PERSONAL DATA PROTECTION POLICY

JSC “ALFA-NISTRU” | Soroca, Republic of Moldova

JSC “ALFA-NISTRU” is committed to protecting the confidentiality and security of your personal data. We fully comply with the applicable legislation, including Law No. 195/2024 on the Protection of Personal Data.

This Policy explains:

• What data we collect and why;
• How we protect your data;
• Your rights;
• How you can contact us.

IDENTIFICATION AND CONTACT DETAILS

Personal Data Controller:

Name: JSC “ALFA-NISTRU”
Registered office: 131 Ștefan cel Mare Street, MD-3005, Soroca, Republic of Moldova
IDNO: 1003607003132

Data Protection Officer (DPO):

Name: Marina Leșan
Email: marina.lesan@alfa-nistru.com
Telephone: +373 (230) 2-36-47

Identification Data

Full name, IDNP, identity document details, date and place of birth.

Contact Details

Residential address, email address, landline telephone number, mobile telephone number.

Professional Data

CV, cover letter, references, certificates and diplomas (for candidates).

Employment Data

Position, department, salary, bank details (for payments), social security contributions.

Operational Data

Working time records, access card data, GPS/vehicle route data, video images from monitored areas.

Legal and Contractual Data

Employment/service contracts, administrative acts, data contained in litigation files.

WHY WE COLLECT DATA

1. Administration of employment relationships and performance of contractual obligations.
2. Calculation of salaries, benefits, social security and tax contributions.
3. Recording working hours and access control.
4. Ensuring the safety of persons and protection of property.
5. Compliance with legal obligations (tax, employment, occupational health and safety requirements).
6. Investigation of incidents and risk management.
7. Protection of our rights in the event of disputes.
8. Communications concerning legal obligations and provision of relevant information.
9. Transport and logistics for employees and goods.
10. Provision of employee benefits (meal vouchers).

HOW DO WE PROTECT YOUR DATA?

Technical Measures

• Encryption of sensitive data in transit (HTTPS/SSL);
• Access control systems and secure authentication;
• Strong passwords and regular password changes;
• Backups and periodic testing;
• Logging and audit monitoring;
• Updated software and anti-malware protection;
• Secure deletion of data upon expiry of the applicable retention period.

Organizational Measures

• Clear privacy and data-use policies;
• Employee training on personal data protection;
• Data processing agreements with all relevant service providers;
• Incident management procedures;
• Periodic risk assessments;
• Access based on the “need-to-know” principle;
• Centralized register of processing activities.

HOW LONG DO WE RETAIN DATA?

Personnel files: For the duration of the employment contract + 7 years after termination (tax-related legal obligation).

CVs of unsuccessful candidates: 12 months from completion of the recruitment procedure.

Video surveillance footage: 30 days (or longer where the footage is relevant to an incident).

GPS/vehicle route data: 12 months.

Visitor register: 12 months.

IT logs and audit logs: 12 months.

Contractual documentation and invoices: Minimum 6 years (in accordance with tax legislation).

YOUR RIGHTS

• Right of access: You may request a copy of your personal data.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure: You may request deletion of your data where legally applicable.
• Right to restriction of processing: You may request restriction of processing for certain purposes.
• Right to data portability: You may obtain your data in a standard format.
• Right to object: You may object to processing in certain circumstances.
• Right to withdraw consent: You may withdraw your consent at any time without penalty.
• Right to lodge a complaint: You may lodge a complaint with the CNPDCP if your rights have been violated.

WITH WHOM DO WE SHARE YOUR DATA?

Internally

• Departments of JSC “ALFA-NISTRU” (HR, Accounting, Legal, IT, Transport, Security).

Externally

• Public authorities: National Office for Social Insurance (CNAS), National Health Insurance Company (CNAM), State Tax Service;
• Financial institutions and banks;
• Contractual service providers (under confidentiality agreements);
• Courts and law enforcement authorities.

SECURITY INCIDENTS

1. We investigate incidents immediately and take measures to contain and mitigate their consequences.
2. We assess the risks to your rights and freedoms.
3. We notify the CNPDCP where required by law, including where there is a high risk.
4. We inform you within the legally prescribed period and provide the relevant details.

HOW CAN YOU EXERCISE YOUR RIGHTS?

Email: marina.lesan@alfa-nistru.com or info@alfa-nistru.com

Telephone: +373 (230) 2-36-47

Postal address: JSC “ALFA-NISTRU”, 131 Ștefan cel Mare Street, MD-3005, Soroca, Republic of Moldova.

Response period: Requests are handled within 30 days. For complex requests, this period may be extended by an additional 60 days.

COMPLAINTS TO THE SUPERVISORY AUTHORITY

National Center for Personal Data Protection (CNPDCP)

Website: www.cnpdcp.md

Location: Chișinău, Republic of Moldova.

SPECIAL PROVISIONS

Video Surveillance

• Cameras are installed only in necessary areas and are clearly signposted;
• Cameras are NOT installed in changing rooms, restrooms or private areas;
• Access to video footage is restricted to authorized persons;
• Video footage is automatically deleted after 30 days, except where it is related to an incident.

GPS and Vehicle Monitoring

• Prior information is provided regarding the use of monitoring devices;
• Monitoring outside working hours is limited;
• Data is used for fleet management and security purposes;
• Data retention period: 12 months.

Sensitive Data

• Strict access controls and enhanced protection (medical data, etc.);
• Storage separately from other personnel files;
• Access limited to authorized persons only.

LEGAL BASIS

• Constitution of the Republic of Moldova;
• Law No. 133/2011 on the Protection of Personal Data (applicable until 23 August 2026);
• Law No. 195/2024 on the Protection of Personal Data (effective from 23 August 2026);
• Law No. 160/2026 (crime prevention);
• Regulation (EU) 2016/679 (GDPR);
• Directive 2002/58/EC;
• Labour Code and Civil Code of the Republic of Moldova;
• Tax, accounting, archival and occupational health and safety legislation.

COMPANY WEBSITE

www.alfa-nistru.com complies with personal data protection requirements:

• A complete and accessible Privacy Policy;
• HTTPS/SSL encryption for data transmission;
• Cookies used with explicit consent;
• GDPR-compliant contact forms and newsletter forms;
• Options for withdrawing consent.

 

Approved by Order of the General Director No. 66 dated 23 July 2026

Supplemented by Administrative Act dated 25 August 2026