Privacy policy
Here you can find out what personal data “Demerzel” S.R.L., a limited liability company registered in the Republic of Moldova, processes through the website 3s.md and in its dealings with people who contact us or use the 3S platform, what we use it for, who we give it to, how long we keep it and what rights you have.
We follow Law No. 195/2024 on personal data protection of the Republic of Moldova, which transposes Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR). For people in the European Union we also apply the GDPR. The rights in Articles 15-22 are numbered the same way in both instruments.
This policy is for visitors to the website, people who write or call us, business contacts at the companies we approach, users of client accounts and people whose data appears in the documents uploaded by our clients (section 15).
1. Who processes the data
The controller of the data is “Demerzel” S.R.L., IDNO 1026023158396, with its registered office in Chișinău, Republic of Moldova; the full details appear in the Legal notice.
You can reach us at contact@3s.md, and on WhatsApp (messages and calls) at +373 60 055 599. Requests about personal data are sent to contact@3s.md.
For people in the European Union, our representative in the Union (GDPR, Article 27) has not yet been appointed. Until the appointment, data subjects and supervisory authorities can send their requests directly to us at contact@3s.md. Once appointed, the representative can be addressed by data subjects and supervisory authorities, in addition to us or instead of us, on all issues related to processing, and the representative's details will appear in this section.
The data you give us directly reaches us in the Republic of Moldova; what that means for people in the European Union is explained in section 6.
2. Data protection officer
We have not appointed a data protection officer. The law requires one only in the cases in Article 37(1) of Law No. 195/2024 and of the GDPR (public authorities, large-scale systematic monitoring, large-scale processing of special categories of data), and, as of the date of this page, we consider that none of these cases applies to us. We receive questions about data at contact@3s.md.
3. What data we process, why and on what basis
The table shows, for each situation, what data we process, why and on what legal basis (Law No. 195/2024, Article 6(1); GDPR, Article 6(1)).
| Situation | Data | Purpose | Basis |
|---|---|---|---|
| You visit the website | IP address, page requested, date and time, browser and operating system | we deliver the pages, troubleshoot and protect the website from abuse | legitimate interest (Article 6(1)(f)) |
| You make a choice in the cookie banner | a random device identifier, the time, the version of the text shown, the choice made, the button used, the page and the network prefix (not the full IP address) | we can prove what you chose | legal obligation to be able to demonstrate consent (Article 6(1)(c), read with Article 7(1)) |
| You accept statistics: measuring visits without cookies | the page address (with the parameters in the address), the page you came from, the page title, the language, the screen size, a few actions from a closed list (a click on a contact channel, a click on a button leading to contact, a change of language); the browser, system, device and approximate location, inferred from the browser data and the IP address, which is not stored | we find out which pages are read and improve them | consent (Article 6(1)(a)) |
| You write or call us (email or WhatsApp) | name, role and company, if you give them; email address; telephone number (on WhatsApp, also the profile name); the content of messages and attachments; date and time | we reply, assess the request and, if you ask for it, prepare an offer | legitimate interest in answering professional inquiries; pre-contractual steps taken at your request, when you ask for an offer (Article 6(1)(b)) |
| You are a contact at a company we approach | name, role, company, professional email address or telephone, the source of the data, the contact history and our notes | we build business relationships with companies | legitimate interest in keeping a record of a professional contact and in sending you a single first message to your professional email address (Article 6(1)(f); section 9); for other commercial messages, your consent (Article 6(1)(a); section 9) |
| You have a client account, opened by invitation, or you accept a 3S offer on behalf of your company | name, role, professional email address, role in the account, the authentication and security logs of the account; when the contract is concluded: the offer, together with the terms and the data processing agreement that accompanied it, in their dated version, the company's written acceptance, with the representative's declaration that they act on behalf of the company, with authority, and for purposes related to its professional activity, and our confirmation, each with its date and time, the company's name and IDNO (or foreign tax code), and the name, position and email address of the representative who accepted | we perform the contract; we can prove that the contract was concluded | performance of the contract (Article 6(1)(b)); for proof that the contract was concluded, legitimate interest (Article 6(1)(f)) |
| You used the client account of a company whose contract has ended | the account activity log (which user opened, downloaded, exported, cited or modified which document, and when) | the establishment, exercise or defense of legal claims, for at most 3 years from termination of the contract (section 7); for this retention, 3S is the controller (section 15) | legitimate interest (Article 6(1)(f)) |
| We conclude a contract and invoice | the company's name, contact person, address, tax code or VAT number, invoice and payment data | we invoice and keep the accounts | performance of the contract and legal obligations (Article 6(1)(b) and (c)) |
| You send us a notice or a request for review (see the Notice and action page) | name and email address; the content of the notice or request; for a formal notice, the data required by law (Law No. 284/2004, Article 17(4)); our correspondence with you | we assess the notice, decide, communicate the decision and can prove how we acted | legal obligation (Article 6(1)(c)): the mechanism and procedure in Regulation (EU) 2022/2065, Article 16, and in Law No. 284/2004, Article 17; for defense in disputes, legitimate interest (Article 6(1)(f)) |
We do not sell the data and do not use it for advertising on other platforms; our direct marketing is described in sections 9 and 10. We do not record telephone calls without your prior consent.
