Privacy Policy

The controller of your data is PRO SPA S.R.L. (S.R.L. „PRO SPA”), which runs the La Fête salon:

• IDNO 1024600087769, VAT code 0212101;
• registered office: MD-2012, mun. Chișinău, str. București 90, ap. 21;
• salon: 5 Sfatul Țării St., Chișinău;
• phone: +373 69 120 126;
• email: prospamoldova@yahoo.com.

We have not appointed a data protection officer. For any question about your personal data, write to the email address above: your message will reach the member of our team who handles these requests.

Data you give us

• Website forms (booking, contact, questions): name, phone number, email address (optional), the service you are interested in, your message, preferred contact channel and your choices regarding marketing messages.
• Business (B2B) enquiries, for example about esthemax® products: additionally, company or salon name and city.
• Messages sent by phone, email or Instagram Direct: whatever data you choose to share with us.
• Appointments: date and time, chosen treatment, specialist, confirmations and messages about the appointment, visit history.

Data collected automatically

• technical data: IP address, browser and device type, pages visited, date and time of visit (server logs);
• data from cookies and similar technologies: necessary ones always, analytics, marketing and functional ones only with your consent (see our Cookie Policy);
• technical signals generated by Google reCAPTCHA, which loads only when you start filling in a form (for example, how you interact with the page), used to tell humans from bots.

Data we do not ask for on the website

We do not ask for health information on the website, and we kindly ask you not to include it in your messages. Any contraindications are discussed during your consultation at the salon; information about the data collected there is provided to you separately, at the salon.

Your name and phone number are required so that we can reply and book you in; without them we cannot handle your request. All other fields are optional.

The legal bases below are those set out in Article 6(1) of Law No. 195/2024.

• Answering requests and booking. We contact you and agree on the treatment and time. Basis: steps taken at your request before entering into a contract, and performance of the contract (point b).
• Appointment confirmations and reminders by SMS, phone or email. Basis: performance of the contract (point b).
• Accounting and other legal obligations, including replies to requests from public authorities. Basis: legal obligation (point c).
• Website security and spam protection (server logs, Google reCAPTCHA). Basis: our legitimate interest in protecting the website and forms (point f).
• Establishing, exercising or defending legal claims. Basis: our legitimate interest (point f).
• Website usage statistics and online advertising (Google Analytics 4, Google Ads, Meta Pixel). Basis: your consent (point a), given through the cookie banner.
• Marketing messages by SMS and email (news, offers, invitations). Basis: your consent (point a), in line with Articles 26 and 28 of Law No. 62/2022 on advertising and Article 17 of Law No. 284/2004 on electronic commerce.
• B2B enquiries (esthemax® products for salons and cosmetologists). Basis: pre-⁠contractual steps (point b) or, for data of company representatives, our legitimate interest in communicating with business partners (point f).

Where we rely on legitimate interest, we make sure it does not override your rights and freedoms. You can object to such processing at any time.

Profiling and automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Only if you have given marketing consent may we group contacts by interests (for example, the treatments you are interested in) to send you relevant offers.

We do not sell your data. We share it only to the extent necessary with:

• TEAM TASKING S.R.L. (IDNO 1025600000415, Chișinău), a processor that develops, hosts and maintains the website and the booking and CRM platform; the platform is hosted on servers in the European Union;
• the website hosting provider, as a processor;
• Google Ireland Limited and Google LLC: Google Tag Manager, Google Analytics 4 and Google Ads (only with your consent), Google reCAPTCHA (only when you fill in a form) and Google Maps (only when you open the map or have accepted functional cookies);
• Meta Platforms Ireland Limited: Meta Pixel, only with your consent;
• SMS service providers: for appointment confirmations and reminders and, only with your consent, for marketing messages;
• our email service provider: for correspondence with you;
• Instagram (Meta), if you write to us via Instagram Direct; in that case Instagram's own terms and privacy policy also apply;
• accountants, auditors and legal advisers bound by confidentiality, where necessary;
• public authorities, only where the law requires it.

Our processors are bound by contracts requiring them to process data only on our instructions and to keep it secure (Article 28 of Law No. 195/2024). For some processing, Google and Meta act as controllers in their own right, under their own policies: Google, Meta.

