Privacy Policy

This Regulation on the processing of information containing personal data sets out the general rules applicable within O.C.N. ”TOP LEASING & CREDIT” S.R.L. regarding the collection, recording, organisation, structuring, storage, adaptation, alteration, consultation, use, disclosure, transmission, restriction, erasure or destruction of personal data.

I. General provisions

1.1. The Regulation is drawn up in order to ensure that the processing activities carried out by O.C.N. ”TOP LEASING & CREDIT” S.R.L. comply with the applicable personal data protection legislation, including Law No. 133 of 8 July 2011 on the protection of personal data, applicable until Law No. 195/2024 enters into force, and Law No. 195 of 25 July 2024 on the protection of personal data, in force from 23 August 2026. 1.2. This Regulation governs the general conditions and requirements for the processing of personal data of the data subjects of O.C.N. ”TOP LEASING & CREDIT” S.R.L., including, as the case may be, clients, potential clients, employees, candidates, collaborators, representatives of contractual partners, suppliers, beneficiaries, visitors, users of the Company platforms and applications and other natural persons whose data is processed in the course of the Company activity. 1.3. For the purposes of this Regulation, O.C.N. ”TOP LEASING & CREDIT” S.R.L. (hereinafter — the “Company”), with its registered office in Chisinau, str. Alexandru cel Bun 108/1, of. 56, IDNO 1006600044168, acts as a personal data controller insofar as it determines the purposes and means of the processing of personal data. 1.4. The terms used in this Regulation are interpreted within the meaning provided by the applicable personal data protection legislation.

II. Purpose and categories of personal data processed

2.1. In the course of its activity, the Company may process, depending on the specifics of the legal relationship and the concrete purpose of the processing, the following categories of personal data:

• surname, first name and patronymic;
• day, month and year of birth;
• signature;
• address (locality, street, number);
• mobile phone, landline phone, fax;
• e-mail address;
• gender;
• image;
• voice;
• the Google+ and/or Facebook username, together with the information whether the account is verified or not;
• the numeric ID of the social network(s);
• the link to the public profile for the selected social network service;
• other identifiers of the data subject, where the data subject records them in the system, such as: the application, the request, the complaint or any other type of information closely related to the subject matter of the services provided, or other information supplied by the data subject.

2.2. The Company does not collect all the listed categories of data for every data subject, but only data that is adequate, relevant and limited to what is necessary in relation to the concrete purpose of the processing. 2.3. The processing of special categories of personal data is carried out only in the cases and under the conditions provided by the applicable legislation and with the application of appropriate technical and organisational measures to protect such data. 2.4. Personal data may be processed, as the case may be, for the following purposes:

• a) keeping records of clients;
• b) fulfilling legal obligations as well as the legitimate interests of the Company in connection with the sale of products;
• c) providing support and client servicing;
• d) opening the client account;
• e) subscribing to the newsletter;
• f) reporting to public authorities;
• g) processing data within the Company;
• h) evaluating and improving services;
• i) providing direct marketing services;
• j) advertising, marketing or publicity;
• k) evaluating (consumer) behaviour;
• l) processing cookie modules;
• m) fulfilling other obligations arising from the legal relationship established with clients.

2.5. Any use of personal data for purposes other than those that are specified, explicit and legitimate is prohibited, except in the cases permitted by the applicable legislation.

III. Location and description of the record systems

3.1. Personal data may be processed and stored by the Company:

• a) on paper, including through contracts, applications, forms, files, registers, correspondence, accounting documents, personnel documents or other physical documents;
• b) in electronic format, including through information systems, applications, databases, online platforms, e-mail, servers, storage devices, IT equipment or other electronic means used by the Company;
• c) in a mixed manner, where data is collected on a physical medium and subsequently entered into electronic systems or vice versa.

3.2. The Company determines, depending on its infrastructure, the places, systems, applications, equipment and media through which personal data is processed. 3.3. Paper documents containing personal data are kept in a room equipped and adapted for the storage and archiving of documents, with access limited to authorised persons. 3.4. Data processed in electronic format may be stored on the Company servers, on external servers, in cloud solutions or in other systems administered by the Company or by duly contracted suppliers, under the conditions of the applicable legislation. 3.5. Where maintenance, technical administration or IT support is provided by external suppliers, they shall process personal data only on the basis of the documented instructions of the Company and on the basis of appropriate confidentiality, security and data protection obligations.

IV. Collection, subjects and recipients of personal data

4.1. Personal data may be processed by the Company manually, automatically or in a mixed manner, depending on the means used and the purpose of the processing. 4.2. Data may be collected directly from the data subject or, as the case may be, from other sources permitted by law. 4.3. Data may be collected through the following means, as the case may be:

• a) completing forms, applications, contracts, questionnaires or other documents;
• b) physical or electronic correspondence;
• c) telephone, face-to-face or electronic interactions;
• d) use of the website, applications, platforms or systems of the Company;
• e) use of the services, products, benefits or functionalities offered by the Company;
• f) photo, video or audio recordings, if used;
• g) other means communicated to the data subject or permitted by the applicable legislation.

