Privacy

Who controls the data

The controller is Cisurt Planning S.R.L., a company established in the Republic of Moldova. The studio is at Strada București 41, oficiul 3, MD-2012 Chișinău. Telephone +373 22 917 648. Email [email protected]. The site is https://businesscisurtcust.cc. The IDNO is printed on the factură fiscală and on the engagement letter. We have not appointed a data protection officer. The studio is two planners, and requests about personal data go to the same address and the same email.

When an engagement letter says that we handle personal data only on your instructions, for example payroll lines inside a workbook that identify a named employee, we act on those instructions for that material and we remain controller for your own contact details, the contract, and the invoice.

The law that applies

Processing is governed by Law no. 195 of 25 July 2024 on the protection of personal data (Legea nr. 195/2024 privind protecția datelor cu caracter personal), published in the Monitorul Oficial of the Republic of Moldova, no. 367–369 of 23 August 2024, article 574, and in force since 23 August 2026. That law replaced Law no. 133/2011. The text in force is available through the official record at e-lex.md.

Supervision belongs to the Centrul Național pentru Protecția Datelor cu Caracter Personal, whose seat is in mun. Chișinău. The Centre’s public site is datepersonale.md. A complaint may be lodged with the Centre, and you may also go to the competent courts of mun. Chișinău, under the conditions of the law.

We follow the principles in article 5 of Law 195/2024: data are processed lawfully, fairly, and transparently; collected for specified purposes; limited to what the work needs; kept accurate; stored no longer than this notice describes; and protected against unauthorised use. We are able to demonstrate those steps for an engagement if the Centre asks.

What we actually hold

This website does not keep an account, a basket, or a list you can join. The contact form does not post your brief to a server of ours. It opens a message in the mail program on your machine, addressed to [email protected]. Until you send that message, we have nothing.

When you do send a brief, we receive whatever you put in it: typically your name, email address, telephone number, city, company, the decision you need the plan to support, a meeting date, and any files you attach. Those files often contain figures about a business. They become personal data where they identify a person, for example a sole proprietor, a home address used as a registered office, a wage tied to a named employee, or a copy of an identity document if you choose to send one. Please do not send identity documents unless we have asked for a specific page and said why.

During an engagement we also keep the engagement letter, our working notes, the workbook, the document, the deck, email about the drafts, and the factură fiscală. If you come to the hall on Strada București, the appointment is a date and a name in our diary, not a recording. We do not record calls as a matter of course. If a call ever needs to be recorded, we will say so at the start and we will not keep the recording with the client files beyond the job.

On the website itself, the only data stored in the browser are the two cookies described in the cookie notice, and only after you save a choice on that page. Until then the site sets nothing. We do not run a separate analytics service, and the page count, if you turn it on, stays in your browser. See the cookie notice for the names, the durations, and how to switch the count off.

Why we use it, and the legal basis

Article 6 of Law 195/2024 is the list we work from.

We reply to a brief, and we prepare an engagement, because you asked us to take steps before a contract. That is article 6(1)(b). We perform the engagement, send the files, and invoice, on the same basis once the letter is accepted.

We keep accounting records, including the factură fiscală, because the Fiscal Code of the Republic of Moldova requires it. That is article 6(1)(c).

We keep a brief that did not become a job, for a limited time, because we have a legitimate interest in answering a follow-up and in showing what was offered if a fee is later disputed. That is article 6(1)(f). You can object. If you object before we have a legal duty to keep the mail, we delete the brief.

The optional page-count cookie is used only if you choose it on the cookie page. That choice is consent under article 6(1)(a). You can withdraw it there at any time, and withdrawal does not affect a count that was never sent anywhere, because the count is not transmitted.

We do not use personal data to make a decision about you by automated means, and we do not build a profile of visitors. Article 22 does not come into play in the way this studio works. The business plan we write is about your company, for a meeting you named. It is not a score we assign to you as a person.

Who else sees it

The two planners in the hall see the files, because they do the work. An accountant in Chișinău sees the client name, the fee, and the description that has to appear on the factură fiscală. The accountant does not receive the workbook unless a line on the invoice cannot be explained without it, which is rare, and then only the page that explains the line.

Your own email provider, and ours, process the messages in order to deliver them. That is a necessary part of corresponding. We do not pass client files to a marketing list, a directory, or a buyer of contacts. We do not sell personal data. If a lawyer, a valuer, or an auditor needs to see material, that happens only when you ask, or when the engagement letter names them.

We may disclose data if a court in the Republic of Moldova, or another authority with a legal power to demand it, requires the disclosure. We will tell you if the law allows us to tell you.

