Privacy policy

Version of: 9 September 2026

This policy explains what personal data AUTO-M collects on auto-m.md, why, on what legal basis, who receives it and how you can control it. It follows Law of the Republic of Moldova no. 195/2024 on the protection of personal data, in force since 23 August 2026, which transposes Regulation (EU) 2016/679 (GDPR) into Moldovan law.

1.Who processes your data

The data controller is the company trading as AUTO-M:

DENSOF AUTO-M S.R.L.
IDNO 1025600061289
str-la Burebista 15, of. 410, Chisinau, Republic of Moldova
Email: sales@auto-m.md
Phone: +373 79 934 907

For anything to do with personal data, including the rights listed below, write to sales@auto-m.md with the subject line “Personal data”. This is the single point of contact, and messages with that subject are handled separately from sales enquiries.

2.What we collect

We collect only what we need to answer your enquiry and to complete the purchase. Here is the full list, by source.

Enquiry form on the site: Name, phone, email, chosen messenger, message text, plus the lot number and the calculated total if you send the form from a vehicle page or from the calculator.
Account: First and last name, email, phone, city, interface language, and your password only as an irreversible hash. If you sign in with Google: your Google account identifier and verified email address.
Customs calculator and car finder quiz: Calculation inputs: make, model, year, engine size and fuel type, price. On their own they do not identify you and stay in your browser; they become personal data only if you submit an enquiry.
Completing a purchase: Documents you provide for buying, shipping and customs clearance: a copy of your ID card or passport, contracts, invoices, customs paperwork. Payment records: amount, currency, purpose, status.
Correspondence: Messages you send us by email, Telegram, WhatsApp or Viber, and internal notes about calls.
Automatically, when you visit the site: IP address, browser type, version and language, device type, pages viewed, referring source. Analytics cookie identifiers only after you consent.

We do not ask for special categories of data — health, religious or political beliefs, criminal record — or for biometric data (art. 9 and 10 of Law no. 195/2024). Please do not send them to us, either in the form or in a messenger.

3.Why we process it, and on what basis

Each purpose has its own legal basis under article 6 of Law no. 195/2024. We do not use the data for purposes that are not listed here.

Answering your enquiry, sourcing a vehicle, quoting the turnkey cost: Steps taken at your request before entering into a contract — art. 6(1)(b).
Performing the contract: bidding, purchase, shipping, customs clearance, registration: Performance of a contract to which you are a party — art. 6(1)(b).
Issuing invoices, keeping accounting and tax records, meeting customs requirements: Legal obligation of the controller — art. 6(1)(c).
Running your account: favourites, saved searches, history of quotes, enquiries and deals: Performance of a contract — art. 6(1)(b).
Traffic and usability analytics, building advertising audiences: Your consent — art. 6(1)(a). Withdrawn in one click; see the section on cookies.
Service security: protection against password attacks, spam and abuse, access logs: Our legitimate interest in protecting the service and its customers — art. 6(1)(f).
Handling complaints and defending our rights in a dispute: Our legitimate interest — art. 6(1)(f).

Name, phone and email in the enquiry form are required: without them we cannot contact you and the form is not accepted. Everything else — your message, the messenger, the calculation inputs — is optional, and leaving it out has no consequences.

4.Who receives the data

We do not sell personal data and we do not pass it on for anyone else to market to you. Access goes only to those without whom the service cannot be delivered:

our staff and our CRM system, to the extent needed to work on your enquiry;
US auctions and their brokers, and catalogue data providers, when we bid on the lot you selected;
VIN history report providers, if you order such a report;
carriers, freight forwarders, port agents, customs brokers and insurers, for shipping and clearance;
the Customs Service and other public authorities, where the law expressly requires it;
analytics providers: Google (Google Tag Manager and related services), Microsoft (Clarity), Yandex (Metrica and Yandex Audiences) — only after you consent to analytics cookies;
Telegram, WhatsApp (Meta) and Viber, if you choose that channel; those conversations are governed by those services;
Google, if you sign in to your account with a Google account;
hosting and infrastructure providers running the site and the databases.

With anyone processing data on our instructions we sign a processing agreement under article 28 of Law no. 195/2024: they act only on our instructions and must provide a comparable level of protection.

