Privacy Policy

1. General information

This Policy applies to the grevkafi.org website and its Romanian, Russian and English versions.

In case of discrepancies between language versions of the Policy, the Romanian version prevails.

From August 23, 2026, personal data processing is carried out in accordance with Law of the Republic of Moldova No. 195/2024 on personal data protection (the “Law No. 195/2024”) and other applicable legislation.

2. Who processes personal data

The personal data controller is Asociația Obștească Centrul de Dezvoltare Umană „Etica Vie” (IDNO: 1016620003160), which manages Grev Kafi Museum (Muzeul Grev Kafi). In this Policy, “the museum” and “we” mean the controller.

The museum address is Str. Alexandru cel Bun 115C, Chișinău, Republic of Moldova.

For questions about personal data processing and protection, write to info@grevkafi.org or call +373 22 291 688.

3. What data we may receive

When a visitor submits the contact form, they provide their name, a contact for the reply and the message text.

Providing data through the form is voluntary. If the visitor does not provide a contact for the reply, the museum may not be able to respond to the request.

Please do not include extra personal, confidential or sensitive data in the message if it is not needed to process the request.

Through the form we may receive:

• name;
• email or phone number;
• request subject;
• preferred communication language;
• message content;
• other information that the visitor provides in the request.

4. Technical data

When the website is visited, technical services required for website operation and protection may automatically process certain technical data.

• IP address;
• browser and device type;
• browser language;
• date and time of the website request;
• requested page;
• technical data required for website operation and security.

5. Why data is used

Personal data is used only for clear and limited purposes related to the operation of the website and the museum.

• answering questions and requests;
• contacting the visitor at their request;
• organizing individual or group tours;
• processing requests related to museum events;
• ensuring website operation and security;
• saving the selected language and display theme;
• fulfilling requirements of applicable legislation.

6. Grounds for processing

We process data only when there is a legal ground provided by Article 6(1) of Law No. 195/2024:

• responding to requests, contacting the visitor, organizing tours and processing requests about events — actions at the visitor’s request, including before entering into a contract (point b)); for requests outside a contract — the museum’s legitimate interest in communicating with visitors (point f));
• ensuring website operation and security, including processing technical data — the museum’s legitimate interest in stable and protected website operation and preventing abuse (point f));
• saving the selected language and display theme — legitimate interest in convenient website operation according to the visitor’s choice (point f));
• fulfilling legal requirements — the museum’s legal obligation (point c));
• newsletters and other optional messages — only separate consent of the visitor, which can be withdrawn at any time (point a)).

Where processing is based on legitimate interest, the visitor has the right to object to it (see section 11).

7. Cookies and saved settings

The website may save the selected language and display theme in the visitor's browser. This is necessary so that, on the next visit, the website opens with the previously selected settings.

On the first visit, the suitable language version of the website may be determined automatically based on the browser language.

These data are used only for the operation and convenience of the website and are not intended for advertising or visitor profiling.

Saved settings can be deleted through the browser settings.

The website does not use analytics, advertising or tracking cookies. Cloudflare may use technically necessary cookies to protect the website from automated requests. If tools requiring consent appear on the website, we will update this Policy and request consent before enabling them.

8. Third-party services

The website is hosted on Cloudflare Pages (Cloudflare, Inc., USA). Cloudflare may process technical data required for website delivery, operation and protection.

Contact form messages are sent to the museum email through Resend (Plus Five Five, Inc., USA). This service is used to deliver messages and send an automatic confirmation to the sender if they provided an email address.

Cloudflare and Resend act as processors authorized by the controller and process data only on the museum's instructions, under data processing agreements (Article 28 of Law No. 195/2024).

The website may contain links to Google Maps and social networks. Maps and social network widgets are not embedded in the website. After opening an external link, data processing is carried out by the relevant service according to its own rules.

