Privacy and Cookie Policy

chirii.md is a rental marketplace in the Republic of Moldova, operated by Societatea cu Răspundere Limitată "CHIRII CONSULTING" (SRL "CHIRII CONSULTING"), IDNO 1015600039959, with its registered office at 49 Alexandru cel Bun St., Rîșcani district, MD-2011, Chișinău, Republic of Moldova (hereinafter "chirii.md" or "we").

In relation to your personal data we act as the data controller: we decide why and how it is processed.

This policy applies to the chirii.md website and all related services, and complements the Terms and Conditions.

We process personal data in accordance with:

• Law no. 195/2024 of the Republic of Moldova on personal data protection, in force since 23 August 2026;
• Regulation (EU) 2016/679 (GDPR), which Law no. 195/2024 transposes and whose standards we apply;
• Law no. 284/2004 on electronic commerce;
• the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+);
• the other applicable rules on data protection and electronic communications.

3.1. Data you give us directly

• Account: email address, first and last name, phone number and password, which is stored only as a hash — we cannot read it;
• Profile: profile photo, a short description, phone, city, country and a website address, if you choose to fill them in;
• Listings: title, description, price, deposit, rental period, item condition, photos, city, address and map coordinates, plus the contact name, phone and email you display;
• Video: only the link to a clip hosted on YouTube or Vimeo. We do not upload or store video files on our servers;
• Messages: conversations with other users through the platform chat;
• Reviews and ratings you leave for other users;
• Favourites: saved listings, saved searches and the owners you follow;
• Contact form: the name, email address, subject and message you send us;
• Sign-in with Google, Facebook or Apple: the account identifier at the provider, and the name and email address the provider shares with us. We do not receive your password and do not access your contacts;
• Consent at sign-up: the date you accepted the Terms and the Privacy Policy, the document version and, if you ticked it, the date of your marketing consent.

Please do not publish sensitive data in listings, messages or reviews — health information, religious or political beliefs, or other special categories of data. We do not ask for it and do not need it.

3.2. Data collected automatically

• Session: a session identifier, your IP address and browser type (user-agent), kept while the session is active;
• Security: the form-protection token (CSRF) and password reset requests;
• Preferences: the city selected in the header and your cookie choice, kept in cookies on your device;
• A view counter for each listing. It is a plain total — we do not record who visited the listing;
• A log of changes to accounts, profiles and listings (including contact details), used for moderation, security and to reconstruct what changed;
• Listing photos: on upload we automatically strip EXIF metadata, including GPS coordinates and the camera model.

We do not track which pages you visit, we do not build a per-user browsing history, and we do not use GPS or any other method of locating your device.

We only process your data when we have a legal basis for it:

Where we rely on consent, we ask for it in advance and you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

We do not sell your data and do not pass it to data brokers or advertising networks. We disclose it only in the situations below and only to the extent necessary:

• Other users: everything you publish in a listing — contact name, phone, city, address and photos — is publicly visible, including to signed-out visitors and search engines. Only publish data you are willing to make known;
• DigitalOcean, LLC — our hosting provider; servers and backups are located in its Frankfurt, Germany (EU) data centre;
• The transactional email delivery provider (confirmation codes, password resets, contact form messages);
• Emotion Trading SRL (the Unifun Bulk SMS platform) and the mobile operators of the Republic of Moldova — for SMS confirmation codes and, if you consented, for marketing messages;
• Google, Meta (Facebook) or Apple — only if you choose to sign in with that account; they confirm your identity to us;
• OpenAI or Google (Gemini) — only if you click “Detect the category from the photo”; they receive the listing's first photo solely to suggest a category;
• The external services embedded in pages, described in section 12, which receive your IP address when their content loads;
• Public authorities, courts and law-enforcement bodies, where the law requires it or to defend a legal claim;
• A potential acquirer, in the event of a merger, reorganisation or sale of the business, subject to the obligation to respect this policy.

Providers that process data on our behalf act as processors, under contracts requiring them to use the data solely on our instructions and to protect it appropriately.

Platform data is stored in the European Union (Frankfurt, Germany). Some optional services — sign-in with Google, Facebook or Apple, category detection with OpenAI or Google Gemini, and YouTube or Vimeo clips — involve transferring some data to the United States. In those cases we ensure an equivalent level of protection through at least one of the following safeguards:

• the transfer is made to a country recognised by the European Commission as providing an adequate level of protection;
• we use the standard contractual clauses approved by the European Commission;
• the provider is certified under the EU-U.S. Data Privacy Framework.

You can request details of the safeguards applied by writing to chirii.md@gmail.com.

We keep data only as long as necessary for the purposes described above:

You can delete your account at any time from your profile settings. Deletion is permanent and immediate: your profile, listings with their photos, conversations (for both participants), reviews, favourites and the account's change log are removed.

Deleted data may remain in backups for at most 14 days, until they are overwritten automatically. We do not restore deleted accounts from backups.

