Information Notice on the Processing of Personal Data

Customers and visitors · Document code: DP-02 · Version of 30.09.2026

Translation. In case of discrepancies, the Romanian version prevails.

1. About this Information Notice

SA „FLOARE-CARPET”, which carries on its commercial activity under the Floare Carpet brand, hereinafter referred to as the “Company”, pays particular attention to the protection of privacy and to the responsible processing of the personal data of persons with whom it interacts.

This Information Notice explains how the Company collects and uses the personal data of customers, potential customers, persons who request information about the Company's products or services, recipients of orders, persons who file complaints or warranty requests, as well as those of other persons who interact with the Company in the context of its ordinary commercial activity.

The Notice has been drawn up in accordance with Law No. 195/2024 on the Protection of Personal Data and seeks to provide, in a clear and accessible form, the information required in particular by Art. 13 of this Law.

This Notice does not constitute consent. Where a specific processing operation requires your consent, it will be requested separately, clearly and for the specific purpose for which it is necessary.

2. Who is the controller of your data

The controller of the personal data processed under this Notice is:

Controller: SA „FLOARE-CARPET”
Commercial brand: Floare Carpet
IDNO: 1003600088549
Registered office: Chișinău, 15 Grădina Botanică Street
E-mail: info@floarecarpet.md
E-mail dedicated to data protection: info@floarecarpet.md
Phone: +373 22 85 66 46

3. In which situations we may collect your data

We may process personal data when you enter one of our stores and request information or assistance, when you contact us by telephone, by e-mail, through the form available on the website or through an official messaging channel, when you request an offer or a consultation regarding products, when you place an order, request delivery of a product, make or confirm a payment, request commercial documents, file a complaint, request the exercise of a warranty right or communicate with us in connection with a purchase.

Data may also be processed when you request a viewing or video consultation regarding our products.

In certain situations, an order may be placed by a person for the benefit of, or for delivery to, another person. In this case, we may receive the recipient's name, telephone number and address from the person placing the order. Where this is necessary, we will ensure that the recipient is informed in accordance with the applicable requirements for data not obtained directly from the data subject.

4. What categories of data we may process

The data we process depend on the nature of your interaction with us. We do not automatically collect all the categories of data described below, but only the information necessary for the specific situation.

In the case of a request for information or a communication with the Company, we may process the surname and first name, telephone number, email address, the content of the message or request, the products you are interested in, and the information you decide to communicate to us during the conversation.

When you place an order, in addition to contact data, we may process information regarding the ordered products, the quantity, the order value, the payment method, the date and place of purchase, the store through which the order was managed, its status, and other information necessary for the performance of the contractual relationship.

If you request delivery, we may process the surname and first name of the contact person or recipient, the telephone number, the delivery address, the information necessary to identify the delivery location, and other instructions you reasonably communicate to us for the performance of the delivery.

For the issuance of accounting or tax documents, we may process data whose collection is required or permitted by applicable legislation. In the case of natural persons, we will request the IDNP, data from the identity document, or other additional information if these are necessary for the specific document or obligation to be fulfilled.

In the case of complaints, warranty requests, or other post-sale requests, we may process identification and contact data, information regarding the product and transaction, the receipt, invoice, or other proof of purchase, the description of the problem, the correspondence with you, the documents or photographs you send to us to demonstrate the situation, and information regarding how the request was resolved.

If you make the payment by means of a banking instrument, we may process the information regarding the execution and confirmation of the transaction that we receive lawfully from the bank or the payment service provider.

During interactions with our staff, you may also voluntarily communicate other information to us. We recommend that you do not transmit to us personal data that are not relevant to your request, in particular copies of identity documents, health data, detailed financial information, or other sensitive data, if these are not necessary for the specific situation and have not been justifiably requested from you.