What we keep in your browser and how visit measurement works are described in the Cookie policy.
Sources of data about business contacts
The data comes from public sources (company websites, public registers, professional profiles on LinkedIn), from recommendations by third parties with your consent, or from events where you introduced yourself. The categories of data are those in the table. We inform you about the processing no later than in our first message to you (Law No. 195/2024, Article 14(3)(b)). If we do not contact you within one month of obtaining the data, we delete it.
4. Legitimate interests
We rely on legitimate interest for:
- the security and proper functioning of the website (server logs)
- replying to the professional inquiries we receive
- keeping records of professional contacts at companies, for business relationships, and a single first message to them (section 9)
- proving acceptance of the terms and of offers
- the establishment, exercise or defense of legal claims: keeping the account activity log after termination of the contract, for at most 3 years (section 7), and defense in disputes about notices and requests for review (section 3)
We have weighed these interests against your rights: we collect only the data in the table; we do not use it for advertising on other platforms, and the data in the server logs is not combined with other sources. You can object at any time (section 8; for direct marketing, section 10).
5. Who receives the data
We do not sell personal data and do not hand it to anyone for advertising. We disclose it to public authorities only when the law requires it. The following recipients receive it, to the extent necessary:
| Recipient | What it does for us | Country | What data it receives |
|---|---|---|---|
| A Romanian IT and analytics service provider, our processor | administers the website server, the contact records, the mailbox and the accounts through which the data passes | Romania | the data in section 3, to the extent necessary |
| A virtual server hosting provider | hosts the server on which the website runs | Germany | IP addresses and server logs |
| Cloudflare, Inc. | the DNS service of the domain 3s.md and forwarding of messages sent to contact@3s.md | United States | technical data of DNS queries; messages sent to contact@3s.md, with their headers |
| Google Ireland Limited or Google LLC | the 3S mailbox | Ireland; United States | messages received at contact@3s.md |
| WhatsApp Ireland Limited or WhatsApp LLC (Meta group) | messaging on the number +373 60 055 599 | Ireland; United States | your number, profile name, messages and files sent; WhatsApp also uses part of the data for its own purposes (WhatsApp Business App terms) |
| 3S's bank and accountant, after a contract is concluded | payments and accounting | Republic of Moldova | invoicing and payment data |
| The 3S client concerned by a notice | receives the notice, so that it can state its position | the country of the client's registered office | the formal notice, in full, with the notifier's data (Law No. 284/2004, Article 17(5)); from a simple notice, the notifier's identity only if strictly necessary |
6. Transfers outside the European Economic Area
Processing in the Republic of Moldova. The data you give us directly reaches us in the Republic of Moldova. On October 7, 2026, the Republic of Moldova was not among the countries for which the European Commission had adopted an adequacy decision (the Commission's list).
Servers in Germany and the provider in Romania. Data stored on servers in Germany and data processed by the provider in Romania stays in the European Economic Area; transfers to them are not restricted (Law No. 195/2024, Article 44(2)).
Providers in the United States (Cloudflare, Google, WhatsApp) process data in the United States. Commission Implementing Decision (EU) 2023/1795 recognizes an adequate level of protection for data transferred from the Union to United States organizations included in the EU-US Data Privacy Framework list. On October 7, 2026, the Framework's official list showed the participation of Google LLC and WhatsApp LLC with the status "Active", and that of Cloudflare, Inc. with the status "Active - Re-certification under Review". Each provider's safeguards:
- Cloudflare, Inc.: the standard contractual clauses adopted by Decision (EU) 2021/914 (modules 2 and 3) and participation in the EU-US Framework, under the provider's data processing agreement (clauses 6.2 and 6.4).
