Privacy policy

Last updated: 2026-10-17 · Version 2026-10-17

This policy explains how [to be completed] processes the personal data of visitors and customers of the Art House website, in line with the personal-data legislation of the Republic of Moldova (Law No. 133/2011 and the acts amending or replacing it) and the principles of the EU General Data Protection Regulation 2016/679 (GDPR).

1. Data controller

[to be completed], IDNO [to be completed], address: [to be completed]. Phone: [to be completed]. Data-protection contact: [to be completed].

2. Data we process

  • Order data: full name, phone number, email, city and delivery address (if delivery is chosen), comment.
  • Images you upload for custom canvases. Before storing, we remove photo metadata (including GPS location) without changing image quality.
  • Consent records: date, time and version of the accepted documents.
  • Visit statistics: pages viewed, time on page, referral source, device type, language. IP addresses are not stored. Without your consent statistics are fully anonymous — no identifier is stored on your device.
  • Your cart is stored only in your browser (localStorage) and is not sent to us until you place an order.

3. Purposes and legal bases

  • Fulfilling your order and contacting you — performance of a contract.
  • Accounting and tax records — legal obligation.
  • Website security, abuse prevention, anonymous statistics — legitimate interest.
  • Detailed visit statistics — your consent, which you can withdraw at any time ("Privacy settings" at the bottom of the page).

4. Recipients

  • Courier — only the data needed for delivery.
  • Hosting provider (processor under contract).
  • Internal order notifications via Telegram — by default without customer personal data.
  • Public authorities — only upon a lawful request.
  • We never sell your data or use it for advertising.

5. Retention

  • Uploaded images not included in an order — deleted automatically after 7 days.
  • Image files of completed orders — deleted 365 days after the order is completed.
  • Order records — for the period required by accounting and tax law.
  • Visit statistics — at most 25 months.

6. Your rights

You have the right to access, rectify and erase your data, restrict or object to processing, data portability and to withdraw consent. Write to [to be completed]; we will reply within the legal deadline. You may also complain to the National Center for Personal Data Protection (CNPDCP), datepersonale.md, or to the courts.

7. Security

HTTPS encryption; order data is accessible only to authorised staff via a password-protected panel; photos are kept in private storage; access is logged; regular backups.

8. Cookies and local storage

The public website uses no cookies. Your browser stores your cart (strictly necessary) and, only with your consent, an anonymous statistics identifier. The admin panel uses a single technical cookie for staff only.

9. Minors

Orders may only be placed by persons aged 18 or over. We do not knowingly collect children's data.

10. Changes

We may update this policy; the current version and date are always shown on this page.