The Centre may, in the exercise of its powers under Law 195/2024, require access to processing records. We keep a short internal note of the categories above so that a request from the Centre can be answered without opening every client workbook.

Where the files stay

Working files stay on machines in the studio at Strada București 41, Chișinău. We do not place client workbooks on a public shared drive for convenience. If you ask us to use a folder that you control, that environment is yours, and the reply will say so. Delivery is a mail with the PDF and the XLSX, or a handoff in the hall onto a drive you bring.

Law 195/2024, articles 44 to 49, covers transfers out of the Republic of Moldova. We do not send personal data to a processor established outside Moldova in order to host the site or to measure visits. When a client in the European Union writes to us, the message travels through ordinary email to Chișinău, and the finished files travel back to that client. Returning the work to the person who commissioned it is not a transfer we make for our own further use.

If a future engagement genuinely required a tool hosted outside Moldova, we would name it in the engagement letter before using it, and we would rely on a transfer ground in articles 45 to 49. We do not do that today.

How long we keep it

A brief that does not become an engagement is kept for up to three years from the last message, which matches the general limitation period for claims under the Civil Code of the Republic of Moldova (Codul civil nr. 1107/2002). You can ask us to delete it sooner if we have no duty to keep it.

Engagement letters, invoices, and the files needed to explain them are kept for as long as the Fiscal Code requires accounting records to be kept, and in any case until the limitation period for a claim about that invoice has expired. Working drafts that are not needed for the invoice or for a dispute are deleted within one year after the final files are sent, unless you ask us to keep a copy for a stated reason.

The cookie cisurt_choice and, if you enable it, cisurt_measure, expire after 180 days or when you clear them. Details are on the cookie page.

Your rights

Under Law 195/2024 you may ask us for the following, and we will answer within the time the law sets, which is generally one month, extended only where the law allows and where we tell you why.

• Access to the personal data we hold about you, and the information listed in article 15.
• Rectification of inaccurate data, and completion of incomplete data, under article 16.
• Erasure under article 17, where a ground for erasure applies and no exception requires us to keep the data.
• Restriction of processing under article 18, including while you contest accuracy.
• Notice of rectification, erasure, or restriction to recipients, where article 19 requires it and where that notice is not impossible or disproportionate.
• Portability of data you provided, where article 20 applies because the processing is based on contract or consent and is carried out by automated means. A workbook we designed is not, by itself, a portable copy of data you typed. Where article 20 does apply, we will give a structured, commonly used format.
• Objection, under article 21, to processing based on legitimate interests. We stop unless we show compelling grounds that override your interests, or the processing is for a legal claim.

To use any of these rights, write to [email protected] or call +373 22 917 648, or write to Strada București 41, oficiul 3, MD-2012 Chișinău. Say which right you are using and how we can identify the file. We may ask for enough detail to be sure we are writing to the right person. We do not charge for a request unless it is manifestly unfounded or excessive, in the sense article 12 allows.

You can lodge a complaint with the Centrul Național pentru Protecția Datelor cu Caracter Personal in Chișinău, including through datepersonale.md, and you can bring a claim before the competent court in mun. Chișinău. Using a right with us first is useful, and it is not a condition of complaining to the Centre.

If we suffer a breach of personal data that article 33 requires us to notify, we notify the Centre. Where article 34 requires notice to you, because the breach is likely to result in a high risk to your rights, we write to the email we hold for you.

Clients in the European Union

The studio is established in Chișinău and Law 195/2024 applies to processing in the context of that establishment, whether or not the processing takes place in Moldova. Where Regulation (EU) 2016/679 also applies because we offer planning work to a person in the Union, you may exercise the corresponding rights in that Regulation as well. A complaint may then also be made to a supervisory authority in your country.

Where article 27 of that Regulation requires a representative in the Union, the engagement letter will name the representative before the work that triggers the duty begins. We do not print a placeholder name here. Most of what we receive from an EU client is correspondence and company figures for a contract they asked for, handled from the Chișinău studio under the Moldovan law above.

Security, children, and changes

The hall is locked when we are not in it. Screens are locked when we leave the table. Client files are kept in folders named by engagement, not left in an open download directory on the website. The website itself is static. It does not have a database of briefs. Mail is the record.

We do not offer planning work to children, and we do not knowingly collect personal data of anyone under 18. If you believe we have received a child’s data, write to us and we will delete it unless a legal duty says otherwise.

If this notice changes, the new version will be dated at the top of this page. A change that affects an engagement already signed will also be sent to the email on that engagement, where the change touches the data of that client. The current version is 2 November 2026.

Questions about this notice: [email protected], +373 22 917 648, Cisurt Planning S.R.L., Strada București 41, oficiul 3, MD-2012 Chișinău, Republic of Moldova.