POLICY ON THE PROCESSING OF PERSONAL DATA

GHS-COM S.R.L.

Last updated: August 23, 2026

 

1. The Personal Data Controller

This Policy describes how GHS-COM S.R.L. (hereinafter – the "Company" or "GHS-COM"), acting as a data controller, processes the personal data of individuals who use the Company's website, online store, loyalty program, or other services, as well as the personal data of representatives, contact persons, and end-users of corporate clients or partners.

The Company processes personal data in accordance with Law no. 195/2024 on personal data protection, as well as other applicable normative acts in the Republic of Moldova.

Controller’s identification data: GHS-COM S.R.L., IDNO: 1002600034424, Chișinău municipality, 6 Dmitrie Cantemir Blvd.

For questions regarding the processing of personal data or to exercise their rights, data subjects may contact us via: e-mail: info@pumamoldova.md; phone: +37376003800; postal address: Chișinău, 6 Dmitrie Cantemir Blvd.

 

2. Categories of Processed Personal Data

Depending on the services used and the data subject's relationship with GHS-COM, the Company may process the following categories of data:

 

• Identification and contact data: first name, last name, phone number, e-mail address, delivery address, city, and other necessary contact details;
• Order and purchase data: placed orders, purchased products, order value and history, delivery method, order status;
• Payment and transaction data: payment method and status, transaction identifiers, and data necessary for refunds. Full bank card details are processed by payment service providers, provided GHS-COM does not collect and store them directly;
• Returns, exchanges, warranties, and complaints data: information necessary for resolving requests, confirming purchases, and exercising consumer rights;
• Customer account and loyalty program data: account details, activity history, points/discounts, granted benefits, user preferences, and settings;
• Customer communication data: content of requests, complaints, reviews, and correspondence via phone, e-mail, online forms, or other channels. Recording of phone calls is only carried out if it is actively used and the individual is informed in advance;
• Technical data and online identifiers: IP address, cookie identifiers, device information, browser, operating system, technical logs, and other information necessary for the functioning and security of the website;
• Marketing and service usage data: communication preferences, interaction with the website, viewed products, and other data used for campaigns and analysis, solely based on the applicable legal ground.

 

3. Data Concerning Children

GHS-COM does not intend to deliberately collect children's personal data for marketing purposes. In the case of information society services offered directly to a child, when the processing is based on consent, the special conditions provided by Law no. 195/2024 apply, including rules regarding the age of 14 and, where applicable, obtaining or authorizing consent by the holder of parental responsibility.

The Company collects only adequate and relevant data, limited to what is necessary in relation to the stated purposes.

 

4. Purposes and Legal Grounds for Processing

GHS-COM processes personal data only for specific, explicit, and legitimate purposes, complying with the principles of lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, integrity, and confidentiality.

 

Processing Purpose	Legal Ground
Creation and administration of the customer account; processing and execution of orders; product delivery; operational communications regarding the order	Performance of a contract and taking steps prior to entering into a contract
Processing payments, refunds, fiscal and accounting documents; fulfilling obligations to authorities	Performance of a contract and/or compliance with a legal obligation
Returns, exchanges, warranties, complaints, and customer support	Performance of a contract, compliance with a legal obligation and, where applicable, legitimate interest in establishing, exercising, or defending a legal claim
Administration of the loyalty program, points/discounts, and related benefits	Performance of the loyalty program's terms; separate commercial communications are based on the ground applicable to marketing
Sending commercial communications via e-mail and SMS	The data subject's valid consent, when required by law; the right to withdraw/unsubscribe can be exercised at any time
Traffic analysis, online marketing, non-essential cookies, and similar technologies	Consent, when required according to applicable legislation
Website and system security, prevention of fraud and incidents, protection of assets, and defense of the Company's rights	The legitimate interest of the Company, following an assessment of the balance between this interest and the rights of the data subject

Where processing is based on consent, it must be freely given, specific, informed, and unambiguous. The withdrawal of consent is possible at any time and does not affect the lawfulness of the processing carried out prior to the withdrawal.

 

5. Loyalty Program

Within the loyalty program, GHS-COM may process data necessary for identifying the member, tracking participation, granting benefits, administering points/discounts, and communicating information strictly related to the program's operation.

Participation in the loyalty program does not, in itself, imply consent to receive commercial communications. Marketing via e-mail, SMS, or other electronic means is carried out separately, based on the applicable legal ground and with an easy opt-out mechanism provided.

 

6. Commercial Communications

If the data subject has provided valid consent, GHS-COM may send information regarding promotions, discounts, new products and collections, campaigns, contests, offers, loyalty program benefits, and other commercial information via e-mail, SMS, push notifications, or other electronic means.

Consent for e-mail and SMS marketing is collected separately from the acceptance of the terms of sale and does not constitute a condition for placing an order.

