Legal basis: Articles 1, 5 and 12–14 of Law No. 195/2024.
1.1. This Personal Data Protection and Privacy Policy (the “Policy”) sets out the procedure and principal conditions for processing the personal data of natural persons when using the amigo.studio website (the “Site”).
1.2. The Policy has been prepared in accordance with Law of the Republic of Moldova No. 195/2024 on the protection of personal data (“Law No. 195/2024”) and applies to the processing of personal data in connection with visiting and using the Site, submitting enquiries and requests, and establishing and developing business relations with XAIRO SRL.
1.3. The purpose of the Policy is to provide data subjects, in a clear, transparent and accessible form, with information about what personal data may be processed, for what purposes and on what legal bases, to whom they may be disclosed, how long they are retained and how the data subject may exercise the rights provided by law.
1.4. The Policy applies to personal data processing associated with the Site and interaction with XAIRO through the Site. Links to third-party websites and services may lead to resources whose data processing rules are determined by their owners.
Legal basis: Article 4 and Article 13(1)(a)–(b) of Law No. 195/2024.
2.1. The personal data controller is XAIRO SRL, IDNO 1002600004694, registered office: Republic of Moldova, Chișinău, 176 Muncești Road, apt. 90 (“XAIRO”, the “Company”, the “Controller”).
Postal address for correspondence by registered letter: Chișinău, 29/5 Testemițanu Street, 2nd floor, XAIRO office.
2.2. Amigo® is a trademark of XAIRO. The Company uses the Site to present services, projects and other professional information and to interact with visitors and prospective clients.
2.3. For matters concerning personal data processing and the exercise of data subject rights, please contact: data@amigo.studio.
For other matters: secretariat@xairo.com.
Legal basis: Articles 4, 5, 9 and 13 of Law No. 195/2024.
3.1. XAIRO may process the personal data of Site visitors, persons submitting enquiries or requests, representatives of prospective and current clients, contractors and other persons interacting with the Company through the Site.
3.2. Depending on the method of interaction, the following may be processed:
3.3. XAIRO does not request special categories of personal data through the Site unless obtaining them is required in a specific situation. Users should not unnecessarily include such data in the free text of an enquiry.
Legal basis: Articles 13–14 of Law No. 195/2024.
4.1. The principal source of personal data is the data subject, when entering information on the Site, sending a message or otherwise providing information to XAIRO.
4.2. Certain technical data arise automatically when the user’s browser or device interacts with the Site and the information resources used by it.
4.3. Where XAIRO obtains personal data other than directly from the data subject, the Company provides the information required by Law No. 195/2024 in the applicable cases and within the applicable time limits, unless the Law provides an exception.
Legal basis: Articles 5–7 and 13 of Law No. 195/2024.
5.1. Personal data are processed for specified, explicit and lawful purposes and are not used in a manner incompatible with those purposes.
5.2. Depending on the circumstances, XAIRO processes personal data for the following purposes:
5.3. In cases of processing based on legitimate interest, XAIRO considers the nature and necessity of the processing, the relevant interest of the Company and the possible impact on the data subject’s rights and freedoms.
5.4. Where processing is based on consent, the data subject has the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5.5. Where XAIRO intends to carry out further processing for another purpose, the Company complies with the requirements of Law No. 195/2024 regarding the compatibility of purposes and the provision of additional information to the data subject.
Legal basis: Article 13(2)(e) of Law No. 195/2024.
6.1. Providing data through the Site is generally voluntary. However, data identified in a particular form as required may be necessary to handle an enquiry, prepare an offer or take the action requested by the user.
6.2. If required data are not provided, XAIRO may be unable to process the enquiry, contact the user or prepare the requested offer.
Legal basis: Article 13(1)(e) and Articles 28–29 of Law No. 195/2024.
7.1. XAIRO does not disclose personal data to third parties without an appropriate legal basis.
7.2. To the extent necessary for the relevant purpose, access to data may be given to:
7.3. Where a third party processes data on XAIRO’s instructions, the Company engages such processor on terms that comply with the requirements of Law No. 195/2024.
The Site’s infrastructure is hosted by Hetzner Online GmbH, which acts as processor in relation to XAIRO data hosted there under a data processing agreement.
7.4. When Google Maps, Google reCAPTCHA and Adobe Fonts/Typekit are used, the user’s browser directly establishes a network connection with the infrastructure of the relevant external provider. The technical data required to establish the connection and provide the relevant resource, including the IP address and standard technical connection parameters, are transmitted to the provider.
Details are provided in the Cookie and Similar Technologies Policy.
Legal basis: Article 13(1)(f) and Articles 44–49 of Law No. 195/2024.
8.1. The Site’s infrastructure is hosted on the infrastructure of Hetzner Online GmbH. Under the current data processing agreement, Hetzner’s contractual processing for the hosting selected by XAIRO takes place in the European Union/European Economic Area, unless XAIRO agrees otherwise in advance in the manner provided for by the contract.
8.2. When Google Maps, Google reCAPTCHA and Adobe Fonts/Typekit are used, the user’s browser interacts with the infrastructure of the relevant provider. To the extent that the relevant processing constitutes an international transfer of personal data, XAIRO applies the requirements and safeguards provided for by Law No. 195/2024.
