TORECO S.R.L., registered in the Republic of Moldova, Chisinau Municipality, 1 Uzinelor Street (“TORECO”, “we”, “us”), hereby informs you about the processing of your personal data and your rights in accordance with Law No. 195 of 25 July 2024 on the Protection of Personal Data (“Law No. 195/2024”), effective as of 23 August 2026, as well as with other applicable legislation.

Considerăm asigurarea dreptului la protecția datelor cu caracter personal un angajament fundamental al TORECO S.R.L. Acest document este documentul-cadru al TORECO privind protecția datelor și se completează cu pagina Cookies and Similar Technologies page., care detaliază tehnologiile utilizate pe site, precum și cu regulamentele și procedurile interne ale companiei.

Table of Contents:

I. General Provisions

II. Principles of Personal Data Processing

III. Who we are and how you can contact us

IV. Purposes of Processing and Legal Bases

V. Categories of Personal Data Processed

VI. How We Collect Data

VII. Data Retention Period

VIII. Who we share your data with

IX. International Data Transfers

X. Data Processing Through the Website and Online Store

XI. Commercial Communications and Direct Marketing

XII. How We Protect the Security of Your Data

XIII. Your Rights

XIV. Security Incident Management

XV. Final Provisions

I. General Provisions

1.1. This document develops and specifies the legal requirements concerning the processing and security of personal data carried out by TORECO S.R.L. and is issued in accordance with the applicable legislation on personal data protection.

1.2. This document is public and is published on the official website www.toreco.md to inform data subjects about TORECO’s processing activities, their purposes and the security measures applied.

1.3. The terms “personal data”, “processing”, “data subject”, “controller”, “processor”, “consent”, “recipient” and “personal data breach” used in this document have the meanings set out in Article 4 of Law No. 195/2024.

1.4. As of 23 August 2026, Law No. 195/2024 replaces Law No. 133/2011 on the Protection of Personal Data.

II. Principles of Personal Data Processing

Personal data processed by TORECO S.R.L. is handled in accordance with the principles established by Article 5 of Law No. 195/2024:

• lawfulness, fairness and transparency — we process data fairly, in accordance with the law, and clearly inform you about how we use it;
• purpose limitation — we collect data for specified, explicit and legitimate purposes and do not subsequently use it in a manner incompatible with those purposes;
• data minimisation — we collect only data that is adequate, relevant and limited to what is necessary for the intended purpose;
• accuracy — we ensure that data is accurate and up to date and promptly correct or delete inaccurate data;
• storage limitation — we do not retain data longer than necessary for the purpose of processing;
• integrity and confidentiality — we apply appropriate technical and organisational measures to protect data;
• accountability — we are responsible for complying with these principles and can demonstrate compliance at any time.

III. Who we are and how you can contact us

 TORECO S.R.L., a legal entity registered in the Republic of Moldova, Chisinau Municipality, 1 Uzinelor Street, IDNO 1013600034835, acts as the personal data controller when processing your personal data.

For any questions concerning the processing of personal data or to exercise your rights:

• E-mail: marketing@toreco.md
• Mail/courier: TORECO S.R.L., 1 Uzinelor Street, Ciocana sector, Chisinau Municipality - marked “For the attention of the Data Protection Officer”
• Telephone: (022) 829 629

IV. Purposes of Processing and Legal Bases

For each processing activity, TORECO establishes a specific purpose and legal basis in accordance with Article 6(1) of Law No. 195/2024:

• Order processing (receiving, validating, invoicing, delivering, returning and refunding orders) — legal basis: Article 6(1)(b), performance of a contract or taking pre-contractual steps at your request.
• Customer support (handling questions, complaints and requests concerning orders or products) - legal basis: Article 6(1)(b), and, for general enquiries, TORECO’s legitimate interest under Article 6(1)(f).
• Compliance with tax, accounting, reporting and archiving obligations — legal basis: Article 6(1)(c), legal obligation.
• Management of relationships with commercial partners/dealers (B2B) — legal basis: Article 6(1)(b) and, where applicable, Article 6(1)(f).
• Improvement of products/services, satisfaction surveys and analysis of purchasing behaviour — legal basis: Article 6(1)(f), TORECO’s legitimate interest.
• Protection of the website against cyberattacks and fraud prevention — legal basis: Article 6(1)(f).
• Establishment, exercise or defence of legal claims (litigation, debt recovery) — legal basis: Article 6(1)(f).
• Direct marketing (newsletters, offers and promotions by e-mail/SMS/telephone) — legal basis: Article 6(1)(a), your consent.
• Marketing profiling (personalised recommendations based on browsing/purchasing behaviour) — legal basis: Article 6(1)(a), consent.
• Analytics and marketing cookies (non-essential) — legal basis: Article 6(1)(a), consent (see the “Cookies and Similar Technologies” page).
• Analytical and marketing cookies (non-essential) — legal basis: Art. 6 para. (1) lit. a), user consent (see the “Cookies and Similar Technologies” page). Cookies and Similar Technologies page.).