4.4. The Company may process the data of the following categories of data subjects: directly from the personal data subjects; indirectly from the personal data subjects through technical methods or means over the internet. 4.5. At the time of data collection or under the conditions provided by law, the Company informs the data subjects about the processing of their personal data, including about the purposes of the processing, the legal grounds, the categories of data, the recipients, the storage period, the rights of the data subjects and the manner of exercising them. 4.6. Personal data may be disclosed, as the case may be and under the conditions of the law, to the following categories of recipients:

• a) the personal data subjects;
• b) the legal representatives of the personal data subjects;
• c) central and local public authorities;
• d) contractual partners;
• e) supervisory bodies on the basis of a justified request.

4.7. The transfer of data to third parties is carried out only on the basis of an applicable legal ground, within the limits of the pursued purpose and with the application of appropriate guarantees regarding confidentiality, security and data protection.

V. Legal grounds for processing and consent

5.1. Personal data is processed by the Company only on the basis of an applicable legal ground. 5.2. Depending on the concrete purpose of the processing, the legal ground may be:

• For the purposes provided in point 2.4 letters a), c), d) and m), the legal ground of the processing is article 6 paragraph (1) letter b) of Law No. 195/2024, namely processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• For the purposes provided in point 2.4 letters b) and f), the legal ground of the processing is, as the case may be, article 6 paragraph (1) letter c) of Law No. 195/2024, namely processing necessary for compliance with a legal obligation to which the Company is subject, including obligations in the field of consumer protection, tax, accounting, reporting, archiving or other obligations provided by the applicable legislation.
• For the purposes provided in point 2.4 letters b), g), h) and k), the legal ground of the processing may be article 6 paragraph (1) letter f) of Law No. 195/2024, namely processing necessary for the purposes of the legitimate interests pursued by the Company or by a third party, including internal administration of the activity, protection of commercial interests, evaluation and improvement of services, analysis of consumer behaviour, prevention of non-compliant use, establishment, exercise or defence of a right, with due regard for the rights and freedoms of the data subjects.
• For the purposes provided in point 2.4 letters e), i), j) and, as the case may be, k) and l), the legal ground of the processing is article 6 paragraph (1) letter a) of Law No. 195/2024, namely the consent of the data subject, where the processing concerns newsletter subscription, sending commercial communications, direct marketing, publicity, advertising, profiling for marketing purposes, the processing of non-essential cookie modules or other optional processing.
• For the purpose provided in point 2.4 letter l), the legal ground of the processing is determined according to the type of cookie modules used. Cookies strictly necessary for the functioning of the website, application or platform may be processed on the basis of the legitimate interest of the Company or of the necessity of providing the requested service, whereas analytics, marketing, advertising or personalisation cookies will as a rule be used on the basis of the consent of the data subject, under the conditions of the applicable legislation.

5.3. Processing operations necessary for the initiation, performance or termination of a contractual relationship shall not be conditioned upon consent, where they are based on the performance of the contract or on pre-contractual steps. 5.4. Processing operations necessary for the fulfilment of legal obligations of the Company shall not be conditioned upon consent. 5.5. Consent is requested only where the processing is based on this legal ground, including, as the case may be, for marketing communications, personalised analyses, sending optional notifications or other processing that is not necessary for the performance of a contract or for compliance with a legal obligation. 5.6. Consent must be freely given, specific, informed and unambiguous. The data subject has the right to withdraw consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal. 5.7. The refusal or withdrawal of consent does not affect processing carried out on the basis of other applicable legal grounds. 5.8. In all cases of processing, the Company will inform the data subjects, under the conditions of the law, at least about the purpose of the processing, the legal ground, the categories of data, the recipients or categories of recipients, the storage period, the rights of the data subjects and the manner of exercising them.

VI. Storage period and erasure of data

6.1. Personal data is kept only for the period necessary to fulfil the purposes for which it is processed. 6.2. Data may be kept for longer periods where this is necessary for compliance with a legal obligation, archiving, reporting, audit, resolution of complaints, establishment, exercise or defence of a right, or in other cases permitted by law. 6.3. The concrete storage periods are established by the Company depending on the category of data, the purpose of the processing, the nature of the legal relationship, the applicable legal obligations and the legitimate needs of the Company. 6.4. Upon expiry of the applicable periods or after the purpose of the processing has ceased, personal data will be erased, securely destroyed, anonymised or archived, as the case may be. 6.5. Where the data subject requests the erasure of data, the Company will analyse the request in relation to the applicable legal grounds, the legal retention obligations and any rights or legitimate interests that justify keeping the data.