9. Who may access data

Data may be accessible only to the extent necessary for the relevant purpose:

• museum employees or representatives who respond to the request;
• technical providers that ensure website operation and message delivery;
• public authorities only in cases provided by law.

Transfer of data outside the Republic of Moldova. Cloudflare and Resend are companies from the USA, therefore technical data and contact form messages may be processed outside the Republic of Moldova. Data is transferred only to the extent necessary for website operation, message delivery and service protection.

As of the effective date of this Policy, there is no decision of the National Center for Personal Data Protection on an adequate level of protection for the USA. Transfer is carried out only where there is a ground provided by Law No. 195/2024 and appropriate safeguards for international data transfer. Where applicable, the museum uses standard contractual clauses for data protection adopted by the European Commission in accordance with point c) of Article 46(2) of Law No. 195/2024.

Information about the safeguards used and, where applicable, a copy of the relevant standard contractual clauses can be obtained by request at info@grevkafi.org. The providers' data processing terms are available at: cloudflare.com/cloudflare-customer-dpa and resend.com/legal/dpa.

10. How long data is kept

Messages from the contact form and related correspondence are kept for no longer than 12 months after the last message. If a request is related to a tour, event or contract, the retention period is counted from their completion.

If longer storage is required by law or is necessary to protect the museum's legitimate interests (for example, until limitation periods expire), data may be stored for the relevant period.

Technical data is stored by providers (Cloudflare, Resend) for periods determined by the type of the relevant service, technical log or message and the provider's applicable retention rules, after which it is deleted or anonymized. Language and display theme settings are stored in the visitor's browser until the visitor deletes them.

When data is no longer needed, it may be deleted or anonymized.

11. Visitor rights

In accordance with Law No. 195/2024 and other applicable legislation, the visitor may request information about the processing of their data, access to the data, correction of inaccurate data, deletion of data, restriction of processing, withdrawal of consent, objection to processing, data portability or protection against an automated individual decision in cases provided by law.

Right to object. If processing is based on the museum's legitimate interest (for example, ensuring website operation and security), the visitor has the right to object to it at any time on grounds relating to their particular situation. In this case, we will stop processing unless we demonstrate legitimate grounds that override the visitor's interests, rights and freedoms.

The website does not use automated decisions that have legal effects for the visitor or otherwise significantly affect them.

To exercise their rights, a visitor may contact the museum at info@grevkafi.org. Requests are reviewed free of charge, except for clearly unfounded or excessive requests in cases provided by Law No. 195/2024.

We respond without undue delay and no later than one month from receiving the request. For complex or numerous requests, this period may be extended by two further months, and we will inform the visitor within the first month. If there are justified doubts about the applicant's identity, we may request additional information to confirm it.

If a visitor believes their rights have been violated, they may contact the museum, file a complaint with the National Center for Personal Data Protection of the Republic of Moldova (MD-2004, Chișinău, str. Serghei Lazo 48; +373 22 820 801; centru@datepersonale.md; www.datepersonale.md) or go to court.

12. Data security

We take reasonable technical and organizational measures to protect data against unauthorized access, unlawful use, alteration, loss, disclosure or destruction.

At the same time, transmission of information over the internet cannot be absolutely protected against all possible risks.

If a data security breach may create a risk to the rights and freedoms of visitors, the museum notifies the National Center for Personal Data Protection, and in case of high risk — the visitors themselves, in the manner provided by Articles 33 and 34 of Law No. 195/2024.

13. Changes to this Policy

This Policy may be updated when website functions, data processing methods, services used or legal requirements change.

The current version is published on this page. The date of the latest update is indicated at the beginning of the Policy.

14. Contact

For questions about personal data processing and protection, contact Grev Kafi Museum (operator — Asociația Obștească Centrul de Dezvoltare Umană „Etica Vie”).

Address — Str. Alexandru cel Bun 115C, Chișinău, Republic of Moldova.

Email — info@grevkafi.org.

Phone — +373 22 291 688.