Privacy Policy

1. Who is responsible for your data

S.R.L. IRIS-ARHPEISAJ, IDNO 1008600042733. Registered office: MD-2012, Republic of Moldova, Chișinău municipality, Rîșcani sector, 33 A. Pușkin str., ap./of. 1A. Contact: info@iris.md, +373 79 992 065. The registered office is distinct from the stores and nursery shown on the Contact page.

2. The data we use

We receive directly from you your name, telephone, optional e-mail, the products and quantities requested, the chosen store for pickup or the delivery address and the comments you enter. Avoid including in comments sensitive data or information about other people that is not necessary for the order.

Browsing involves the transmission of IP address, browser information and technical requests to the server. Cart, favorites and comparison are kept in the browser; the unsubmitted form is kept in the tab session. We do not collect card details through this site.

3. Purposes and Legal Basis

The management of requests, contacting you for availability, preparation and execution of the order are based on the steps required by you before concluding a contract and on the execution of the contract (art. 6 para. (1) letter b)). The name, telephone number and data required for collection or delivery are required for this purpose; without them we cannot process the request.

Accounting documents and responses to authorities' requests are processed based on legal obligations (letter c)). Protecting the site against abuse and defending certain rights can be based on legitimate interest (let. f)), with the assessment of the need and the impact on your rights.

We do not condition your order on consent to advertising. The current site has no subscription to marketing, advertising analysis or profiling. If we introduce optional consent-based processing, we will explain them separately and only activate them after consent; it can be withdrawn as easily as it was granted.

4. Who can receive the data

We use Kommo CRM to manage enquiries. We send the name, phone number, email if provided, ordered products and variants, quantities, prices, fulfilment method, address and comments entered in the form. Authorised staff can access this information to process the enquiry.

Order data is accessible to authorized personnel and IT providers who ensure the operation of the service. The current implementation uses Neon for the database and an admin panel with authenticated access. For a confirmed delivery, the carrier can only receive the data necessary for the delivery. Accountants and authorities can receive data when there is a legal basis. We do not sell personal data.

Hosting provider, database region, subcontractors and any international transfers must be confirmed prior to public release. Any transfer outside the Republic of Moldova requires verification of the conditions and guarantees provided by law. You can request information about recipients and applicable guarantees at info@iris.md.

5. How long we keep the data

The retention criteria are: the time required to resolve the request, the execution of the order, the applicable accounting obligations and the legal deadlines for complaints or the defense of a right. After the termination of these purposes, the data must be deleted or anonymized, including through the backup replacement cycle. The detailed internal retention schedule and deletion procedure must be validated prior to actual orders.

In the browser, the basket and lists remain until you remove them or clear the site data. The form draft is deleted upon successful submission or tab session termination. Details and duration of saving settings are in the Cookie Policy.

6. Your rights and how to exercise them

You can request access, rectification, deletion, restriction and, under the law, data portability. You can object to processing based on legitimate interest; for direct marketing, the right to object can be exercised at any time. When the basis is consent, the withdrawal does not affect the lawfulness of the previous processing.

Write to info@iris.md or to the registered office and describe the request. We may ask for proportionate information for identity verification; do not send copies of identity documents unless requested. We usually respond within a month at most. If the law allows an extension of up to two months due to the complexity or number of applications, we inform you in the first month and explain the reasons.

Rights are not absolute: for example, erasure may be limited by a legal retention obligation. We explain the reason for any limitation. You can file a complaint with the National Center for the Protection of Personal Data (CNPDCP), through datepersonale.md, and you can address the competent court.

7. Safety, children and external services

Administrative access is restricted. No transmission or storage can be guaranteed to be absolutely secure. If you notice a problem, contact us at info@iris.md. The site does not make decisions with exclusively automated legal effect and does not create advertising profiles.

The Site is not designed to intentionally collect data from children. If a child has submitted data without the involvement of the legal representative, contact us for verification and appropriate action. Links to Google Maps and social networks open external services, governed by their policies.

8. Policy Update

We post the changes on this page and ask for a new consent when a new purpose requires it. The version date does not replace notice of significant changes.