We apply technical and organisational measures proportionate to the risks: encrypted transmission over HTTPS, hashed password storage, session cookies inaccessible to JavaScript, CSRF protection on forms, role-based access control and logging of administrative actions.

Access to user data is limited to people who need it to perform their duties and who are bound by a confidentiality obligation.

No transmission of data over the internet can be guaranteed to be completely secure. If a personal data breach occurs, we notify the supervisory authority within 72 hours of becoming aware of it and, if the breach poses a high risk to your rights, we notify you without undue delay.

As a data subject you have the following rights:

• Right of access — you can find out what data we hold about you and get a copy. You can download a file with your data from your profile settings at any time;
• Right to rectification — you can ask us to correct inaccurate or incomplete data. Most of it you can edit yourself in your profile settings;
• Right to erasure — you can ask us to delete data when there is no longer a basis for keeping it. You can also delete your account directly in settings;
• Right to restriction of processing — you can ask us to suspend processing in certain situations;
• Right to object — you can object to processing based on our legitimate interest;
• Right to data portability — you can receive your data in a structured, commonly used, machine-readable format (JSON) directly from your profile settings;
• Right not to be subject to a decision based solely on automated processing — we make no such decisions; you can always change an automatically suggested category;
• Right to withdraw consent at any time, without affecting the lawfulness of earlier processing;
• Right to lodge a complaint with the supervisory authority — see section 16.

You can exercise your rights by writing to chirii.md@gmail.com. We reply within one month; for complex requests the deadline may be extended by two months, in which case we will tell you. Exercising your rights is free, but we may charge a reasonable fee or refuse manifestly unfounded or excessive requests.

To protect your data, we may ask for additional information that allows us to confirm your identity.

We send transactional messages directly related to using your account: sign-up confirmation, SMS confirmation codes, password resets and the team's replies to your requests. They are part of the service and cannot be turned off while the account is active.

Notifications about account activity — new messages or a favourite listing becoming available again — are shown inside the platform, not sent by email.

We send marketing messages (offers, promotions, news) by SMS, email or other channels only if you gave separate consent under the Marketing agreement. The consent is optional and you can withdraw it at any time in My profile → Marketing communications or by writing to us at chirii.md@gmail.com.

11.1. What cookies are

Cookies are small text files that the site stores in your browser. They let us recognise your device on later visits and remember your preferences. Cookies are not viruses and give us no access to your files.

11.2. The cookies we use

All the cookies above are set by chirii.md, are strictly necessary for the platform to work, and are not used to track you across other sites.

11.3. Optional cookies

At present we have no traffic analytics tool active, and we use no advertising, profiling or retargeting cookies.

The cookie banner nevertheless offers a "Measurement and analytics" category. If we introduce such a tool in the future, it will load only for visitors who have accepted that category. Until then, the option has no practical effect.

11.4. How to change your choice

You can change or withdraw your consent at any time via the "Cookie settings" link in the footer of every page. Your choice is remembered for 6 months, after which we ask again.

You can also manage or delete cookies in your browser settings (Chrome, Firefox, Safari, Edge, Opera). Blocking cookies entirely makes signing in and using some platform features impossible.

Some pages load resources hosted by other companies. When they load, that service receives your IP address and browser information, even if you never interact with it:

The site's fonts are hosted on our own servers, so displaying pages sends no data to Google Fonts or other font providers.

These services are operated by independent companies that process data under their own privacy policies. We do not control them and have no access to the data they collect. For YouTube we use privacy-enhanced mode (youtube-nocookie.com), which limits cookies until the clip is started.

The platform may also contain links to third-party sites. We recommend reading the policy of every site you reach from chirii.md.

chirii.md services are intended for people aged 18 and over. We do not knowingly collect data from minors. If you learn that a minor has given us personal data, write to chirii.md@gmail.com and we will delete it.

When you create an account — including through Google, Facebook or Apple — you accept the Terms, by which you confirm that you are at least 18 years old.

We may update this policy to reflect legal, technical or service changes. The current version is permanently published on this page, together with the date it was last updated.

If the changes are significant, we will notify you by email or through a notice in the platform and, where necessary, ask for your consent again.

For any question about the processing of your data, or to exercise your rights, you can contact us:

• Controller: SRL "CHIRII CONSULTING", IDNO 1015600039959
• Email: chirii.md@gmail.com
• Address: 49 Alexandru cel Bun St., MD-2011, Chișinău, Republic of Moldova

We have not appointed a data protection officer, as our activity involves neither large-scale systematic monitoring nor processing of special categories of data. Personal data requests are handled directly by the controller at the address above.

If you believe your rights have been infringed, you can contact the National Centre for Personal Data Protection of the Republic of Moldova (CNPDCP):

• Address: 48 Serghei Lazo St., MD-2004, Chișinău, Republic of Moldova
• Website: datepersonale.md

We do encourage you to contact us first — most of the time we can resolve the matter directly and quickly.