VII. Rights of the data subjects

7.1. The Company, as a personal data controller, guarantees the observance of the personal data protection rights of clients, potential clients, users, employees, collaborators, representatives of contractual partners, suppliers, visitors and other data subjects under this Regulation. 7.2. In accordance with Law No. 195/2024, data subjects enjoy, as the case may be and under the conditions of the law, the following rights:

• a) the right to be informed about the processing of personal data;
• b) the right of access to the personal data concerning them;
• c) the right to rectification of inaccurate data or completion of incomplete data;
• d) the right to erasure of personal data, in the cases provided by law;
• e) the right to restriction of processing;
• f) the right to data portability, in the cases provided by law;
• g) the right to object to processing, including to processing for direct marketing purposes;
• h) the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them;
• i) the right to withdraw consent, where the processing is based on consent, without affecting the lawfulness of the processing carried out prior to the withdrawal;
• j) the right to lodge a complaint with the CNPDCP;
• k) the right to address the competent court.

7.3. The Company will analyse the requests of the data subjects and will respond within the time limits and under the conditions provided by the applicable legislation. 7.4. Where it has reasonable doubts concerning the identity of the person submitting the request, the Company may request additional information necessary to confirm the identity of the data subject. The rights may be exercised through the dedicated form on the Website: Personal data request

VIII. International transfers

8.1. The transfer of personal data to recipients in other states or to international organisations is carried out only under the conditions provided by the applicable legislation. 8.2. In the case of international transfers, the Company will apply, as the case may be, the appropriate safeguards provided by law, including adequacy decisions, contractual clauses, binding corporate rules or other mechanisms permitted by the applicable legislation. 8.3. Data subjects will be informed about international transfers, under the conditions of the law.

IX. Security incidents

9.1. Any incident or suspicion of an incident that may affect the security of personal data must be reported to the person or department designated by the Company. 9.2. Incidents may include, without being limited to: loss of documents, erroneous transmission of data, unauthorised access, unauthorised disclosure, compromise of passwords, infection of computer systems, accidental destruction of data or unavailability of systems. 9.3. The Company will assess the incident, document the measures taken and decide, as the case may be, whether notification of the CNPDCP and/or information of the data subjects is necessary.

X. Liability

10.1. Persons who process personal data on behalf of or for the Company are obliged to comply with this Regulation, the applicable legislation and the internal instructions of the Company. 10.2. Failure to comply with this Regulation may entail disciplinary, civil, administrative or criminal liability, as the case may be, in accordance with the applicable legislation and the internal documents of the Company.

XI. Contact details

11.1. For questions regarding the processing of personal data or the exercise of the rights of data subjects, interested persons may contact the Company at: O.C.N. ”TOP LEASING & CREDIT” S.R.L. Address: Chisinau, str. Alexandru cel Bun, 108/1, of. 56 E-mail: office@topleasingcredit.md Phone: 0 (22) 835 820

XII. Final provisions

12.1. The identification of data subjects and the collection of the data indicated in this Regulation are carried out, as the case may be, in electronic format, on paper or by other means made available by the Company. 12.2. Data subjects are responsible for providing accurate, complete and up-to-date data. The Company may presume that the data provided is correct, unless there are indications to the contrary. 12.3. In the case of reasonable doubts concerning the accuracy of the data, the Company may request additional information or documents for its confirmation or update. 12.4. This Regulation is reviewed periodically or whenever necessary, including in the case of changes in legislation, internal processes, systems used or risks related to the processing. 12.5. This Regulation is supplemented by the provisions of the applicable legislation and by the policies, procedures and internal instructions of the Company. 12.6. For distinct processing operations, including campaigns, applications, platforms, contests or special services, the Company may adopt separate notices, policies, regulations or annexes. 12.7. The amendment and supplementation of this Regulation is carried out in the manner established for its approval.

TERMS AND CONDITIONS

O.C.N. “TOP Leasing & Credit” S.R.L. (hereinafter “the Company”) owns the website( www.topleasingcredit.md , as well as the ownership rights for all information presented on this site, and reserves the right to modify the content and/or structure of the site at any time without prior notice. No information on this site shall be considered an offer. This site contains no suggestions or recommendations regarding any field of activity, and the information contained herein does not constitute a basis for decision-making of any kind. Therefore, the Company cannot be held responsible for any type of damage caused to the site user. It is forbidden for any person to reproduce, distribute, or publish in any form the content of the materials presented on this site without the written consent of the Company. O.C.N. “TOP Leasing & Credit” S.R.L. does not guarantee that the information appearing on this site is error-free, although it makes every effort to provide updated and accurate information. Any person wishing to obtain information and/or purchase any of the services or products presented on the site is invited to contact any of the O.C.N. “TOP Leasing & Credit” S.R.L. offices to be informed both about the availability of the respective service or product and about the contractual conditions, taxes, tariffs, and applicable commissions. The Company cannot be held legally responsible for any damage, loss, or prejudice caused to the site user due to erroneous information. Information may be changed at any time and no guarantee can be offered regarding its accuracy, completeness, or up-to-date status. O.C.N. “TOP Leasing & Credit” S.R.L. cannot guarantee or control the accuracy and timeliness of information present on third-party websites that are referenced on the Company’s site. Using the Website means complying with the Terms and Conditions stated above. Merely browsing the Website is not consent to optional cookies: these are placed only after the choice you express in the cookie banner.