Privacy Policy

Fidelir S.R.L. (“we”, “us”), IDNO 1026023126883, Chișinău, Republic of Moldova, is the controller for personal data processed across the company: the public websites, client engagements, CSIRT and network operations, and the Fidelir Trust Services programme. This policy applies to Fidelir S.R.L. as a whole, not only to trust-service activities.

This Privacy Policy describes how we process personal data. Our Independence, Privacy & Security Charter sets out operational principles for client engagements — including data minimisation, purpose limitation, no voluntary disclosure to third parties, and staff accountability. The Charter is published on this website and should be read together with this policy.

We may process identity and contact data (name, email, phone) when you write to us, and technical data required to operate and secure the website (for example IP address, browser type, and session identifiers where used for admin or security).

For client engagements, we process only the information strictly necessary to deliver the agreed service. Access to client systems and data is limited to engagement scope, retained only for the contractually defined period, and not used for any other purpose.

Trust-service subscribers are processed under the applicable engagement agreement and the published Certificate Policy and CPS. Public use of trust.fidelir.com is described on that site; disclosure of any personal data still follows this company policy.

We process data to respond to enquiries, operate and secure our systems, deliver contracted services, and meet legal obligations. Depending on the case, processing is based on legitimate interests, contract performance, consent, or a legal obligation. Lawfulness of processing by Fidelir S.R.L. is governed by Law no. 195/2024 on personal data protection of the Republic of Moldova (which transposes Regulation (EU) 2016/679).

We do not voluntarily provide governments, intelligence agencies, law enforcement, or other third parties with access to website enquiry data, client systems, or operational data. Any disclosure occurs only as described below. Where legally permitted, we will notify affected clients of official requests concerning their information or infrastructure.

We do not disclose personal data to a public authority as a matter of courtesy or expediency. A CERT notice, a general letter of competence, or an incident report is not, by itself, a legal basis for disclosure.

Fidelir S.R.L. discloses personal data to a public authority only where a legal obligation to do so is laid down in the legislation of the Republic of Moldova (Law no. 195/2024, Article 6(1)(c) and Article 6(3)), and only to the extent required by that obligation. Processing must also respect purpose limitation and data minimisation (Article 5). Processing by competent authorities for the prevention, investigation, detection or prosecution of criminal offences is regulated separately by Law no. 160/2026; that regime does not remove Fidelir’s duty to have a legal basis before disclosing.

A request that seeks personal data must be sent via Contact and must state:

• the requesting authority and the signatory with competence to issue the act;
• the legal basis (the law and the article) that creates Fidelir S.R.L.’s obligation to disclose;
• the type of procedural act, not only a general letter;
• the purpose;
• the categories of data, limited to what is necessary;
• the relevant period and a specific identifier.

Incomplete requests are returned for completion. We do not treat them as refused on the merits. Where legally permitted, we will challenge requests that are unlawful, overly broad, or inconsistent with purpose limitation, data minimisation, due process or proportionality, and we will notify affected clients where the law allows.

Technical incident coordination is handled by Fidelir CSIRT via Contact and does not include identification of a natural person unless a request meeting this section has been completed.

The National Centre for Personal Data Protection (CNPDCP) supervises Law no. 195/2024. Supervisory functions of other authorities over specific services do not replace the requirements in this section.

We do not use cookies on the public website. Details are in our Cookie Policy.

Enquiry-related correspondence is retained only as long as needed for the purpose of the enquiry and for applicable legal or security requirements. Engagement-related data is retained according to the contract and applicable law.

Data may be processed by infrastructure and service providers acting on our instructions (hosting, email, security). Processors act under contractual controls. Where data is transferred outside the EEA, we use appropriate safeguards required by law.

We apply privacy-by-design and least-privilege practices. Personnel access to client environments, where required, is limited to what is necessary for the task, for the shortest time required, and is logged. Background screening, confidentiality obligations and internal accountability measures apply as described in our Charter.

Subject to Law no. 195/2024, you may request access, rectification, erasure, restriction, portability, and objection to processing, and you may withdraw consent where processing is consent-based. You may also lodge a complaint with the National Centre for Personal Data Protection (CNPDCP).