Information note

Privacy Notice on the Processing of Personal Data

B.I.C. „INFODEBIT CREDIT REPORT” S.R.L. - Version 1.1 of 24 August 2026

1. Purpose of this Privacy Notice

B.I.C. „INFODEBIT CREDIT REPORT” S.R.L. respects the right of natural persons to privacy and to the protection of their personal data.

This Privacy Notice explains, in a transparent and accessible manner:

who processes personal data;
what categories of data are processed;
from what sources the data are obtained;
for what purposes they are used;
the legal bases for the processing;
to whom the data may be disclosed;
how long they are retained;
whether they are transferred to recipients in other states;
how they are used within the Client Portal, the website, the CRM system and the mobile application;
what rights the data subject has;
how these rights may be exercised.

This Notice has been drawn up in accordance with:

Law No. 195/2024 on the Protection of Personal Data;
Law No. 122/2008 on Credit History Bureaus;
Law No. 284/2004 on Information Society Services;
the regulations issued by the National Bank of Moldova;
the regulations issued by the National Centre for Personal Data Protection;
the other legislation applicable to Infodebit's activity.

2. Identity of the controller

The controller of the personal data is:

Name: B.I.C. „INFODEBIT CREDIT REPORT” S.R.L.

IDNO: 1017600009673

Registered office: Republic of Moldova, Chișinău municipality, 10B Calea Ieșilor Str., 5th floor, MD-2069

Telephone: +373 79 025 932

E-mail: info@infodebit.md

Website: https://www.infodebit.md/

Infodebit is a credit history bureau and processes the information that forms the credit history under the terms of Law No. 122/2008.

3. Data Protection Officer

Infodebit has appointed a Data Protection Officer who may be contacted with any questions regarding the processing of data or the exercise of rights:

Data Protection Officer: „Privacy by Default” S.R.L.

E-mail: office@gdpr.md

Telephone: +373 69 24 22 66

Data subjects may contact the Data Protection Officer directly, without being required to first address any other unit of Infodebit.

4. Persons to whom this Notice applies

This Notice applies to data relating to:

credit history subjects;
persons who request their own credit report;
users of the Client Portal;
users of the mobile application;
visitors to the website;
persons who complete online forms;
persons who contact Infodebit;
the representatives, directors, founders, employees and contact persons of clients and contractual partners;
the representatives of the sources that form credit histories;
the representatives of the users of credit histories;
clients and prospective clients recorded in the CRM system;
recipients of professional or commercial communications;
persons who submit requests, petitions, complaints or challenges;
the legal or authorised representatives of data subjects;
other persons whose data are processed in connection with Infodebit's activity.

5. Principles applied

Infodebit processes data in compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and controller accountability.

Infodebit does not request or process data that are not necessary for the achievement of a lawful and specified purpose.

6. General legal bases

Depending on the specific purpose, Infodebit processes data on the basis of:

compliance with a legal obligation;
the application of Law No. 122/2008;
the performance of a contract;
the taking of steps prior to the conclusion of a contract, at the data subject's request;
the legitimate interest pursued by Infodebit or by a third party, where this is permitted by law, necessary and not overridden by the rights and freedoms of the person;
consent, only for optional processing for which it constitutes an appropriate basis;
the establishment, exercise or defence of a legal right;
other bases expressly provided for by the applicable legislation.

7. Consent and the activity of the credit history bureau

Consent is not used as a general legal basis for the formation, updating, retention and provision of the credit history where these operations are governed by Law No. 122/2008.

In particular, Infodebit does not rely exclusively on consent for:

the transmission of data to Infodebit by the sources that form credit histories;
the formation and retention of the credit history;
the updating of information concerning the debtor's obligations;
the provision of the credit report to a user who meets the legal conditions;
keeping records of requests and access events;
retaining the declared legal basis;
fulfilling obligations concerning the security, quality and protection of information.

