Privacy Policy

1. Data controller

Personal data collected through the Auto Service Desk platform is processed by:

• Name: Independent Entrepreneur “TUDOR BEȘLIU”
• IDNO: 1026023003762
• Registered office: str. Independenței, bl. 104, apt. 28, MD-6201, Sîngerei, Republic of Moldova
• Email: support@autosdesk.app
• Phone: +373 79 461 484

For any question about your personal data, you can contact us using the details above.

2. What data we collect

• Account data (auto service): name, email, phone, full name, address, tax code, password (stored encrypted), logo.
• Bank details (auto service): IBAN, bank code, bank name — used exclusively for display in the header of work orders generated as PDF.
• Billing data: invoice history, card payment reference (Paynet). We do not store bank card data.
• Data about mechanics: first name, last name — entered by the auto service to assign work orders.
• Data entered about the service's own clients: client type (individual or company), first/last name or company name, IDNO, email, one or more phone numbers and, where applicable, the client's bank details (IBAN, SWIFT, bank name) — processed by us only as a processor, in accordance with Section 11 of the Terms and Conditions.
• Data about clients' cars: make, model, year of manufacture, engine capacity, engine code, chassis number (VIN), registration number — processed by us only as a processor, just like client data.
• Technical data: IP address, access log, for security and audit.

3. Purpose and legal basis of processing

The data is used exclusively to provide and improve the Auto Service Desk service: creating and managing the account, billing, technical support, communication related to using the platform and compliance with legal obligations (e.g. accounting).

4. Data storage and security

Data is stored in secure databases, with role- and account-based restricted access, isolated per auto service (multi-tenancy). Passwords are stored encrypted (hashed), and communication with the platform takes place exclusively over a secure connection (HTTPS). Administrative access to client accounts is allowed only to authorized staff, through the impersonation feature, which is automatically logged and auditable.

5. Third-party services used

For the platform to work, we use the following third-party providers, which may process data on our behalf:

• Mailtrap — sending transactional emails.
• Twilio — sending WhatsApp notifications (USA — transfer outside the Republic of Moldova).
• tophost.md — server hosting, physically located in Chișinău, Republic of Moldova.
• Backblaze — storage of encrypted backups, in its Amsterdam data center, European Union.

We do not sell or share your data with third parties for commercial purposes. Data may be disclosed only when required by law or to the technical providers strictly necessary for the platform to work.

6. International data transfer

Data is hosted mainly in the Republic of Moldova. Certain data passes through services outside the country (e.g. Twilio, USA) exclusively for the WhatsApp notification feature, if enabled, strictly limited to the data necessary for that feature. Database and file backups are encrypted by us before transfer and stored with Backblaze in the European Union; the provider has no access to their content.

7. Retention period

Account data is kept for as long as the subscription exists. After the account is terminated/deleted, account data is kept for 90 days (for possible recovery requests), after which it is permanently deleted.

Deleted data may persist in encrypted backups for at most 6 months, after which it is removed automatically. Backups are used for no purpose other than restoring data after an incident. If a restore is needed, previously deleted data is deleted again immediately after the restore.

The steps to request account deletion are described on the Account deletion page.

Accounting documents (invoices, related bank details) are kept for 6 years from issue, in accordance with Law no. 287/2017 on accounting and financial reporting and the Index of standard documents approved by the State Archive Service of the Republic of Moldova, regardless of the account's status.

8. Your rights

Stored data is processed in accordance with Law no. 195/2024 on personal data protection. Under this law, you have the right to:

• access the data processed about you;
• rectification of incorrect data;
• erasure of data (“the right to be forgotten”), except for legal retention obligations;
• object to processing, under certain conditions;
• data portability (export in a structured format).

To exercise these rights, you can contact us using the details in point 1. You also have the right to lodge a complaint with the National Center for Personal Data Protection (CNPDCP).

9. Changes to this policy

This policy may be updated periodically. Any change will be reflected by updating the date above.