Legal basis: Articles 5–7 and 12–13 of Law No. 195/2024; Article 116(5)–(6) of Law No. 72/2025 on electronic communications.
1.1. This Policy describes the actual use of cookies, localStorage and related technologies on the amigo.studio website (the “Site”), as well as the external resources accessed by the user’s browser when visiting certain pages of the Site.
1.2. The controller is XAIRO SRL, IDNO 1002600004694, registered office: Republic of Moldova, Chișinău, 176 Muncești Road, apt. 90.
For personal data matters: data@amigo.studio. For other matters: secretariat@xairo.com. Postal address: Chișinău, 29/5 Testemițanu Street, 2nd floor, XAIRO office.
1.3. The Policy reflects the Site’s production configuration established as a result of the technical review. The mere presence of a technology in source code does not in itself mean that it is actually used if it is not activated in the production configuration.
1.4. This Policy applies together with the “Personal Data Protection and Privacy Policy”. Insofar as personal data processing is concerned, this document specifies its provisions as applied to cookies, localStorage and related external technologies.
Legal basis: Article 116(5)–(6) of Law No. 72/2025; Articles 4–7 of Law No. 195/2024.
2.1. Cookies are small pieces of data that a website or external service may store in the user’s browser and subsequently access. Other technologies, including localStorage, may also be used to store information in the browser.
2.2. Article 116 of Law No. 72/2025 establishes special requirements for storing information in the user’s terminal equipment and obtaining access to information already stored in it, including the requirement to provide the user with clear and complete information about the purposes of processing.
2.3. Article 116(6) separately governs technical storage or access carried out solely for transmitting a communication over an electronic communications network or strictly necessary to provide an information society service expressly requested by the user.
2.4. Where the use of cookies, localStorage or an external resource involves the processing of personal data, the requirements of Law No. 195/2024 apply alongside those of Law No. 72/2025. For such processing, XAIRO determines the appropriate legal basis under Article 6 of Law No. 195/2024 and complies with the applicable transparency and data protection requirements.
2.5. Where, in a particular case, personal data processing is based on consent, that consent must comply with Law No. 195/2024 and may be withdrawn by the data subject.
Legal basis: Article 116(6) of Law No. 72/2025; Articles 5, 6(1)(f), 24–25 and 32 of Law No. 195/2024.
3.1. The Site uses two first-party cookies to ensure security and session operation. XAIRO does not use them for analytics, advertising or profiling.
| Cookie | Purpose | Period | Category |
|---|---|---|---|
| XSRF-TOKEN | Protection against cross-site request forgery (CSRF) when using Site forms and requests | Up to 2 hours; may be renewed during the session | Necessary |
| amigostudio_session | Server session identifier required for Site functions, including form state and locale | Up to 2 hours; may be renewed during the session | Necessary |
3.2. Restricting or blocking these cookies through the browser may impair the operation of the Site’s forms, session or security mechanisms.
Legal basis: Articles 5, 7 and 12 of Law No. 195/2024; Article 116 of Law No. 72/2025.
4.1. After the user accepts, rejects or saves the selected categories in the cookie management mechanism (CMP), the Site stores the choice made in the browser’s localStorage.
| Technology | Purpose | Period | When created |
|---|---|---|---|
| localStorage: cookie_consent | Storing the user’s choice and the settings version | 365 days or until deletion/reset by the user | After the user’s action: accepting, rejecting or saving the choice |
4.2. The user may change a previously made choice through the cookie settings mechanism available on the Site. Clearing browser data may delete the stored choice, after which the Site may request it again.
4.3. CMP is used to manage the categories provided for in it and to store the user’s choice. However, not every external resource in the Site’s current technical configuration is managed by CMP. The actual behaviour of such resources is described in section 6.
Legal basis: Articles 5–7 and 12–13 of Law No. 195/2024; Article 116 of Law No. 72/2025.
5.1. According to the results of the technical review, as of the date of this version, Google Analytics 4, Google Tag Manager, Matomo, Microsoft Clarity, Hotjar, Yandex Metrica, Meta Pixel, Google Ads/Conversion Tracking, LinkedIn Insight Tag and TikTok Pixel are not activated on the production Site.
5.2. The presence in source code of the technical capability to connect particular analytics or marketing systems does not mean that they are actually used.
5.3. Before activating a new analytics or marketing technology, XAIRO assesses its purpose, the data processed, recipients, the legal basis for processing and the applicable requirements of Laws No. 195/2024 and No. 72/2025.
Legal basis: Articles 5–7, 12–13 and, where applicable, Articles 44–49 of Law No. 195/2024; Article 116 of Law No. 72/2025.
6.1. Some Site pages access external services directly from the user’s browser. When such a connection is established, at least the IP address and standard technical connection parameters are transmitted to the external provider.
The technical review established the following integrations:
| Service | Use | Purpose | Actual status |
|---|---|---|---|
| Adobe Typekit / Adobe Fonts | On the reviewed pages during loading | Loading web fonts | The external resource loads automatically before a choice is made in CMP |
| Google Maps JavaScript API | Contact page | Displaying an interactive map | Loads automatically before a choice is made in CMP |
| Google reCAPTCHA v2 | Project request form | Protection against automated requests, spam and abuse | Loads on the relevant page; not managed by CMP |
| Google reCAPTCHA v3 | Application-related functionality | Assessment of automated activity and protection against abuse | Starts after the first interaction with the application button; not managed by CMP |
This table corresponds to the facts established during the technical review and already reflected in the working version dated 11 September 2026.