5. Purposes for which we use the data and the legal bases

5.1. Responding to requests and providing the requested information

When you contact us to request information about available products, prices, characteristics, stock levels, purchase terms, delivery or other commercial matters, we use the data you provide to us to analyze the request and respond to you, within the meaning of Art. 6(1)(b) of Law No. 195/2024.

For general communications, the processing may also be justified by the Company's legitimate interest in managing requests addressed to its business, communicating with interested persons and ensuring the proper operation of the customer relations service, under Art. 6(1)(f) of Law No. 195/2024.

5.2. Conclusion and performance of the sales contract

When you purchase a product or place an order, we process the data necessary for recording and confirming the order, verifying product availability, preparing it, communicating with you and fulfilling the other obligations arising from the contractual relationship.

The legal basis for these operations is the necessity of performing the contract to which you are a party, in accordance with Art. 6(1)(b) of Law No. 195/2024.

5.3. Organization of delivery

When you request delivery of the products, we use the name, contact details, address and information related to the order for scheduling and carrying out the delivery, communicating with you or with the recipient and managing any situations that arise during transport.

This processing is necessary for the performance of the contract and is based on Art. 6(1)(b) of Law No. 195/2024.

To the extent that the delivery is carried out by an external provider, we will disclose to it only the data necessary for the provision of that service.

5.4. Accounting and tax records and fulfilment of statutory obligations

The Company is obliged to keep certain records and to issue, retain or present documents in accordance with tax, accounting and consumer protection legislation and other rules applicable to its business.

In these situations, the processing of data is based on the necessity of complying with a legal obligation applicable to the Company, pursuant to Art. 6(1)(c) of Law No. 195/2024.

5.5. Warranties, complaints and resolution of after-sales requests

If you contact us to exercise a warranty right, to return a product, to submit a complaint or to resolve another issue related to a purchase, we will use the relevant data to verify the situation, communicate with you and resolve the request.

Depending on the specific nature of the request, the processing may be necessary for the performance of the contract, for compliance with a legal obligation or for the Company's legitimate interest in appropriately documenting and resolving claims and complaints.

5.6. Prevention of fraud and abuse and protection of the Company's rights

To the extent necessary and proportionate, we may retain and use certain information to prevent fraud, verify contested transactions, investigate incidents, manage disputes, establish, exercise or defend rights before courts, authorities or other competent bodies.

These operations are generally based on the Company's legitimate interest in protecting its assets and rights, preventing fraud and being able to demonstrate how a commercial relationship was performed, under Art. 6(1)(f) of Law No. 195/2024.

The data retained for this purpose will be limited to what is relevant to the specific situation and will not be used subsequently for incompatible purposes.

5.7. Marketing and optional commercial communications

To the extent that we offer you the possibility to subscribe to a newsletter or to receive promotional messages by e-mail, SMS or other channels, the data necessary for such communication will be used only on the basis of an appropriate legal basis.

Where the legal basis is consent, it will be requested separately, and the possibility of purchasing products, requesting a quote or benefiting from the Company's services will not be conditional on granting it.

You may withdraw your consent or object to marketing communications at any time, without this affecting existing purchases or contractual relationships.

This Notice does not, by itself, constitute your consent to marketing.

6. Mandatory or optional provision of data

In most situations, you decide whether you wish to contact us or purchase our products. Once you request the conclusion or performance of a certain operation, however, some data become necessary for carrying it out.

For example, if you request delivery of a product, we will normally not be able to carry out the delivery without an address and without a reasonable means of contact. Similarly, certain information may be mandatory for issuing a tax document or for fulfilling a legal requirement.

Where a field is optional, this must be apparent from the form or from the context. Refusal to provide data that are not necessary must not prevent access to the requested product or service.

7. Where we obtain your data

In most cases, the data are obtained directly from you when you contact us, place an order, request delivery, complete a form, or communicate with our staff.

In certain situations, the information may come from the person who places an order on your behalf or requests delivery of a product to you, from a provider involved in the performance of the contract, or from a financial institution that confirms that a payment has been made.