8.3. The data subject may request information about the applicable transfer mechanism and available safeguards at data@amigo.studio.
8.4. Processing enquiries in internal information systems and on servers directly controlled by XAIRO does not in itself constitute a transfer of data to an independent third-party recipient.
Legal basis: Article 5, Article 13(2)(a) and Article 17 of Law No. 195/2024.
9.1. XAIRO retains personal data no longer than necessary for the purposes for which they are processed, unless longer retention is required by law or reasonably required to establish, exercise or defend legal claims.
9.2. When determining the retention period, XAIRO takes into account the purpose and nature of processing, the volume of data, the duration of the interaction, contractual and legal obligations, applicable time limits for bringing claims, and risks to the rights and freedoms of data subjects.
9.3. Data relating to an enquiry that did not result in a contractual relationship are deleted or anonymised once there is no longer a reasonable business and legal need to retain them.
Data relating to contractual relations may be retained during the performance of the contract and thereafter for the period necessary to comply with legal requirements and protect the parties’ rights.
9.4. The retention periods for the Site’s first-party cookies and localStorage are stated in the Cookie and Similar Technologies Policy.
Legal basis: Articles 5–7 and 13 of Law No. 195/2024; Article 116(5)–(6) of Law No. 72/2025 on electronic communications.
10.1. The Site uses first-party cookies required for security and session operation and localStorage to store the user’s choice. On certain pages, the user’s browser also accesses external Google and Adobe resources.
10.2. The special requirements of Article 116 of Law No. 72/2025 apply to storing information in the user’s terminal equipment and obtaining access to information stored in it, including the requirements to inform the user about the purposes of processing.
10.3. Where the use of cookies, localStorage or an external resource also involves the processing of personal data, the requirements of Law No. 195/2024 apply alongside Law No. 72/2025. XAIRO determines the appropriate legal basis for such processing under Article 6 of Law No. 195/2024 and complies with the applicable transparency and personal data protection requirements.
10.4. The actual set of first-party cookies and localStorage, their purposes and retention periods, as well as external resources and the particular features of their loading, are described in a separate Cookie and Similar Technologies Policy.
Legal basis: Articles 5, 24–25 and 32 of Law No. 195/2024.
11.1. XAIRO applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss or alteration, unauthorised disclosure or access and other forms of unlawful processing.
11.2. Access to personal data is granted only to the extent necessary to perform the relevant functions and is subject to organisational and technical restrictions.
11.3. No method of transmitting or storing information can provide absolute security. XAIRO assesses the measures applied having regard to the nature of the processing and the relevant risks.
Legal basis: Article 12 and Articles 15–22 of Law No. 195/2024.
12.1. In the cases and to the extent provided for by Law No. 195/2024, the data subject has the right to:
12.2. The conditions, limitations and procedure for exercising rights are set out in detail in the “Procedure for Exercising the Rights of Data Subjects” published on the Site.
Legal basis: Article 12(2)–(6) and Articles 15–22 of Law No. 195/2024.
13.1. A request may be sent to data@amigo.studio or by registered letter to: Chișinău, 29/5 Testemițanu Street, 2nd floor, XAIRO office.
13.2. Where there are reasonable doubts concerning the identity of the applicant, XAIRO has the right to request additional information necessary to confirm identity.
13.3. Information about action taken on a request is provided without undue delay and no later than one month after receipt. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months, with the data subject being notified during the first month.
13.4. Rights are exercised free of charge, except in the cases provided for by the Law involving manifestly unfounded or excessive requests.
13.5. Detailed rules are established in the “Procedure for Exercising the Rights of Data Subjects”.
Legal basis: Article 13(2)(f) and Article 22 of Law No. 195/2024.
14.1. In the ordinary use of the Site, XAIRO does not make decisions concerning visitors based solely on automated processing of personal data, including profiling, which produce legal effects concerning the person or similarly significantly affect that person.
14.2. If such processing is introduced, XAIRO will provide the information required by law and ensure the relevant safeguards.
Legal basis: Articles 12 and 13 of Law No. 195/2024.
15.1. A data subject who considers that the processing of his or her personal data infringes the law has the right to apply to the National Centre for Personal Data Protection of the Republic of Moldova (CNPDCP).
15.2. Official information about CNPDCP and the means of contacting it is available on CNPDCP’s official website.
15.3. Applying to CNPDCP does not deprive the data subject of other remedies provided for by law.
Legal basis: Articles 5, 12–13 and 24 of Law No. 195/2024.
16.1. XAIRO has the right to review the Policy when legislation, methods of data processing, Site functionality or technologies used change.
16.2. The current version is published on the Site with the version date indicated. If a change materially affects the nature of processing or the rights of data subjects, XAIRO takes the necessary additional information measures where required by law.
Controller: XAIRO SRL IDNO: 1002600004694 Registered office: Republic of Moldova, Chișinău, 176 Muncești Road, apt. 90 Website: amigo.studio Email for personal data matters: data@amigo.studio Email for general matters: secretariat@xairo.com Postal address: Chișinău, 29/5 Testemițanu Street, 2nd floor, XAIRO office
Version dated 17 September 2026