Privacy Policy

Last updated: 14 November 2026

This policy explains how the website aria.md processes personal data, in accordance with Law No. 195/2024 on personal data protection of the Republic of Moldova, in force from 23 August 2026, which transposes the standards of Regulation (EU) 2016/679 (GDPR).

1. Who is the data controller

The data controller is the real estate company ARIA, which operates the aria.md website.
Phone: +373 68 666 444
For any questions regarding your data, you can contact us at this number or via the page Contact.

2. What data we process

Account data of agents and agencies: surname, first name, e-mail, phone, profile photo, the agency they belong to, login credentials.
Property listings: description, price, address and map location, photos, as well as the name and phone number of the agent who owns the listing.
Requests and messages sent through the website forms: name, phone, e-mail and the content of the message.
CRM data, entered by agents in their personal account about their clients (name, phone, property preferences, notes).
999.md API key of the agent who connects their 999.md account for the automatic import of listings.
Technical data: IP address, device and browser type, pages visited, date and time of access, as well as cookies (see section 9).

3. Purposes and legal bases of processing

Creating and managing the agent account, publishing listings and operating the personal account (including the CRM) – legal basis: performance of a contract (acceptance of the platform's terms of use).
Automatic import and synchronisation of listings from 999.md – legal basis: the agent's consent, given by entering the API key; it can be withdrawn at any time by deleting the key from the account.
Publishing new listings on ARIA's Facebook and Instagram pages and in the Telegram group, together with the agent's phone number – legal basis: performance of the contract with the agent and the legitimate interest in promoting listings.
Responding to requests and messages – legal basis: steps taken at your request prior to entering into a contract and the legitimate interest in responding.
Website security, prevention of fraud and abuse – legal basis: legitimate interest.
Compliance with legal obligations (for example, retention of accounting documents) – legal basis: legal obligation.

CRM data is entered by agents. For this data, the agent is responsible for having a legal basis, and ARIA processes it only in order to provide the service to the agent.

4. The online valuation tool and the loan calculator

Data entered into the online valuation tool (address, area, features, photos) and into the loan calculator is not saved. It is used only for the result displayed on screen and is deleted when you close or leave the page. The valuation is an estimate, produced automatically based on comparable public listings and an artificial intelligence analysis; it has no legal effect on you and does not replace the appraisal of a certified appraiser.

5. Who we share data with

We do not sell or rent personal data. We share it only with the providers necessary for the operation of our services, who process it on our behalf or as independent controllers, in accordance with their own policies:

999.md (Simpals) – import and synchronisation of listings of agents who have connected their account;
Meta Platforms (Facebook, Instagram) and Telegram – publishing listings on ARIA's pages;
Anthropic (the Claude model) – automatic translation of the website's texts into English and Russian and the analysis in the online valuation tool;
OpenStreetMap – locating addresses on the map;
National Bank of Moldova – retrieving the official exchange rate (no personal data is transmitted);
the website hosting provider;
public authorities, only when we are required to do so by law.

6. Transfer of data outside the Republic of Moldova

Some providers (Meta, Telegram, Anthropic) process data on servers outside the Republic of Moldova, including in the European Union and the United States of America. These transfers are made only under the conditions set out in Law No. 195/2024, on the basis of adequate safeguards provided by the providers (for example, standard contractual clauses) or, where applicable, your consent.

7. How long we keep data

account data and listings – for as long as the account is active; after the account is closed, we delete them within 30 days at most, except for data we are required by law to retain;
listings hidden or deleted by the agent – are removed from the website and from synchronisation with 999.md;
requests and messages – for up to 2 years from the last communication;
data entered into the valuation tool and the loan calculator – is not stored at all;
technical logs – for up to 6 months.

8. Your rights

Under Law No. 195/2024, you have the following rights:

right of access – to find out whether we process data about you and to receive a copy of it;
right to rectification – to correct inaccurate or incomplete data;
right to erasure ("right to be forgotten");
the right to restriction of processing;
the right to data portability – to receive your data in a structured format and transmit it to another controller;
the right to object – including to processing based on legitimate interest;
the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you;
the right to withdraw consent at any time, without affecting the processing carried out until then.

To exercise your rights, contact us at +373 68 666 444 or via the page Contact. We respond without undue delay, within the time limits provided by law (as a rule, within one month at most). Exercising your rights is free of charge.

If you believe that your data is being processed in violation of the law, you may lodge a complaint with the National Center for Personal Data Protection (CNPDCP): MD-2004, mun. Chișinău, str. Serghei Lazo 48, tel. (022) 820 801, e-mail centru@datepersonale.md, datepersonale.md. You may also apply to the courts.

9. Cookies

The website uses cookies that are strictly necessary for its operation: the authentication session, form security, and the selected language (Romanian, English or Russian). These cookies do not require consent. If we use analytics or marketing cookies, we will enable them only with your prior consent. You can delete or block cookies in your browser settings.

10. Data security

We apply appropriate technical and organizational measures: encrypted connection (HTTPS), role-based access restrictions, passwords and API keys stored securely and displayed masked, and regular system updates. In the event of a personal data breach, we notify the CNPDCP and, where applicable, the affected individuals, within the time limits provided by law.

11. Deletion of data received via Facebook or Instagram

To request the deletion of your data received via Facebook or Instagram, call us at +373 68 666 444 or write to us via the page Contact, stating your name and the account concerned. We confirm the deletion once it is completed.

12. Changes to the policy

We may update this policy when our services or legislation change. The current version is published on this page, with the date of the last update.