If we receive data about you from another person and the processing does not fall within an exception provided by law, we will ensure appropriate information within the time limit and under the conditions established by Law No. 195/2024.

8. To whom we may disclose your data

The Company does not sell customer databases and does not disclose information to third parties without a purpose and a legal basis.

However, for the conduct of its activity, there may be situations in which certain data must be communicated or made available to providers or recipients.

In the case of deliveries, the necessary data may be communicated to the carrier or logistics provider that performs the delivery. The volume of information transmitted will be limited to what is necessary for identifying the order, contacting the recipient, and handing over the products.

Data may be accessed by providers of IT services, hosting, maintenance, CRM, communication services or other technical services, when they provide the infrastructure necessary to the Company. In situations where the provider processes data on behalf of the Company, the relationship will be governed in accordance with Art. 28 of Law No. 195/2024, including through contractual obligations regarding confidentiality, security, the use of subprocessors, assistance provided to the Company, and the deletion or return of data.

The relevant data may be accessible to accounting service providers, auditors, legal consultants, or other specialists, to the extent necessary for the performance of their duties and subject to compliance with applicable confidentiality obligations.

In payment operations, banks, financial institutions, payment service providers, or payment infrastructure operators may process certain information in their own capacity and in accordance with their legal obligations.

When the law obliges us or when there is a valid request issued within the limits of legal powers, the data may be communicated to public authorities, tax authorities, law enforcement bodies, courts of law, bailiffs, or other competent authorities.

In the event of a dispute or the need to protect the Company's rights, the relevant information may be communicated to lawyers, experts, courts, authorities, or other legitimate participants in that procedure.

Internal access to data is also limited. The fact that a person is an employee of the Company does not confer on them the right to access all customer data. Access is granted according to concrete duties and the professional need to know the respective information.

9. Data transfers outside the Republic of Moldova

The Company verifies the location of providers and of the technical infrastructure used for data processing. The use of an electronic service may involve, in certain situations, the storage of or access to data from outside the Republic of Moldova, even if the service is used by our staff in the Republic of Moldova.

In each such situation, the Company verifies the lawfulness of the transfer and applies the corresponding legal mechanism provided by the Law, including, as the case may be, a decision on the adequate level of protection, appropriate safeguards, or the applicable contractual clauses.

10. How long we retain data

The retention period depends on the purpose for which the data were collected, the nature of our relationship with you and the applicable legal obligations.

Commercial requests that do not result in a purchase will be retained only for as long as is reasonably necessary to manage the request and any related follow-ups, in accordance with the term set out in the Company’s Retention Table. In the absence of a specific reason for longer retention, such data will be erased after expiry of the approved internal term for uncompleted commercial requests.

Data relating to orders and contractual relationships will be retained for the period necessary for the performance of the contract, the resolution of any post-contractual obligations and, to the relevant extent, for the period during which claims related to that relationship may be brought or defended.

Financial, accounting and tax documents will be retained for the mandatory periods established by applicable legislation.

Data relating to a complaint, warranty or dispute will be retained until the final resolution of the matter and, where necessary, until expiry of the period during which the resolution or legal relationship may give rise to additional claims or obligations.

Data used for marketing on the basis of consent will be used until consent is withdrawn or until the purpose for which it was granted ceases. Information strictly necessary to demonstrate the existence or withdrawal of consent may be retained thereafter to the extent necessary to demonstrate compliance.

If certain information becomes necessary for a dispute, audit, investigation or for the establishment, exercise or defence of a right, erasure may be suspended temporarily only for the relevant information and only for the period during which that necessity persists.

The specific operational periods are established and administered through the Company’s Retention Policy and Retention Table, drawn up in application of the storage limitation principle provided for by Law No. 195/2024.

11. How we protect your data

The Company applies technical and organisational measures designed to protect data against unauthorised access, loss, alteration, destruction or unlawful disclosure.

