Co-funded by the European Union and the Government of the Republic of Moldova · Co-funded by the European Union and the Government of the Republic of Moldova · Project 101269445 — Digital Europe Programme

EDIH – Digital Innovation Hub of Moldova
§
Legal document

Privacy Policy

Last updated 6 iul 2026

1. Who we are — Data Controller

EDIH Moldova (European Digital Innovation Hub Moldova) is operated by ACETI — Association for Information Technologies, based in the Republic of Moldova. ACETI acts as the personal data controller within the meaning of Regulation (EU) 2016/679 (GDPR) and applicable national legislation.

Controller contact: gdpr@edih.md

2. Personal data we collect

We collect only data you provide voluntarily through the channels below:

Single Window form (beneficiary registration)

  • Full name of legal representative
  • Professional email address
  • Phone number
  • Company / organisation name and IDNO
  • Legal form and sector of activity
  • Number of employees and turnover (SME category)

Contact form

  • Full name
  • Email address
  • Content of the message sent

Event registration

  • Full name
  • Email address
  • Organisation / company (optional)

Newsletter

  • Email address

Browsing data (analytics)

Via Google Analytics 4 (with your consent), we collect aggregate data on browsing behaviour: pages visited, session duration, country/region, device type. This data does not directly identify you.

3. Purpose and legal basis of processing

PurposeLegal basis (GDPR)
Processing beneficiary registration applications for EDIH programmesArt. 6(1)(b) — performance of a contract / pre-contractual measures
Communication with beneficiaries and prospective beneficiariesArt. 6(1)(f) — legitimate interest
Organising and managing eventsArt. 6(1)(b) — performance of a contract
Sending the newsletterArt. 6(1)(a) — explicit consent
Reporting to the European Commission (funder)Art. 6(1)(c) — legal obligation / grant contractual clauses
Statistical analysis of website trafficArt. 6(1)(a) — consent (analytics cookies)

4. Retention periods

  • Registered beneficiaries: for the duration of participation in EDIH programmes and up to 5 years after project completion, in accordance with the European Commission's audit requirements.
  • Contact requests: 12 months from the date of submission.
  • Event participation data: 24 months.
  • Newsletter subscription: until consent is withdrawn.
  • Analytics data: in accordance with the GA4 retention policy (default 14 months, configurable).

Upon expiry of the retention period, data is deleted or irreversibly anonymised.

5. Recipients and third-party processors

We do not sell, rent or commercialise your personal data. We may share it, to the strictly necessary extent, with:

  • European Commission / CINEA — as funder, for reporting project indicators (Grant Agreement No. 101269445).
  • Cloud / hosting service providers — servers located in the EU/EEA, with data processing agreements (DPA).
  • Google Ireland Limited — via Google Analytics 4, for traffic statistics (only with your consent).
  • Email marketing platform — for sending the newsletter (only with your consent).
  • Public authorities — when required by law.

6. International data transfers

Your data may be transferred outside the European Economic Area (EEA) via Google Analytics 4 services (servers located in the USA). Google LLC participates in the EU–US Data Privacy Framework and has implemented Standard Contractual Clauses (SCC) adopted by the European Commission, ensuring an adequate level of protection.

Please consult the Google Privacy Policy for details. Google Privacy Policy

7. Your rights

Under the GDPR, you have the following rights, which you may exercise by email at gdpr@edih.md:

  • Right of access (Art. 15) — to receive a copy of the personal data we hold about you.
  • Right to rectification (Art. 16) — to have inaccurate or incomplete data corrected.
  • Right to erasure (Art. 17) — to request deletion of your data, under the conditions set by law.
  • Right to restriction of processing (Art. 18) — to limit processing in certain circumstances.
  • Right to data portability (Art. 20) — to receive your data in a structured, commonly used, machine-readable format.
  • Right to object (Art. 21) — to object to processing based on legitimate interest.
  • Withdrawal of consent — at any time, without affecting the lawfulness of processing prior to withdrawal.

We will respond to your requests within 30 calendar days, in accordance with Art. 12 GDPR.

8. Right to lodge a complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority:

  • Republic of Moldova: National Centre for Personal Data Protection (CNPDCP) — www.datepersonale.md
  • EU (Art. 77 GDPR): the supervisory authority of the EU Member State where you are located.

9. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction, including:

  • Encrypted transmission via HTTPS/TLS
  • Restricted data access on a need-to-know basis
  • Confidentiality agreements with employees and collaborators
  • Periodic security audits

10. Contact

For any request concerning personal data processing or the exercise of your rights, please contact us at:

Email: gdpr@edih.md
Address: ACETI, Republic of Moldova, Chișinău