enquiries (Art. 6(1)(f) GDPR), or pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• To send the newsletter, if you have subscribed. Basis: your consent, which you can withdraw at any time (Art. 6(1)(a) and Art. 7 GDPR).
• To protect the contact form against spam and automated abuse. Basis: our legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR).
• To operate, maintain and secure the platform, including technical logs. Basis: our legitimate interest in keeping the site functional and safe (Art. 6(1)(f) GDPR).
• To comply with our legal obligations (for example accounting, fiscal or legitimate requests from authorities). Basis: legal obligation (Art. 6(1)(c) GDPR).
• Traffic statistics — optional and currently inactive. If we introduce an analytics tool, it will be enabled solely with your consent (Art. 6(1)(a) GDPR).

Recipients and processors

We do not sell or rent your data. The data you submit through the site (via the contact form and the newsletter subscription) is stored in the site's own database.

The form, newsletter and e-mail delivery functions are provided by WordPress components hosted on our own infrastructure — Fluent Forms (the contact form), MailPoet (the newsletter) and FluentSMTP (sending e-mails). These are part of our own system and are not independent third-party processors.

We rely on external processors, under data-processing agreements (DPAs) and on our documented instructions, only for:

• The web hosting provider — stores the site and the database on secure servers.
• Cloudflare — through the Cloudflare Turnstile service, protects the contact form against spam and automated abuse; the related technical data is sent to Cloudflare, a processor established in the United States (international transfer).
• Any external SMTP service configured in FluentSMTP — if e-mail delivery is carried out through a third-party SMTP relay, it processes the data needed for delivery (the email address and the message content) as a processor.

We may also disclose data to public authorities when the law requires us to.

International transfers

Your data is processed mainly in the Republic of Moldova, the controller's home jurisdiction. Some providers (for example Cloudflare) may process limited technical data on infrastructure located outside Moldova or the EU, including in the United States. In such cases, the transfer is protected by appropriate safeguards within the meaning of Chapter V of the GDPR — typically the European Commission's standard contractual clauses (Art. 46 GDPR). We do not transfer your data to other third countries without a valid legal basis under Chapter V of the GDPR.

How long we keep data

• Messages sent via the form — kept for as long as needed to handle the request and any resulting relationship, as a rule no more than 24 months from the last contact, unless a legal obligation requires a longer period.
• Newsletter subscription data — kept until you unsubscribe or withdraw consent, after which they are promptly removed.
• Technical and security logs — kept for a short period, as a rule no more than 12 months.
• Accounting and fiscal records — kept for the period required by the accounting and fiscal legislation of the Republic of Moldova.
• Anti-spam verification tokens — transient, not retained beyond the verification.

Your rights

• The right of access to your data (Art. 15 GDPR).
• The right to rectification of inaccurate or incomplete data (Art. 16 GDPR).
• The right to erasure — the „right to be forgotten” (Art. 17 GDPR).
• The right to restriction of processing (Art. 18 GDPR).
• The right to be informed about the notification of recipients in the event of rectification, erasure or restriction of processing (Art. 19 GDPR).
• The right to data portability (Art. 20 GDPR).
• The right to object to processing, including processing based on legitimate interest (Art. 21 GDPR).
• The right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand (Art. 7(3) GDPR).
• The right not to be subject to a decision based solely on automated processing, including profiling (Art. 22 GDPR).

You can exercise these rights by writing to us at contact@upm.md. We reply within the legal deadline, as a rule within one month. Equivalent rights are also granted to you by the legislation of the Republic of Moldova: currently by Law no. 133/2011 (arts. 12–18) and, from 23 August 2026, by Law no. 195/2024, which adopts the GDPR standards.

The right to lodge a complaint

If you consider that your rights have been infringed, you can lodge a complaint with the supervisory authority of the Republic of Moldova: the National Centre for Personal Data Protection (CNPDCP), str. Serghei Lazo 48, MD-2004 Chișinău, www.datepersonale.md. If you are in the European Union, you may also turn to the supervisory authority of your country of residence (Art. 77 GDPR).

Data security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure: encrypted connection (HTTPS/TLS), access control to administrative systems, anti-spam protection, data-processing agreements with our external processors and periodic review of security measures.

Cookies

We use essential cookies for the site to function. Any statistics cookies are optional, currently inactive and would only be enabled with your consent. You can change or withdraw your cookie consent at any time via the «Cookie settings» link in the footer of every page or through your browser settings. Full details are in the Cookie Policy.

Cookie policy

Minors

The site is not directed at children and we do not knowingly collect data of persons under 16. If you learn that a minor has provided us with personal data, write to us at contact@upm.md and we will delete it.

Automated decisions and profiling

We do not make decisions based solely on automated processing and we do not carry out profiling that produces legal effects or similarly significantly affects you.

Providing data: is it required?

Providing data via the form is voluntary, but without the data needed to identify you and reply we cannot handle your request. Subscribing to the newsletter is entirely optional.

Changes to this policy

We may update this policy from time to time. The applicable version is the one published on this page, and the date above indicates the last update. Material changes will be signalled here. From 23 August 2026, processing will be governed by Law no. 195/2024.

Contact
Cookie policy
Terms & conditions