Depending on the nature of the system and the associated risks, these measures include access control according to professional duties, use of individual accounts, protection of equipment and information systems, management of access rights, backups, security updates, protection of physical documents and training of personnel who process data.

Employees and persons working under the Company’s authority may process data only in accordance with their duties and the instructions received and are subject to confidentiality obligations.

In relation to suppliers that process data on our behalf, we assess the guarantees they provide and include the contractual obligations provided for by law.

12. Video surveillance in stores

Certain stores and premises of the Company are under video surveillance for the purpose of protecting persons and property, preventing and investigating incidents and defending the Company’s legitimate interests.

Video surveillance constitutes a distinct processing operation and is governed by a separate CCTV Information Notice, available in the monitored premises and, where applicable, online.

Before entering a video-surveilled area, individuals are informed by specific signage.

13. Promotional campaigns, raffles and contests

If you participate in a raffle, contest, prize campaign or other promotional action organised by the Company, the data relating to your participation will be processed in accordance with the campaign rules and the specific information notice for that campaign.

14. Your Rights

Law No. 195/2024 confers on you a number of rights concerning personal data. The exercise of a right depends on the specific circumstances of the processing and, in certain cases, on the legal basis underlying it.

You have the right to request confirmation as to whether or not we process data concerning you and, where such processing exists, to obtain access to such data and to the information provided by law.

If the data we hold are inaccurate or incomplete, you have the right to request their rectification or completion.

In the situations provided by law, you may request erasure of the data. However, this right is not absolute. For example, the Company may be required to retain certain documents in order to comply with a legal obligation or may need certain information for the establishment, exercise, or defense of a right.

Under the conditions provided by law, you may request restriction of processing, in which case the data will be retained, but their use will be limited in accordance with the applicable legal conditions.

Where processing is based on consent or on the performance of a contract and is carried out by automated means, you may, under the conditions of law, benefit from the right to data portability.

Where processing is based on the Company’s legitimate interest, you have the right to object to the processing on grounds relating to your particular situation. Following your objection, we will cease the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or unless the processing is necessary for the establishment, exercise, or defense of a right.

As regards direct marketing, you may object at any time to the use of the data for this purpose. After you exercise your right to object, the data will no longer be used for direct marketing.

If processing is based on your consent, you have the right to withdraw it at any time. Withdrawal of consent produces effects for the future and does not affect the lawfulness of processing carried out before withdrawal.

You also have the right to lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova (CNPDCP) if you consider that the processing of your data violates data protection legislation.

15. How You Can Exercise Your Rights

To exercise your rights or for questions regarding how we process your data, you may contact us at:

E-mail: info@floarecarpet.md
Postal address: Chișinău municipality, 15 Grădina Botanică Street
Telephone for information: +373 22 85 66 46

You may also submit the request at one of our stores, in which case it will be forwarded to the person responsible for data protection.

We will respond to requests within the period established by law, in principle within no more than one month of receiving them. In situations where the law permits an extension of the period due to the complexity or number of requests, we will inform you of the extension and the reasons for it.

In order to protect the data against disclosure to another person, we may request additional information where we have reasonable doubts as to the identity of the requester. However, as a general rule, we do not request a copy of the identity document for each request. Verification will be carried out by a method proportionate to the nature of the information requested and to the risk of disclosure.

The exercise of rights is, in principle, free of charge, subject to the exceptional situations provided by law for manifestly unfounded or excessive requests.

16. Automated Decisions and Profiling

In the ordinary commercial operations described in this Notice, the Company will not adopt a decision concerning you based solely on automated processing that produces legal effects or similarly affects you to a significant extent without complying with the conditions and safeguards provided by Law No. 195/2024.

If, in the future, the Company introduces a profiling or automated decision-making process for which the law requires informing the data subject, you will receive in advance the additional information provided by law, including relevant information on the logic used and the envisaged consequences of the processing.

Specific information on the use of the website is available in the Privacy Policy, and information on the use of cookies in the Cookie Policy.