Where processing is based on TORECO’s legitimate interest, we ensure that such interest does not override your fundamental rights and freedoms. You have the right to object to such processing on grounds relating to your particular situation (see Section XIII).

V. Categories of Personal Data Processed

Depending on your relationship with TORECO (customer, prospective customer, website visitor, representative of a partner/dealer or job applicant), we may process, as applicable:

• identification data: first name, surname, name of the company you represent and position;
• contact data: e-mail address, telephone number, delivery and/or billing address;
• order data: products ordered/viewed, order value, payment and delivery method, order history;
• financial/billing data: billing information, IDNO (for legal entities); we do not store full bank card details, as online payments are processed by an authorised payment service provider;
• account data: username and authentication data (passwords are stored cryptographically and not in plain text);
• technical data and online identifiers: IP address, browser and device type, pages visited — collected through cookies and similar technologies, as detailed on the dedicated page;
• communication data: contents of messages submitted through the contact form, e-mail or telephone.

TORECO does not collect special categories of personal data (racial/ethnic origin, political opinions, religious beliefs, health data, sexual orientation, biometric or genetic data), as defined in Article 9 of Law No. 195/2024, except where expressly permitted by law.

Minors: The TORECO website and services are not intended for minors. Under Article 8 of Law No. 195/2024, processing a minor’s data based on consent is lawful only where the minor is at least 14 years old; below this age, consent from a legal representative is required. If we become aware that we have collected data relating to a minor under 14 without such consent, we will delete it without undue delay.

VI. How We Collect Data

We generally collect your data directly from you — when you place an order, create an account, complete a contact form or contact us by telephone/e-mail. For publicly available information concerning legal entities (partners/dealers), we may also consult public sources, such as official registers or company search engines in the Republic of Moldova (e.g. idno.md).

VII. Data Retention Period

We retain personal data only for as long as necessary for the purpose for which it was collected:

• order and billing data: for the period required by applicable tax and accounting legislation;
• user account data: for the duration of the account; upon your request for deletion or after an extended period of inactivity, the account may be deleted or anonymised, except for data that must be retained by law;
• marketing/newsletter data: until consent is withdrawn or you unsubscribe;
• contact form/correspondence data: until the request has been resolved and for as long as necessary to demonstrate its resolution;
• data relating to litigation or debt recovery: for the duration of the proceedings and until the applicable limitation/enforcement periods expire.

After these periods expire, the data is deleted, securely destroyed or anonymised.

VIII. Who we share your data with

We transfer or provide access to your personal data only where there is an appropriate legal basis and only to the extent necessary, including to:

• courier/delivery service providers, for shipment of orders;
• payment service providers, for processing online payments;
• IT service providers (hosting, website maintenance, e-mail marketing) acting as processors under contracts requiring confidentiality and security obligations in accordance with Article 28 of Law No. 195/2024;
• outsourced accountants/auditors, subject to confidentiality obligations;
• competent public authorities, where required by law.

We do not sell or provide your data to third parties for their own marketing purposes.

IX. International Data Transfers

Your data is primarily processed within the territory of the Republic of Moldova. Where certain services used by TORECO (for example, hosting, cloud services or e-mail marketing platforms) involve transferring or accessing data outside the Republic of Moldova, TORECO ensures that such transfer takes place only:

• to countries/organisations for which an adequacy decision exists;
• on the basis of appropriate safeguards (e.g. standard contractual clauses); or
• under one of the derogations expressly provided by Law No. 195/2024 (e.g. your explicit consent or the necessity to perform a contract).

You may contact us at any time for additional information regarding such transfers, including a copy of the safeguards applied.

X. Data Processing Through the Website and Online Store

10.1. Website forms. Through www.toreco.md , we collect data directly provided by you through forms (customer account, order, contact form and newsletter subscription). The requested data is limited to what is necessary for the relevant purpose, and mandatory fields are appropriately marked.

10.2. Placing orders. To process an order, we request your name, contact details, delivery/billing address and information about the products ordered. This data is necessary for entering into and performing the contract (Article 6(1)(b)).