- Google: participation of Google LLC in the EU-US Framework and, where necessary, standard contractual clauses, according to Google's explanations.
- WhatsApp: participation of WhatsApp LLC in the EU-US Framework; the terms are in the WhatsApp Business App Terms.
People in the Republic of Moldova. Law No. 195/2024 allows transfer to states in the European Economic Area without special authorization (Article 44(2)). To other states it requires either a decision of the CNPDCP on the adequacy of the level of protection (Article 45) or appropriate safeguards, including the standard data protection clauses approved by the CNPDCP or adopted by the European Commission (Article 46(2)(c)). We are not aware of a CNPDCP decision concerning the United States. Cloudflare's data processing agreement applies the standard clauses only to data protected by the laws of the European Union, the European Economic Area, Switzerland and the United Kingdom, and Google also refers to standard clauses where required. For data protected only by Moldovan law, we determine the safeguard that applies to each provider and explain it at contact@3s.md.
Copy of the safeguards. The text of the standard clauses is public: Decision (EU) 2021/914. The providers' agreements are at the addresses above. You can also ask for a copy of the safeguards at contact@3s.md.
7. How long we keep the data
| Data | How long | Why |
|---|---|---|
| Server logs | at most 30 days | troubleshooting and security |
| Your choice in the cookie banner, in your browser | valid for 6 months, then we ask you again (or sooner, when the text of the information changes); it stays in your browser until you choose again or delete it yourself | we remember your choice without asking on every page |
| Record of your choice, on our server | 36 months from the choice | proof of consent; the general limitation period of 3 years (Civil Code of the Republic of Moldova, Article 391(1)) |
| Data from measurement without cookies | 13 months, then deletion | year-on-year comparison |
| Messages without an offer | 12 months from the last message, then deletion | we reply and resume a conversation |
| Messages that led to an offer | 36 months from the last message, then deletion | we can prove the content of the offer in a possible dispute (general limitation period: 3 years) |
| Business contacts, approached, no reply | 12 months from the first message, then deletion; if you object, we keep only the data strictly necessary to ensure we do not contact you again | record of business relationships |
| Business contacts, not yet approached | at most one month from obtaining the data; if we do not contact you, we delete it | you are informed within one month of the data being obtained (Article 14(3)(a)) |
| Client account and log of acceptance of the terms | for the term of the contract and 3 years after it ends | performance of the contract; proof of acceptance; general limitation period |
| Account activity log (which user opened, downloaded, exported, cited or modified which document, and when), after termination of the contract | at most 3 years from termination of the contract, then deletion | the establishment, exercise or defense of legal claims, with 3S as controller, on the basis of legitimate interest (Article 6(1)(f)); the general limitation period of 3 years (Civil Code of the Republic of Moldova, Article 391(1)) |
| Notices and requests for review, with the data in them | 3 years from the closing of the case, then deletion | we can prove how we acted; the general limitation period of 3 years (Civil Code of the Republic of Moldova, Article 391(1)) |
| Invoices and accounting documents | the periods set by the legislation of the Republic of Moldova | legal obligation |
| Data in clients' documents | according to the client's instructions and the data processing agreement | section 15 |
8. Your rights
You have the right of access to the data (Article 15), the right to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to be informed of the recipients to whom we have disclosed the data (Article 19), to data portability (Article 20), to object (Article 21) and not to be subject to a decision based solely on automated processing (Article 22). The numbering is the same in Law No. 195/2024 and in the GDPR.
Send requests to contact@3s.md. We reply without undue delay and within one month of receipt. For complex requests the period may be extended by two months; we tell you about the extension and its reasons within the first month (Law No. 195/2024, Article 12(3); GDPR, Article 12(3)). The reply is free of charge; if a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, giving reasons (Article 12(5)). If we have reasonable doubts about your identity, we ask for additional information (Article 12(6)). If we do not act on a request, we tell you why and that you can lodge a complaint and bring a court action (Article 12(4)).
9. Commercial messages and direct marketing
We may send you a single commercial message on our own initiative, to your professional email address, if your role at a company is relevant to the 3S service. The legal basis is our legitimate interest in building business relationships with companies (Law No. 195/2024 and the GDPR, Article 6(1)(f)). The message states where we obtained your contact details and how you can object (section 10). We do not send message sequences: if you do not reply, we do not write to you again on our own initiative.