The data subject may unsubscribe at any time, free of charge. E-mail messages will include a functional unsubscribe mechanism, and SMS or other electronic communications will offer a simple way to opt out. Strictly operational communications regarding an order, delivery, return, or other contractual obligations are not considered marketing communications.

 

7. Data Recipients and Processors

GHS-COM may disclose personal data to third parties only to the extent necessary to achieve the stated purposes and in compliance with applicable legal requirements:

 

• Delivery and courier service providers, including FAN Courier, for the purpose of dispatching and delivering orders; typically, the first name, last name, phone number, delivery address, and data necessary for identifying the shipment are transmitted;
• Payment service providers, financial institutions, or payment processors;
• IT service providers, hosting, maintenance, security, and information system administration providers;
• Communication service providers for SMS, e-mail, or electronic notifications, to the extent they are actually used by GHS-COM;
• CRM solution providers and/or loyalty platforms, if used;
• Legal, accounting, audit service providers, or other professional consultants, to the extent necessary for the provision of services;
• Public authorities, courts, and other competent institutions, when disclosure is required by law or necessary for the defense of a right.

 

When a provider processes personal data on behalf of GHS-COM, the relationship with them will be governed by a contract or other appropriate legal act, establishing the subject matter, duration, nature, and purpose of the processing, the types of data, the categories of data subjects, the obligations of the parties, and the security requirements.

GHS-COM does not share customer data with third parties for their own marketing purposes, unless there is a distinct legal ground and the data subject has been properly informed.

 

8. International Data Transfers

If the use of certain technical services, platforms, hosting solutions, analytics, CRM, marketing, or communications involves transferring or accessing data from outside the Republic of Moldova, GHS-COM will carry out the transfer only on the basis of a mechanism permitted by Law no. 195/2024 and by applying appropriate safeguards.

Additional information regarding the recipients, destination countries, and applicable safeguards can be requested using the contact details provided in Section 1.

 

9. Retention Periods

Personal data are retained only for the period necessary to fulfill the purposes for which they were collected, taking into account legal obligations, statutes of limitation, the need to resolve complaints, and the defense of GHS-COM's rights.

 

• Data related to orders, contracts, and fiscal/accounting documents – for the periods stipulated by applicable accounting, tax, and archiving legislation;
• Customer account data – for the duration of the account's existence, and after its closure only to the extent that the retention of certain data is required by law or necessary for the defense of a right;
• Loyalty program data – for the duration of participation in the program and subsequently only for the period justified by legal obligations or the defense of rights;
• Data used for commercial communications – until the withdrawal of consent/unsubscription or until the expiration of the inactivity period established by internal rules; proof of the opt-out choice may be kept in a suppression list to prevent the resending of messages;
• Data regarding complaints, returns, exchanges, and customer communications – for the period necessary for resolution and, subsequently, for as long as necessary according to legal obligations or statutes of limitation.

 

The specific retention periods are established through GHS-COM's internal retention procedures. Upon expiration of the applicable term, the data is securely deleted, destroyed, or anonymized.

 

10. Rights of Data Subjects

Under the conditions of Law no. 195/2024 and to the extent applicable to the specific situation, the data subject may exercise the following rights:

 

• The right to be informed;
• The right of access to data;
• The right to rectification;
• The right to data erasure (right to be forgotten);
• The right to restriction of processing;
• The right to data portability;
• The right to object, including at any time to processing for direct marketing purposes;
• The right to withdraw consent, when processing is based on consent;
• Rights related to automated individual decision-making, if GHS-COM uses such processes;
• The right to lodge a complaint with the National Center for Personal Data Protection (NCPDP / CNPDCP) and the right to an effective judicial remedy.

 

Requests should be sent to the contact details indicated in Section 1. If there are reasonable doubts concerning the identity of the person making the request, GHS-COM may request additional information strictly necessary to verify their identity.

GHS-COM responds to requests without undue delay and within the time limits prescribed by Law no. 195/2024. If the law permits an extension of the deadline, the data subject will be informed within the initial timeframe, along with the reasons for the delay.

 

11. Cookies and Similar Technologies

The website may use cookies and similar technologies for functionality, security, analytics, and marketing. Strictly necessary cookies may be used without consent when the law permits this. Non-essential cookies, including those for analytics and marketing, are activated only under the conditions and legal grounds provided by applicable legislation.

Detailed information on the types of cookies, providers, duration, and user options is presented in the Cookie Policy and the preference management mechanism available on the website.

 

12. Data Security

GHS-COM applies technical and organizational measures appropriate to the risks associated with processing, in order to prevent unauthorized access, loss, destruction, alteration, disclosure, or any other form of data compromise.

Security measures are periodically reviewed and adapted based on the nature, scope, context, and purposes of processing, as well as the evolution of risks and technical solutions.

 

13. Policy Modifications

GHS-COM may update this Policy when legislation, internal processes, services, providers, or processing methods change. The updated version will be published on the website and will indicate the date of the last modification.

 

Date of last update: August 23, 2026.