6.2. When an external resource is accessed, technical data may be transmitted to the provider regardless of whether the relevant service creates a cookie in the user’s browser.
6.3. XAIRO does not specify particular names or retention periods for third-party cookies of external services where their actual creation was not confirmed by the technical review performed.
6.4. Google reCAPTCHA. XAIRO processes technical personal data associated with the use of reCAPTCHA in order to protect forms, the Site and information systems against spam, automated requests and abuse. The legal basis is XAIRO’s legitimate interest under Article 6(1)(f) of Law No. 195/2024, provided that the user’s interests, rights and freedoms do not override that interest.
6.5. Google Maps. Technical personal data processing associated with loading Google Maps is performed to provide users with interactive information about the Company’s location and contact details. XAIRO bases such processing on legitimate interest under Article 6(1)(f) of Law No. 195/2024, provided that the user’s interests, rights and freedoms do not override that interest.
6.6. Adobe Fonts/Typekit. Technical personal data processing associated with loading web fonts is performed to ensure the intended and consistent visual display of the Site. XAIRO bases such processing on legitimate interest under Article 6(1)(f) of Law No. 195/2024, provided that the user’s interests, rights and freedoms do not override that interest.
6.7. The legal bases stated in clauses 6.4–6.6 relate to personal data processing under Law No. 195/2024. When using the relevant technologies, XAIRO also applies the special requirements of Article 116 of Law No. 72/2025.
Legal basis: Articles 5–7 and 13 of Law No. 195/2024; Article 116 of Law No. 72/2025.
7.1. XAIRO processes technical data required for the Site’s first-party cookies, protection of information systems, prevention of abuse and ensuring Site resilience on the basis of the legitimate interest in ensuring the security and proper operation of information resources, where that interest is not overridden by the user’s interests, rights and freedoms.
7.2. When using technologies that affect the user’s terminal equipment and at the same time involve personal data processing, XAIRO applies both relevant legal regimes:
7.3. Compliance with the requirements to inform the user under Law No. 72/2025 does not replace the need to have a legal basis for personal data processing under Law No. 195/2024.
Legal basis: Article 13(1)(e)–(f), Articles 28–29 and 44–49 of Law No. 195/2024.
8.1. The Site is hosted on the infrastructure of Hetzner Online GmbH. In relation to XAIRO data hosted there, Hetzner acts as a processor on XAIRO’s behalf under a data processing agreement.
For the hosting selected by XAIRO, Hetzner’s contractual processing takes place in the European Union/European Economic Area, unless XAIRO agrees otherwise in the manner provided for by the contract.
8.2. When Google Maps and Google reCAPTCHA are used, the user’s browser interacts with Google’s infrastructure, and when Adobe Fonts/Typekit is used, it interacts with Adobe’s infrastructure.
To the extent that such processing entails an international transfer of personal data, the corresponding requirements and safeguards of Law No. 195/2024 apply.
8.3. Processing applications in internal information systems controlled by XAIRO does not constitute a transfer of data to an independent third-party recipient merely because a separate internal domain, information system or server is used.
Legal basis: Articles 5–6, 12–13, 24–25 and 32 of Law No. 195/2024.
9.1. Site forms may request a name, contact details, company information, a project description and the contents of a message. This information is not a cookie, and its processing is governed primarily by the Personal Data Protection and Privacy Policy.
9.2. The Site’s own CSRF mechanism and Google reCAPTCHA are used for the technical protection of forms.
9.3. Data entered directly by the user in a form may, after the form is submitted, be processed in XAIRO’s internal information systems for registering and handling the request and for subsequent communication.
Legal basis: Articles 7, 12 and 15–22 of Law No. 195/2024; Article 116 of Law No. 72/2025.
10.1. The user may manage the categories provided for in CMP through the settings mechanism available on the Site and may also use browser functions to manage cookies and other stored data.
10.2. The actual limitations of CMP in relation to external resources are described in section 6 of this Policy.
10.3. Where personal data processing is based on consent, the user has the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
10.4. To the extent that cookies, identifiers or technical information relate to an identified or identifiable natural person, the data subject has the rights provided for by Law No. 195/2024.
The procedure for exercising them is established in a separate document, “Procedure for Exercising the Rights of Data Subjects”.
10.5. Personal data enquiries: data@amigo.studio; by registered letter: Chișinău, 29/5 Testemițanu Street, 2nd floor, XAIRO office.
Legal basis: Articles 5, 12–13 and 24–25 of Law No. 195/2024.
11.1. XAIRO reviews this Policy when the Site’s actual production configuration changes, when new cookies, browser storage, analytics or advertising systems or external resources are connected, or when the purposes or methods of processing change materially.
11.2. Before connecting a new technology, XAIRO assesses the nature of its operation, the data processed, purposes, recipients, legal basis for processing and the applicable requirements of Laws No. 195/2024 and No. 72/2025.
11.3. The current version of the Policy is published on the Site with the version date indicated.
Version dated 17 September 2026