The booking and CRM platform is hosted in the European Union. Some providers, notably Google and Meta, may transfer data to the United States or other countries.

Such transfers take place only under the conditions of the chapter on transfers of Law No. 195/2024: to countries that ensure an adequate level of protection, or subject to appropriate safeguards such as the standard contractual clauses used by these providers. You can ask for information about the safeguards applied by writing to prospamoldova@yahoo.com.

• Requests that do not turn into appointments: 12 months from the last communication.
• Client file and appointment history: for the duration of our relationship and 3 years after it ends.
• Proof of marketing consent: while consent is active and for 3 years after it is withdrawn, as evidence.
• Accounting records: for the periods required by Law No. 287/2017 on accounting and financial reporting and by tax legislation.
• Server logs: up to 30 days, except those needed to investigate a security incident.
• Google Analytics statistics: 14 months.
• Cookies: as listed in our Cookie Policy.

When these periods expire, the data is deleted or anonymised.

As a data subject, you have the right:

• of access: to find out whether we process data about you and to receive a copy;
• to rectification of inaccurate or incomplete data;
• to erasure (“right to be forgotten”), under the conditions set by law;
• to restriction of processing;
• to data portability: to receive the data you provided to us, processed on the basis of consent or contract, in a structured, commonly used format, or to have it sent to another controller;
• to object to processing based on legitimate interest; you can object to direct marketing at any time, without giving reasons (Article 21);
• to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you;
• to lodge a complaint with the National Center for Personal Data Protection.

Email us at prospamoldova@yahoo.com, call +373 69 120 126 or tell us at the salon. To make sure data reaches the right person, we may ask you for additional information to confirm your identity.

We reply without undue delay and within one month of receiving your request at the latest. If the request is complex or we receive many requests, this period may be extended by two further months; in that case we will let you know within the first month and explain why (Article 12(3) of Law No. 195/2024).

Exercising your rights is free of charge. Only for manifestly unfounded or excessive requests does the law allow a reasonable fee to be charged or the request to be refused.

We send SMS or emails with news and offers only if you ticked the relevant box in a form or gave your explicit consent in another way (for example, at the salon). These boxes are never pre-⁠ticked, and consent is not a condition for booking.

You can withdraw consent at any time, free of charge: via the unsubscribe link in any email, by following the instructions in the SMS, or by writing to or calling us. Withdrawal takes effect within 72 hours at most (Article 26 of Law No. 62/2022).

Appointment confirmations and reminders are not marketing messages; you will keep receiving them as long as you have appointments.

The website is informational. For information society services, online consent may be given by a person who has reached the age of 14 (Article 8 of Law No. 195/2024); below that age, consent from a parent or legal guardian is required.

Appointments for minors are made by a parent or legal guardian. If you become aware that a minor has sent us data without the required consent, write to us and we will delete it.

We apply technical and organisational measures appropriate to the risks, including:

• encrypted connection (HTTPS/TLS) for the website and forms;
• access to data only for people who need it, with individual accounts;
• regular backups;
• contracts with processors in line with Article 28 of Law No. 195/2024;
• protection of forms against abuse (reCAPTCHA).

No method of transmission over the internet is completely secure. If a security incident occurs that may affect your rights, we will act in accordance with the law, including by notifying the supervisory authority and, where required, you.

We use necessary cookies to run the website and, only with your consent, analytics, marketing and functional cookies. Analytics and marketing tags (Google Analytics, Google Ads, Meta Pixel) do not load before you give consent.

The full list and how to change your choices are in our Cookie Policy. You can change your choice at any time via the “Cookie settings” link in the website footer.

If you have a concern, please write to us first: we will try to resolve it quickly. You nevertheless have the right to lodge a complaint at any time with:

National Center for Personal Data Protection (CNPDCP)
MD-2004, mun. Chișinău, str. Serghei Lazo 48
phone: 022 820 801
email: centru@datepersonale.md
www.datepersonale.md

You may also bring the matter before a court.

We may update this policy when our services, providers or the law change. The current version is published on this page with the date of the last update. If a change significantly affects your rights, we will also inform you directly, through the contact channel you gave us.