Privacy Policy

The data controller is "GARM INC" SRL ("ITCore", "we"):

• Company ID (IDNO/c.f.): 1017600028014
• VAT number: 0308617
• Registered office: MD-2043, mun. Chișinău, bd. Traian 2, of. 135, Republic of Moldova
• Director: Coretchii Alexandr
• Website: https://itcore.md
• Data protection officer (DPO): dpo@itcore.md
• General email: info@itcore.md

We process personal data under Law of the Republic of Moldova No. 195/2024 on Personal Data Protection, which has applied since 23 August 2026 and brings the GDPR into Moldovan law. If you visit the site from the European Union, the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) also applies.

This policy applies to visitors to itcore.md, to people who send a request through the Contacts form and to people who email us.

It does not cover data we can access while managing clients' IT infrastructure: servers, email, staff accounts, accounting systems, CCTV. There the client remains the controller and we act on its behalf. That processing is governed by the contract with the client and by the Data Processing Agreement (DPA).

You fill it in yourself. The fields are:

The form cannot be sent without ticking the box to accept this policy. The request is stored on the website server and sent by email to info@itcore.md.

The form is protected by Cloudflare Turnstile, which checks that a person rather than a script is sending the request. To do this, Cloudflare receives technical details about your browser and connection: IP address, browser and device type, and technical request parameters. We neither see nor store these details; we only receive the outcome of the check.

The website runs through the Cloudflare network (DNS, CDN, traffic proxying) and is protected by our own web application firewall (WAF). Both keep request logs: IP address, time, page requested and browser type. We use these records to fend off attacks and investigate faults. We do not link them to any particular person.

If you click "Accept" in the cookie window, the site loads two analytics services.

Google Analytics 4 (through Google Tag Manager). Google then receives details of your visit: which pages you opened, where you came from, how long you stayed, your device, browser and operating system type, and your IP address, which is used to estimate your approximate location (country, city). Visits are linked to each other by a pseudonymous identifier stored in the _ga cookie. We see aggregated reports, not individuals, and we do not try to find out who is behind an identifier.

Microsoft Clarity — heatmaps and session recordings. Clarity captures how you use the page: clicks, scrolling, mouse movements, window resizing, and the structure of the page, so that the visit can later be replayed as a recording. Microsoft also receives details of your device, browser, operating system and screen size, your IP address (used to determine the country) and the page you came from. Text you type into fields (including the Contacts form) and choices in drop-down lists are masked by Clarity right in your browser in every mode and are not sent to Microsoft; in the default masking mode, numbers and email addresses on the pages are hidden as well. Visits are linked by a pseudonymous identifier in the _clck and _clsk cookies. We watch recordings to find the parts of the site that are hard to use, and we do not try to find out whose visit it was.

Until you answer in the cookie window, and if you click "Decline", the Google Analytics, Google Tag Manager and Microsoft Clarity scripts are not loaded on the page at all and no data goes to Google or Microsoft. Details are in the Cookie Policy.

Consent given in the Contacts form and every decision in the cookie window, including a refusal, are recorded on the website server: the version of the document consented to, your decision in the cookie window (allowed or declined), the date and time, the site language, the IP address with its last octet zeroed (it cannot identify a specific device) and the browser type. The cookie decision record holds no name or contact details. These records let us demonstrate consent if audited (Article 7(1) GDPR).

We do not ask on this site for identity document details, payment card data, health information or any other special categories of data. Please do not send them through the form.

The site is not intended for people under 16, and we do not knowingly collect their data. If you learn that a child has sent us their data, write to dpo@itcore.md and we will delete it.

We do not use your data for marketing newsletters, we do not sell it and we do not pass it to advertising networks. If you sent us a request, we will contact you about that request.

Requests are seen only by the "GARM INC" SRL staff who reply to them and prepare ITCore proposals.

Technical providers and systems that the site's data passes through:

Data may also be disclosed to:

• public authorities of the Republic of Moldova — only in response to a lawful request made in the manner prescribed by law;
• professional advisers (lawyers, accountants, auditors) — to the extent their work requires.