We send you other commercial messages on our own initiative, by email, by messaging applications or by telephone, only with your prior consent (Law No. 284/2004, Article 22(1); Law No. 72/2025, Article 124(1) and (3)), except where the law allows otherwise: for example, to our customers, for similar services, if they are clearly given the chance to object easily and free of charge (Law No. 72/2025, Article 124(2)). Consent can be given in any form, including in writing, by an exchange of electronic messages or orally, and the burden of proving it is ours (Law No. 62/2022, Article 26(4)). You can withdraw it at any time by replying to the message or writing to contact@3s.md.
Conversations that you start - through the WhatsApp link or by email - are not unsolicited messages: we reply.
Every commercial message states clearly that it is a commercial communication and on whose behalf it is sent (Law No. 284/2004, Article 22(2)(a)-(b)), has a valid address at which you can ask us to stop sending (Law No. 72/2025, Article 124(4)) and points to this policy.
10. Your right to object to direct marketing
You have the right to object, at any time, to the processing of your data for direct marketing, including profiling to the extent that it is related to such marketing. After you object we no longer process the data for that purpose. You can object by writing to contact@3s.md or by replying directly to the message you received. We remind you of this right, separately from the rest of the information, no later than in our first message to you (Law No. 195/2024, Article 21(2)-(4); GDPR, Article 21(2)-(4)).
11. Withdrawing consent
If processing is based on your consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before it (Law No. 195/2024, Article 7(3); GDPR, Article 7(3)).
- For commercial messages: reply to the message or write to contact@3s.md.
- For statistics: the link "Cookie settings" in the footer of every page reopens the choice, and "Reject all" stops measurement immediately.
12. Complaint to a supervisory authority
If you consider that the processing of your data infringes the law, you can lodge a complaint:
- in the Republic of Moldova, with the National Center for Personal Data Protection (CNPDCP): str. Serghei Lazo 48, MD-2004, Chișinău; tel. (022) 820 801 (from abroad: +373 22 820 801); centru@datepersonale.md; datepersonale.md. The limitation period for the complaint is one year from the date on which you could have learned of the alleged infringement, but not later than 3 years from the infringement (Law No. 195/2024, Article 72);
- in the European Union, with the supervisory authority of the state where you live or work or where the alleged infringement took place (GDPR, Article 77(1)); you can find the list of authorities at the European Data Protection Board. In Romania, for example, the authority is ANSPDCP: dataprotection.ro, anspdcp@dataprotection.ro.
You can also apply to a court (Law No. 195/2024, Article 74).
13. Whether you must provide your data
You have no legal or contractual obligation to give us personal data through this website. Without the contact details in a message we cannot reply, and without the data needed for a client account we cannot perform the contract. Measuring visits is not a condition for using the website.
14. Automated decisions
We do not take decisions based solely on automated processing and we do not create profiles that produce legal effects concerning you or similarly affect you (Law No. 195/2024, Article 22; GDPR, Article 22).
15. Clients and their documents
If you are a client or a user of a client account:
- for the data of your account (section 3, row "You have a client account"), the controller is “Demerzel” S.R.L.;
- for the documents that your company uploads to the platform, the controller is the client and 3S is the processor: it processes them only on the client's documented instructions, under the Data Processing Agreement (Law No. 195/2024, Article 28; GDPR, Article 28). The providers that take part in this processing are on the Platform sub-processors page;
- for the account activity log, after termination of the client's contract, the controller is “Demerzel” S.R.L.: it keeps the log for at most 3 years from termination, solely for the establishment, exercise or defense of legal claims, on the basis of legitimate interest (Article 6(1)(f)), and then erases it (sections 3, 4 and 7).
If your data appears in the documents of a 3S client and you want to exercise your rights, contact the client. If you write to us, we pass the request on to the client.
If you consider that 3S does not comply with the standard contractual clauses that apply to the processing of documents of clients in the European Union, you can send a complaint to contact@3s.md; we deal with it without delay (Clause 11(a) of the Annex to Decision (EU) 2021/914).
The platform's artificial intelligence assistant is described on the Artificial intelligence in 3S services page.
16. Children
3S services are for professionals. We do not knowingly collect data about children.
17. Security
We apply technical and organizational measures appropriate to the risk (Law No. 195/2024, Article 32; GDPR, Article 32). The website is served over an encrypted connection (HTTPS).
The record of banner choices keeps only the network prefix. The full IP address of the request appears only in the server's access logs (sections 3 and 7).
18. Changes
The version in force is the one on this page, with the date of the update at the top.