Consent declarations obtained under the procedures applied prior to the amendment of the legal framework, including those used up to 2022, are not relied upon to justify current operations that must be based on Law No. 122/2008 and on the legal bases in force at the time of processing.

In the case of a credit history subject who is a natural person, the transmission and access of information take place under the terms of Law No. 122/2008, including in the context of:

the existence of a contractual relationship;
the taking of measures prior to the conclusion of the contract, at the person's request;
the existence of a legitimate interest in the relevant information, where this basis is permitted by law, declared and verifiable;
the existence of another obligation or authorisation provided for by law.

Consent may be used for separate and optional activities, such as:

subscription to the newsletter;
optional commercial communications;
statistical or marketing cookies;
other optional features that are not necessary for the formation of the credit history or the provision of the main service.

8. Processing of data for the formation of the credit history

8.1. Categories of data

Under the terms of Law No. 122/2008, Infodebit may process:

first name and surname;
date and place of birth;
IDNP (personal identification number);
the series and number of the identity document, where the processing is necessary and permitted;
domicile or residence;
contact details;
information on the place of employment, where lawfully included in the service provided;
information on a credit application;
information on contracts for credit, loan, leasing, financing or supply on credit;
the number, date and status of the contract;
the amount and currency of the obligation;
the outstanding balance of the obligation;
the repayment schedule and term;
the payments made;
arrears and their duration;
the amendment or restructuring of the obligation;
the extinguishment of the obligation;
information on guarantees, suretyship and co-debtors;
information on disputes relating to the obligation;
information on insolvency, where the law permits;
information on the sources that transmitted data;
information on the users who requested reports;
the date, purpose and declared basis of the report request;
challenges and the results of verification;
the credit score and the related statistical indicators;
the history of changes to the information;
other information provided for by Law No. 122/2008.

8.2. Sources of the data

The data may be obtained from:

banks;
non-bank lending organisations;
crowdfunding service providers;
legal entities and sole traders that grant credit;
legal entities and sole traders that supply goods or services on credit or on a deferred-payment basis, within the meaning of Law No. 122/2008;
other entities that meet the legal conditions to be sources for the formation of credit histories;
state registers and information systems, where access is permitted by law;
the data subject;
the person's legal or authorised representative;
other sources permitted by law.

8.3. Purposes of the processing

The data are used to:

form and update the credit history;
assess the manner in which obligations are performed;
prepare the credit report;
provide the report to authorised recipients;
calculate the credit score;
verify the accuracy of the data;
resolve challenges;
keep records of sources and users;
supervise and demonstrate the lawfulness of access events;
prevent fraud and unauthorised access;
fulfil Infodebit's legal obligations.

8.4. Legal basis

The processing is based on:

Law No. 122/2008;
the fulfilment of Infodebit's legal obligations;
the applicable contractual relationship or pre-contractual measures;
the declared legitimate interest, in the cases and under the conditions permitted by Law No. 122/2008;
the establishment, exercise or defence of a legal right;
other applicable legal provisions.

8.5. Retention

The credit history is retained for 5 years from the date of the last change to the information on the debtor's obligations.

Information on a credit application is retained for the specific period provided for by Law No. 122/2008.

Records of the legal basis declared by a source or user, including where data are accessed, are retained for the period provided for by Law No. 122/2008.

9. Provision of the credit report

The credit report may be provided to:

the credit history subject;
their legal or authorised representative;
the user of the credit history who meets the legal conditions;
public authorities and institutions, within the limits of their legal powers;
other recipients expressly authorised by law.

Before providing the report, Infodebit applies measures to verify:

the applicant's identity;
the applicant's standing and right of access;
the existence of a contractual relationship, where necessary;
the declared purpose;
the declared legal basis;
compliance with the technical conditions of access.

The report is not provided to any person who does not have a legal right of access.

10. Scoring and profiling

Infodebit may calculate a credit score on the basis of the relevant information in the credit history and of the methodology approved by Infodebit.

The score is a statistical assessment of the risk associated with the person's borrowing behaviour and performance of obligations.

