Information

Privacy Policy

1. General provisions

This Privacy Policy (the "Policy") describes how "ROCK SOFT" S.R.L (fiscal code 1021600014623, mun. Chișinău, str. Doctor Tudor Strisca 8/1, of. 266, Republic of Moldova; hereinafter — "the Operator", "we") collects, stores, processes and protects the personal data of users of the sms.md platform.

Personal data is processed in accordance with Law No. 133 of 08.07.2011 on Personal Data Protection and Law No. 195 of 25.07.2024 (transposing EU GDPR 2016/679, effective from 23 August 2026), as well as Law No. 241-XVI of 15.11.2007 on Electronic Communications.

2. Data controller

  • Company: "ROCK SOFT" S.R.L
  • Director: Bodarev Valeri
  • Address: mun. Chișinău, str. Doctor Tudor Strisca 8/1, of. 266, Republic of Moldova
  • Fiscal code (IDNO): 1021600014623
  • Email: [email protected]
  • Phone: +373 69 425 208

3. Operator and client roles

The sms.md platform operates in two distinct roles:

  • Data Controller — for personal data of the platform's own clients (individuals or representatives of companies registered on the platform): identity data, contact data, billing data.
  • Data Processor — for SMS recipients' data (phone numbers and message content) supplied by client-operators. The client is responsible for the lawfulness of collecting and processing recipient data, including obtaining consent for commercial communications.

Processing of SMS recipient data as a processor is carried out solely on documented instructions from the client-operator, under a Data Processing Agreement (DPA).

4. Categories of personal data processed

Platform client data (Controller):

  • Identity data: full name, company name
  • Contact data: email address, phone number
  • Authentication data: email and password (hashed)
  • Billing data: payment details and accounting documents
  • Technical data: IP address, browser type, activity logs

SMS recipient data (Processor):

  • Phone numbers of message recipients
  • SMS message content supplied by the client
  • Delivery reports (delivery status of each message)

5. Purposes and legal bases for processing

Purpose Legal basis
Providing platform services (registration, authentication, SMS sending) Performance of contract (Art. 6(1)(b) GDPR)
Billing and accounting Legal obligation (Art. 6(1)(c) GDPR)
Technical and operational communications (account notifications, reports) Legitimate interest (Art. 6(1)(f) GDPR)
Marketing communications (news, offers) Consent (Art. 6(1)(a) GDPR) — withdrawable at any time
Sending SMS on behalf of clients Client-operator's instructions (DPA)
Fraud prevention and platform security Legitimate interest (Art. 6(1)(f) GDPR)

6. Recipients of data

Personal data may be transferred to:

  • Mobile network operators (Moldcell, Orange Moldova, Unite) — for SMS delivery
  • Payment service providers — for transaction processing
  • Cloud and infrastructure providers — for platform hosting (under data processing agreements with adequate safeguards)
  • Public authorities — where required by law

We do not sell or transfer your personal data to third parties for commercial purposes without your explicit consent.

7. International data transfers

Data may be processed on servers located in the Republic of Moldova and the European Union. Any transfer outside Moldova is carried out in compliance with Law No. 133/2011 (Art. 30–32) and, after August 2026, Law No. 195/2024 — via standard contractual clauses or other appropriate mechanisms.

8. Data retention

  • Active account data: for the duration of the contractual relationship
  • Inactive account data: 12 months from last activity, then deleted or anonymised
  • SMS delivery logs: 6 months for operational and support purposes
  • Billing data: 5 years, as required by Moldovan tax legislation
  • SMS recipient phone numbers: deleted upon campaign completion or at the client-operator's request, but no later than 30 days after contract termination

9. Your rights

Under Articles 12–18 of Law No. 133/2011 and Law No. 195/2024, you have the following rights:

  • Right to information — to be informed about the data processed and the conditions of processing
  • Right of access — to request a copy of personal data held about you
  • Right to rectification — to request correction, updating or deletion of inaccurate or incomplete data
  • Right to object — to object to processing, including for marketing purposes
  • Right not to be subject to automated individual decisions — not to be subject to decisions based solely on automated processing
  • Right to lodge a complaint — to file a complaint with the National Centre for Personal Data Protection or seek judicial redress

To exercise your rights, contact us at [email protected]. We will respond within 30 calendar days.

10. Data security

We apply appropriate technical and organisational measures to protect personal data: encryption in transit (TLS/HTTPS) and at rest, role-based access control, activity log auditing, and regular security testing. Access to personal data is limited to employees who require it to perform their duties.

11. Cookies

The sms.md website uses functional cookies required for proper platform operation (session, language preferences) and analytical cookies for service improvement. By continuing to use the site after accepting the cookie notice, you consent to their use. You may disable cookies in your browser settings, which may affect certain site functionalities.

12. Policy changes

We reserve the right to update this Policy. The revised version will be published on this page with the date of revision. We recommend checking this page periodically. Continued use of the platform after publication of changes constitutes acceptance of those changes.

13. Contact details and supervisory authority

For any questions regarding personal data processing:

You have the right to lodge a complaint with the supervisory authority:

  • National Centre for Personal Data Protection (NCPDP)
  • Address: str. Sergei Lazo, 48, Chișinău, MD-2004, Republic of Moldova
  • Phone: (022) 820 801  |  Email: [email protected]
  • Web: datepersonale.md