There are no other recipients. If this list changes, we will update this section and the version date.

The website server, the database and the mail server are located in the European Union.

Cloudflare processes technical data in the data centre of its network closest to you, which may be outside the EU and Moldova. The legal mechanism for such transfers is the European Commission's standard contractual clauses included in Cloudflare's data processing agreement.

Google Analytics data is processed by Google Ireland Limited, and some of it is transferred to Google LLC in the USA. Google LLC is certified under the EU–US Data Privacy Framework; the transfers are also covered by the European Commission's standard contractual clauses in Google's data processing terms.

Microsoft Clarity data is processed by Microsoft Ireland Operations Limited (Ireland) and Microsoft Corporation (USA) and stored in the Microsoft Azure cloud. Microsoft Corporation is certified under the EU–US Data Privacy Framework; transfers between Microsoft Ireland Operations Limited and Microsoft Corporation are also covered by the European Commission's standard contractual clauses.

If you withdraw consent or ask us to delete your data, we delete it within 30 days of your request, except for data the law requires us to keep longer.

Under Law No. 195/2024 and the GDPR you can:

• find out what data we hold about you and get a copy;
• correct inaccurate data;
• have your data erased (the "right to be forgotten") where there is no legal ground to keep it;
• restrict processing while a dispute about the data is being resolved;
• object to processing we carry out on the basis of legitimate interest;
• withdraw consent at any time. Processing before withdrawal remains lawful, but we stop using the data from that point on. Consent to analytics is withdrawn through the "Cookie settings" button in the site footer: it opens the cookie window again, and after you withdraw consent the site deletes the Google Analytics and Microsoft Clarity cookies on the itcore.md domain itself;
• receive your data in a machine-readable format and pass it to another controller (portability);
• not be subject to automated decisions. There are none on this site: requests are read and handled by people.

How to exercise them: write to our data protection officer at dpo@itcore.md or to info@itcore.md. We reply within 30 days; if a request is complex, we will let you know and extend the deadline by no more than a further 60 days. To avoid handing data to the wrong person, we may ask you to confirm that you are the person the data concerns.

The first three are needed for the site to work and are set without consent. Google Analytics and Microsoft Clarity cookies appear only if you clicked "Accept" in the cookie window. There are currently no marketing or advertising cookies on the site. You can change your choice at any time with the "Cookie settings" button in the site footer, which opens the window again; if you withdraw consent, the site deletes the _ga, _ga_*, _clck and _clsk cookies itself and reloads the page. The full list, lifetimes and procedure are in the Cookie Policy.

The connection to the site is encrypted (HTTPS/TLS). Access to requests and to administrative interfaces is limited to staff who need it for their work, through personal accounts. The server sits behind a web application firewall, changes in the system are logged, software is updated regularly and backups are made.

No method of transmitting or storing data is completely secure. If a breach affecting your data occurs, we will notify the CNPDCP within the period set by law (for cases under the GDPR, within 72 hours of becoming aware of it) and notify you without undue delay if the risk to your rights is high.

If you believe we are processing your data unlawfully, please write to us first at dpo@itcore.md; most issues can be sorted out quickly. You are nevertheless entitled to go straight to the supervisory authority:

National Centre for Personal Data Protection (Centrul Național pentru Protecția Datelor cu Caracter Personal, CNPDCP) MD-2004, mun. Chișinău, str. Serghei Lazo 48 Phone: +373 22 820 801 Email: centru@datepersonale.md Website: datepersonale.md

Visitors from the EU may also contact the data protection authority of the country where they live or work.

We update this document whenever our processing changes: a new provider, a new form, a new analytics service. The current version is always published on this page, with the version date at the top. For substantial changes (new purposes, new recipients) we will also notify the people whose requests we hold, using the contact details they gave us.

Questions about this document: dpo@itcore.md or info@itcore.md.