The score does not, in itself, constitute a decision by Infodebit to grant or refuse credit. The decision belongs to the creditor or supplier examining the application.

The person may:

request information on the existence of scoring;
obtain pertinent explanations regarding the main categories of data used;
challenge inaccurate or incomplete data that have influenced the score;
request their verification and rectification;
exercise the rights relating to automated decision-making, where the legal conditions are met.

Infodebit does not publish the mathematical formula, the exact weightings or the technical information whose disclosure would prejudice trade secrecy, security or fraud prevention, without, however, limiting the person's right to an intelligible explanation.

11. Processing of data in the Client Portal

11.1. Data processed

For the creation, administration and securing of the Client Portal, Infodebit may process:

first name and surname;
IDNP;
telephone number;
e-mail address;
authentication data;
the account identifier;
the password in protected form;
confirmation codes or one-time passwords;
data relating to authentication via government services;
information on the representation of a legal entity;
the date and time of account creation;
the date, time and result of authentications;
the IP address;
information about the device and browser;
actions performed in the account;
the requests and reports generated;
documents uploaded by the user;
payments and transaction information, without retaining full card details where the payment is processed by an authorised provider;
messages and requests submitted through the Portal;
technical and security logs.

11.2. Purposes of the processing

The data are used to:

identify and authenticate the user;
create and administer the account;
verify the right of representation;
provide the requested services;
generate and make available the reports;
record requests and payments;
prevent fraud;
protect the account;
investigate suspicious access;
ensure the traceability of operations;
provide technical assistance;
resolve complaints;
fulfil legal obligations.

11.3. Legal basis

The processing is based on:

the performance of the requested service;
the taking of pre-contractual steps;
the fulfilment of legal obligations;
Law No. 122/2008, where the service concerns the credit history;
the legitimate interest in security, fraud prevention and the defence of rights;
consent, only for distinct optional features.

11.4. Mandatory nature of the data

Data marked as mandatory are necessary for identification, account creation, security and the provision of the service.

Refusal to provide the mandatory data may make it impossible to:

create the account;
verify identity;
provide the report;
make the payment;
resolve the request;
use a secured feature.

11.5. Retention

Account data are retained for the duration of the account's existence and thereafter for as long as necessary to fulfil legal obligations, resolve complaints, demonstrate operations and defend rights.

Data forming part of the credit history are retained in accordance with the specific periods provided for by Law No. 122/2008, regardless of the closure of the account.

Security logs are retained in accordance with the period established in internal policies, depending on the risk of the operations and the need to investigate incidents.

12. Processing of data through the mobile application

12.1. Account and identity data

The mobile application may process:

first name and surname;
IDNP;
telephone number;
e-mail address;
the account identifier;
the data required for authentication;
confirmation codes;
information on the credit report and the requested services;
documents or information submitted by the user;
the history of operations performed in the application.

12.2. Technical data

For operation and security, the application may process:

the IP address;
the type and model of the device;
the operating system and its version;
the version of the application;
the language and technical settings;
technical identifiers of the application or device;
the date and time of access;
the authentication log;
errors, crashes and diagnostic data;
information on the application's performance;
the technical token required to deliver notifications, if the user enables notifications.

12.3. Device permissions

The application requests access to device functions only where such access is necessary for a feature requested by the user.

Granting a technical permission through the operating system does not automatically constitute consent to any processing. Data obtained through a permission are used only for the purpose presented to the user.

The user may manage permissions in the device settings. Disabling a permission may limit only the feature for which that access is necessary.

12.4. Purposes of the processing

The data in the application are used to:

create and administer the account;
identify and authenticate;
provide the report and the requested services;
display personal information;
notify about operations and account security;
prevent fraud;
detect unauthorised access;
diagnose errors;
improve performance and security;
provide technical assistance;
fulfil legal obligations.