5.Transfers outside the Republic of Moldova

Importing a car is a cross-border service, so some data inevitably leaves the country. We name the destinations plainly:

United States — auctions and their brokers, VIN report providers, and Google and Microsoft as analytics providers;
European Union — carriers, freight forwarders and port agents along the shipping route;
Russian Federation — Yandex, as the provider of Metrica and Yandex Audiences.

The grounds for such transfers are set out in the cross-border transfer chapter of Law no. 195/2024: an adequacy decision of the National Center (art. 45), appropriate safeguards in the contracts with recipients (art. 46 and 47), or the derogations in art. 49 — in particular that the transfer is necessary to perform your contract, and your explicit consent.

Transfers to analytics providers happen solely on the basis of your consent. If you have not given it, or have withdrawn it, that transfer does not take place.

6.How long we keep it

An enquiry that did not lead to a contract: 12 months from the last contact.
The contract and its related documents: The term of the contract plus three years after it ends — the general limitation period.
Accounting, tax and customs documents: The periods set by the legislation of the Republic of Moldova for that type of document.
Your account: For as long as the account exists. After deletion the data leaves the live systems immediately and the backups within 90 days.
Email and messenger correspondence: 24 months.
Analytics cookies: The lifetime of each individual file — from a single session up to 24 months.

Once a period expires the data is deleted or anonymised, meaning it can no longer be traced back to you and is used only as anonymous statistics.

7.Your rights

Articles 13 to 22 of Law no. 195/2024 give you the right:

to know what data of yours we process, and to receive a copy of it;
to have inaccurate data corrected and incomplete data completed;
to have data erased once there is no longer a basis for keeping it;
to restrict processing while we check your objection or the accuracy of the data;
to receive the data you provided in a machine-readable format and pass it to another controller;
to object to processing based on our legitimate interest;
to withdraw consent at any time, which does not affect the lawfulness of processing carried out before the withdrawal;
not to be subject to a decision based solely on automated processing that produces legal effects concerning you.

To exercise any of these rights, write to sales@auto-m.md. We reply within one month of receiving the request; if the request is complex the period may be extended, and we will tell you why. Making a request is free. If your message does not make clear who you are, we will ask you to confirm your identity, so that we do not hand your data to someone else.

8.Where to complain

If you believe we have breached your rights, write to us first — most questions are settled straight away. You are also entitled to go to the supervisory authority or to court:

National Center for Personal Data Protection (CNPDCP)
MD-2004, Chisinau, str. Serghei Lazo 48
Phone: (022) 820 801
Email: centru@datepersonale.md
Website: datepersonale.md

9.Cookies and browser storage

The site itself sets no cookies at all. What it saves stays in your browser storage and is not sent to us with page requests:

cookie-consent — your decision on the consent banner;
auto-m-theme — the light or dark theme you chose;
token and user — your account session, if you are signed in; they go when you sign out;
catalogue filters — so you come back to the same list after opening a lot page and returning; cleared when the tab closes.

Actual cookies appear only after you press “Accept”: they are set by Google Tag Manager, Microsoft Clarity, Yandex Metrica and the Yandex Audiences pixel, each under its own rules. Before that their scripts are not loaded into the page at all. Session recording (webvisor) and click maps in Metrica are switched off.

You can change your mind at any time: the “Cookie settings” link in the site footer reopens the banner. If you choose “Decline”, the page reloads so that any tools already running stop for the current session. Cookies and the stored site data can also be deleted from your browser.

10.How we protect the data

The measures required by article 32 of Law no. 195/2024 look like this here:

all site traffic runs over HTTPS only;
passwords are stored solely as an irreversible hash — we do not know them and cannot recover them;
staff access is separated by role and granted on a need-to-know basis;
actions in the administrative area are written to an audit log;
servers and databases are backed up, and access to them is restricted.

If a security incident occurs that could harm you, we will notify the National Center and you, in the manner set out in articles 33 and 34 of Law no. 195/2024.

11.Automated decisions

We do not take decisions about you solely by automated means, without human involvement. The lot condition score you see in the catalogue describes the vehicle, not a person, and has no bearing on your rights or on the terms we offer you.

12.Minors

The service is for adults: a car import contract is signed by a person with full legal capacity. We do not knowingly collect data about children. If you believe a child has given us their data, write to sales@auto-m.md and we will delete it.

13.Changes to this policy

If the policy changes we will update the version date at the top of the page, and announce material changes on the site. The version in force is always at this address.