Privacy Policy

1. Who Is the Data Controller

The data controller is TOT STUDIO LABS SRL, a company registered in the Republic of Moldova, mun. Chișinău, sec. Centru, str. Drumul Viilor. Contact details for data processing inquiries are provided in Section 13.

2. Who This Policy Applies To

This Policy applies to three categories of people:

• Visitors of the tot.md website — those who browse the site, submit an inquiry, or contact us.
• Representatives of client companies — those who use the TOT Sites platform dashboard (business owner, administrators, staff).
• End customers of companies using the TOT Sites platform — their data is processed on TOT's infrastructure but controlled by the client company itself. The rules for such processing are described in Section 11 and in a separate Data Processing Agreement (DPA).

3. What Data We Collect

• Contact details: name, email, phone number, company name — when filling out forms on the website or activating the platform.
• Account data: login, role, settings, action history in the dashboard.
• Payment and billing details of the client company required for invoicing (IDNO, legal address). We do not store bank card data — it is processed directly by the payment provider (MAIB Business).
• Technical data: IP address, browser and device type, interface language, date and time of visits, cookies.
• Content of inquiries sent via forms, email or messengers.The content of inquiries submitted through forms, email or messengers.

4. Purposes and Legal Grounds for Processing

• Processing inquiries, answering questions and preparing commercial proposals — legitimate interest.
• Concluding and performing the TOT Sites platform subscription agreement, invoicing — performance of a contract.
• Informing about new features and offers — with the user's consent, with the option to unsubscribe at any time.
• Bookkeeping and tax accounting — legal requirement.
• Traffic analytics and improvement of the website and product — legitimate interest.
• Ensuring platform security and fraud prevention — legitimate interest.

5. Cookies and Analytics

We use cookies for the website's operation, analytics, and remembering your preferences. You can disable optional cookies in your browser settings — this will not affect the site's basic functionality.

• Essential cookies — authentication, interface language, cart and form functionality.
• Analytics cookies — Google Analytics, Cloudflare Insights (in anonymized form).
• Marketing cookies — used only with your consent (e.g., Meta Pixel, Google Ads).

6. Who We Share Data With

We do not sell personal data. It is shared only with the following categories of recipients:

• Hosting and infrastructure providers that keep the website and platform running.
• The MAIB Business payment provider — for processing payments and invoicing.
• Analytics and email delivery services operating under confidentiality agreements.
• Government authorities of the Republic of Moldova — solely upon an official request based on law.

7. International Data Transfers

TOT's core infrastructure is located in Moldova and EU countries. If data is transferred to a provider outside Moldova or the EU, we use providers that ensure a comparable level of data protection (standard contractual clauses or equivalent safeguards).

8. Data Retention Period

Data is kept no longer than necessary for the purposes of processing: inquiry data from the website — up to 3 years from the last contact; platform client data — for the term of the agreement plus 5 years after its termination, for accounting and tax purposes, unless a different period is set by law.

9. Data Subject Rights

• Right of access — to find out whether we process your data and to obtain a copy of it.
• Right to rectification — to request correction of inaccurate data.
• Right to erasure — to request deletion of data where no legal grounds exist for its retention.
• Right to restriction of processing and to object to processing.
• Right to data portability — to receive your data in a machine-readable format.
• The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, write to us at our contact email — we will respond within 30 days.

10. Data Security

We apply technical and organizational protection measures: encrypted connections (HTTPS/TLS), role-based access restrictions, action logging, regular backups, and DDoS protection. Only employees who need it for their work have access to the data.

11. Data of TOT Sites Platform Clients

If your company uses the TOT Sites platform to build a website, accept bookings or take orders, you (the client company) are the data controller of your own customers — you determine what data to collect and why. In this case, TOT acts as the processor: we store and process the data on your instructions and provide its technical protection.

The terms of such processing, including the allocation of responsibility, sub-processors and the incident notification procedure, are set out in a separate Data Processing Agreement (DPA), which forms an appendix to the platform subscription agreement.

12. Changes to This Policy

We may update this Policy. The date of the current version is shown at the top of the page. We notify platform clients by email in advance of any material changes affecting them.

13. Contacts and Complaints

TOT STUDIO LABS SRL

Republic of Moldova, mun. Chișinău, sec. Centru, str. Drumul Viilor

Phone: +373 7999 6927

Email: [email protected]

If you believe your rights have been violated, you may file a complaint with the National Center for Personal Data Protection of the Republic of Moldova: datepersonale.md