12.5. Legal basis

The processing is based on:

the performance of the requested service;
Infodebit's legal obligations;
Law No. 122/2008, for services relating to the credit history;
the legitimate interest in security, fraud prevention and the operation of the application;
consent for notifications or other optional features, where necessary.

12.6. Distribution platforms

Where the application is downloaded, installed or updated through an application store, the operator of that platform may process data in accordance with its own privacy policy and in the capacity of a separate controller.

Infodebit does not control the processing carried out independently by the operator of the application store.

13. Processing of data through the website

13.1. Data processed automatically

When accessing https://www.infodebit.md/, the following may be processed:

the IP address;
the date and time of access;
the page and feature accessed;
the address of the referring page;
the browser type;
the device type;
the operating system;
session identifiers;
technical information on errors and security;
cookies and similar technologies.

13.2. Purposes of the processing

The data are used to:

display and operate the website;
ensure the security of the services;
prevent attacks and fraud;
manage the session;
detect errors;
retain evidence of operations;
analyse the audience, only under the conditions applicable to statistical cookies;
improve the user experience;
resolve technical problems.

13.3. Online forms

If a person completes a form, Infodebit may process:

first name and surname;
telephone number;
e-mail address;
company and position;
IDNP, only where necessary for the requested service;
the subject and content of the message;
attached documents;
the date and time of submission;
technical and security information;
other data voluntarily provided by the person.

The person is asked not to include in free-text fields any data that are not necessary for examining the request.

13.4. Legal basis

The processing is based on:

the steps taken at the person's request;
the performance of a contract;
legal obligations;
the legitimate interest in communication, security and the operation of the website;
consent for the newsletter and non-essential cookies, where necessary.

13.5. Retention of forms

General requests are retained for the period of their examination and thereafter for as long as necessary to demonstrate the response, resolve any complaints and defend rights.

Requests concerning the credit history, data protection or the exercise of a right are retained in accordance with the periods applicable to the relevant process.

14. Cookie modules

Infodebit uses:

strictly necessary cookies;
preference cookies;
statistical or analytics cookies, if accepted;
marketing cookies, only if used and accepted.

Strictly necessary cookies are used for the technical operation, security and authentication of the services.

Non-essential cookies are activated only after a valid choice has been expressed, where consent is required.

The user may:

accept all cookies;
reject non-essential cookies;
select the accepted categories;
subsequently modify or withdraw the choice.

The up-to-date list of cookies, providers, purposes and durations is set out in the Cookie Policy.

15. Processing of data in the CRM system

Infodebit uses a CRM system to manage relationships with clients, prospective clients, sources, users, partners and their contact persons.

15.1. Categories of data

The following may be recorded in the CRM:

first name and surname;
the company or institution represented;
the position held;
the business telephone number;
the business e-mail address;
information on the right of representation;
data on the contract and the services used;
the history of discussions, meetings and correspondence;
offers and requests;
tasks and follow-up actions;
complaints and relationship incidents;
communication preferences;
the source of the contact;
the information necessary to prepare or perform the contract;
other professional information provided in the context of the relationship.

15.2. Sources of the data

The data may be obtained:

directly from the person;
from the company or institution they represent;
from correspondence and meetings;
from contracts and commercial documents;
from a colleague or authorised representative;
from public professional sources;
from events, conferences or commercial enquiries;
from existing contractual relationships.

15.3. Purposes of the processing

The data are used to:

prepare and negotiate contracts;
administer contractual relationships;
provide support;
manage communications;
maintain the history of the relationship;
allocate internal tasks;
follow up on requests;
resolve complaints;
promote services to professional contacts, in accordance with the law;
defend Infodebit's rights and legitimate interests;
fulfil legal obligations.

15.4. Legal basis

The processing is based on:

the performance of the contract;
pre-contractual measures;
legal obligations;
the legitimate interest in managing professional and commercial relationships;
consent, where necessary for optional communications.

15.5. Retention

Data relating to clients and partners are retained for the duration of the relationship and thereafter for as long as necessary to fulfil legal obligations, demonstrate communications and defend rights.