10.3. Customer account. Creating an account involves processing the identification and contact data necessary for its operation. Passwords are protected using cryptographic mechanisms and are not stored in readable form.

10.4. Newsletter/commercial communications. Subscription is optional and involves processing your e-mail address (and, where applicable, other contact details voluntarily provided) solely on the basis of your consent (see Section XI).

10.5. Acceptance of order terms does not constitute consent to marketing. You may place an order without being required to subscribe to the newsletter or accept non-essential cookies — these options are presented separately.

10.6. Automatically collected data. When accessing the website, the IP address, browser and device type, pages accessed and date/time of access may be collected automatically to the extent necessary for website operation and security. Full details regarding cookies and similar technologies used — including any analytics tools (e.g. Google Analytics) or marketing tools (e.g. Meta Pixel) — as well as your consent preferences, are provided on the “Cookies and Similar Technologies” page.

10.7. Automated decision-making. TORECO does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Any product recommendations displayed based on browsing history do not produce such effects and may be disabled by withdrawing consent to marketing cookies.

XI. Commercial Communications and Direct Marketing

11.1. TORECO sends newsletters, offers and promotional materials by e-mail, SMS or telephone only on the basis of your prior consent, expressed through a clear and unambiguous action (e.g. ticking an unchecked box), presented separately from completing an order or accepting the website’s terms and conditions.

11.2. Consent may be withdrawn at any time as easily as it was given: through the unsubscribe link included in each message, through your account (where this option is available), or by contacting us directly using the contact details provided in Section III.

11.3. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal and does not affect orders already placed or your customer account.

11.4. Regardless of the consent provided, you have the right to object at any time, without providing justification, to the processing of your data for direct marketing purposes (Article 21 of Law No. 195/2024).

11.5. Messages strictly necessary for fulfilling an order (order confirmation, delivery, billing or complaint-resolution information) are not considered commercial communications and are not conditional upon consent to marketing.

XII. How We Protect the Security of Your Data

We apply technical and organisational measures appropriate to the level of risk, including:

• access controls for systems containing personal data, based on individual accounts;
• encryption of sensitive data transmissions (e.g. during online payment);
• contractual confidentiality and security obligations imposed on suppliers and partners processing data on behalf of TORECO;
• regular employee training on personal data protection.

Online payments are processed through authorised payment service providers. TORECO does not request or store full bank card details or card security codes.

XIII. Your Rights

Under Chapter III of Law No. 195/2024, you have the following rights:

• Right to be informed about the processing of your personal data (Articles 12–14).
• Right of access (Article 15) — you may request confirmation as to whether your data is being processed and obtain a copy.
• Right to rectification (Article 16) — you may request correction of inaccurate data or completion of incomplete data.
• Right to erasure (“right to be forgotten”) (Article 17) — you may request deletion of your data, except where retention is required by law or necessary for the establishment, exercise or defence of legal claims.
• Right to restriction of processing (Article 18), where provided by law.
• Right to data portability (Article 20), where processing is based on consent or contract and is carried out by automated means.
• Right to object (Article 21), including the unconditional right to object to direct marketing.
• Right not to be subject to a decision based solely on automated processing (Article 22).
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint with the CNPDCP (48 Serghei Lazo Street, Chisinau Municipality; e-mail: centru@datepersonale.md; www.datepersonale.md) or to bring proceedings before the competent court.

 How to exercise your rights: you may contact us using the details provided in Section III by submitting a request containing your name, contact details for receiving a response and a description of your request. We will respond within one month of receiving your request. This period may be extended by up to two additional months depending on the complexity of the request, with prior notification. If we have reasonable doubts concerning the identity of the requester, we may request additional information to verify their identity.

XIV. Security Incident Management

In the event of a personal data breach, TORECO S.R.L. will notify the CNPDCP without undue delay and, where possible, within 72 hours of becoming aware of the incident, unless the breach is unlikely to result in a risk to your rights and freedoms. Where the risk is high, you will be informed directly, without undue delay, about the nature of the incident and the measures taken.

XV. Final Provisions

15.1. This document is reviewed periodically and whenever relevant legislative or operational changes occur. Material changes will be brought to your attention through a prominent notice on the website.

15.2. This document is supplemented by the “Cookies and Similar Technologies” page and TORECO S.R.L.’s internal policies/procedures.

15.3. This notice does not constitute legal advice. For specific circumstances, we recommend consulting an appropriate legal professional.