Data of prospective clients who have not initiated a contractual relationship are reviewed periodically and deleted when they are no longer necessary or when the person objects to communications, unless another basis for retention exists.

16. Recording of communications and support

When a person contacts Infodebit by telephone, e-mail, form, Portal or application, the following may be processed:

identification and contact data;
the date and time of the communication;
the content of the request;
the response provided;
the documents submitted;
the unit and person who handled the request;
the outcome of the resolution.

Infodebit does not record telephone conversations in audio without prior notice and without an appropriate legal basis.

17. Commercial communications and newsletter

Infodebit may send communications about its products, services and news only on an applicable legal basis.

Where the communication is based on consent:

the option is not pre-ticked;
consent is separate from acceptance of the Terms and Conditions;
the person may refuse without losing the main service;
proof of consent is retained;
the person may unsubscribe at any time.

Withdrawal of consent for marketing does not affect administrative, contractual or security communications, or those required by law.

18. Sources of data where they are not obtained directly from the person

Infodebit may obtain data about a person without that person providing them directly, in particular:

from the sources that form credit histories;
from the users of credit histories;
from the company or institution the person represents;
from state registers and information systems;
from contractual partners;
from professional or public sources;
from the legal or authorised representative;
from public authorities;
from the providers involved in authentication, payment, security or communications.

Infodebit provides the information required by law within a reasonable period, but no later than one month after obtaining the data, at the latest at the first communication or before the first disclosure, as the case may be.

Individual notification is not required to the extent that:

the person already holds the information;
obtaining or disclosure is expressly provided for by law and appropriate measures exist to protect the person;
the data must remain confidential under a legal obligation;
the provision of notification is impossible or would involve a disproportionate effort, under the conditions of the law, in which case Infodebit applies alternative measures, including the publication of this Notice.

19. Recipients of the data

Depending on the purpose and the basis, the data may be disclosed to:

the credit history subject;
their legal or authorised representative;
the sources that form credit histories;
the users of credit histories who meet the legal conditions;
hosting and technical infrastructure providers;
software development and maintenance providers;
database administration providers;
authentication and identification providers;
payment service providers;
communications, e-mail, SMS and notification providers;
the CRM system providers;
auditors;
legal advisers and the Data Protection Officer;
postal and courier service providers;
the National Bank of Moldova;
the National Centre for Personal Data Protection;
the courts;
law enforcement bodies;
other public authorities, within the limits of their legal powers;
other recipients authorised by law.

Providers that process data on behalf of Infodebit are contractually required to comply with documented instructions, confidentiality and security requirements.

20. Transfers outside the Republic of Moldova

Certain technical providers, application store operators, notification, analytics, communications or infrastructure services may process data in other states.

The transfer of data to a recipient in another state or to an international organisation is carried out only if the requirements of Law No. 195/2024 are met.

Depending on the situation, the transfer may be based on:

an adequacy decision on the level of protection;
appropriate safeguards;
applicable contractual clauses;
binding corporate rules;
a derogation provided for by law;
another recognised legal mechanism.

The person may request further information about the transfers applicable to their data and the safeguards used.

21. Retention periods

Infodebit determines retention periods according to the purpose, the nature of the data and legal obligations.

The main criteria are:

the period provided for by Law No. 122/2008;
the duration of the contract;
the duration of the account's existence;
the period necessary to resolve a request;
accounting and tax obligations;
limitation periods;
audit and supervision obligations;
the need to prevent fraud;
the need to establish, exercise or defend a legal right.

In particular:

the credit history is retained for 5 years from the last change to the information on the debtor's obligation;
information on the credit application is retained for the specific period provided for by Law No. 122/2008;
data on declared legal bases and access events are retained in accordance with the applicable legal period;
account data are retained for the duration of the account and thereafter for as long as necessary to fulfil legal obligations and defend rights;
contractual, accounting and tax data are retained in accordance with the periods provided for by law;
marketing data based on consent are processed until consent is withdrawn or until they are no longer necessary;
cookies are retained for the periods indicated in the Cookie Policy.

Once the applicable period has expired, the data are deleted, destroyed, anonymised or archived in accordance with the law.

22. Data security

Infodebit applies appropriate technical and organisational measures, including, as applicable:

access control;
user authentication;
separation of roles;
monitoring of access;
protection of networks and databases;
protection of data in transit and at rest;
backups and restoration;
vulnerability monitoring;
security updates and fixes;
protection against malicious software;
business continuity;
physical security;
staff training;
contractual confidentiality obligations;
incident management;
periodic audits and reviews.

Infodebit cannot guarantee the absolute elimination of every risk, but maintains measures appropriate to the nature of the data and the risks of the processing.

23. Personal data breaches

In the event of an incident, Infodebit:

identifies and limits the effects;
investigates the causes;
documents the incident;
assesses the risk to individuals;
adopts remedial measures;
notifies the National Centre for Personal Data Protection where the law so requires;
informs the affected persons where the incident is likely to result in a high risk, subject to the exceptions provided for by law.

24. Rights of the data subject

Under the terms of Law No. 195/2024, the person may benefit from:

the right to be informed;
the right of access;
the right to obtain a copy of the data;
the right to rectification;
the right to have incomplete data completed;
the right to erasure;
the right to restriction of processing;
the right to data portability;
the right to object;
the right to withdraw consent;
the rights relating to automated decision-making;
the right to lodge a complaint;
the right to bring the matter before a court.

These rights are not absolute and are exercised according to the legal basis and the nature of the processing.

Data that must be retained or processed under Law No. 122/2008 or another legal obligation cannot be erased merely because:

the person withdraws a previously given consent;
the person requests the closure of the account;
the contractual relationship has ended;
the person submits a general erasure request.

25. Special rights of the credit history subject

The credit history subject has the right to:

obtain their own credit report;
receive, once a year and free of charge, the credit report from each bureau that holds their history;
learn the sources that contributed to the formation of the history;
learn the users to whom reports about them were provided;
challenge the information in whole or in part;
request its amendment or completion;
request that the information be marked as challenged for the duration of the verification;
be informed of the result of the verification;
challenge the refusal or failure to resolve the request.

26. How to exercise the rights

Requests may be submitted:

electronically, through the channels published on https://www.infodebit.md/;
through the Client Portal, if the feature is available;
through the mobile application, if the feature is available;
in person, at Infodebit's registered office;
by post;
through a legal or authorised representative.

The request must allow the applicant and the right being exercised to be identified.

Infodebit may request additional information only where there are reasonable doubts about the identity or the standing of the representative.

Requests based on Law No. 195/2024 are handled without undue delay, but no later than one month from receipt.

This period may be extended by up to two months, taking into account the complexity and number of requests. The person is informed of the extension and its reasons within one month.

The specific time limits and procedures under Law No. 122/2008 apply to the credit report and to the challenge of the credit history.

27. Lodging a complaint

The person may contact Infodebit or the Data Protection Officer to clarify and resolve the situation.

The person also has the right to:

lodge a complaint with the National Centre for Personal Data Protection;
address the National Bank of Moldova on matters relating to the supervision of the credit history bureau's activity, within the limits of its powers;
bring the matter before a court.

Prior recourse to Infodebit is not mandatory and does not limit the person's right to address the competent authority or the court directly.

28. Amendment of the Notice

Infodebit may update this Notice in the event of:

a change in legislation;
the introduction of new services;
changes to the mobile application, the Portal, the CRM or the website;
changes to the purposes, bases, recipients or transfers;
changes to the retention periods;
the emergence of requirements from the competent authorities.

The updated version is published on https://www.infodebit.md/, indicating the date of the last update.

Significant changes are communicated by appropriate means, where the law requires information to be provided.

Date of last update: 24 August 2026
Version: 1.1