Privacy policy

1. Who processes the data

The operator is S.R.L. „BosmoImpex”, IDNO 1004600053009, registered office str. C. Stamati 2, ap. 1, mun. Chișinău, Republica Moldova, trading as Flat Studio (flät). Showroom and factory: str. Socoleni 31, MD-2020, mun. Chișinău.

For any question about your data, write to info@flatstudio.md, call +373 60 810 810 or visit the showroom. We have not appointed a data protection officer, as the law does not require one of us; the company’s management handles these questions directly.

2. What we process, why, and on what basis

Projects saved in the configurator hold only the configuration (model, size, decors, cabinets) and a code — no name or phone. They are linked to you only if you send the project with a request; we delete them on request.

Name and phone are needed so we can call you: a request cannot be sent without them. The other fields are optional.

We do not use your data for advertising, sell it, or pass it to other companies for marketing. We make no automated decisions and do no profiling.

3. Who can access the data

• Our staff who handle your request or order (managers, the measuring and installation team), each with a personal account and only as far as needed.
• The contractor who builds and runs our site and platform, under a data processing agreement.
• Vercel Inc. (USA) — hosts the site; the servers that receive the forms run in Frankfurt, Germany (EU).
• Railway Corporation (USA) — hosts the platform and the database where requests are kept; servers in the Netherlands (EU).
• Zoho Corporation B.V. (the Netherlands, EU) — our e-mail, for messages sent to info@flatstudio.md.
• Google LLC (USA) — copies of messages received at info@flatstudio.md are forwarded to the company management’s Gmail mailboxes.
• Public authorities — only when the law requires it.

These providers process the data only on our behalf and on our instructions, under data processing agreements.

4. Transfers outside the Republic of Moldova

The data is stored on servers in the European Union (Germany and the Netherlands), e-mail included (Zoho, EU data centre). Vercel and Railway are US companies; transfers to them rely on the appropriate safeguards the law provides for — the standard contractual clauses in their data processing agreements. Copies of messages forwarded to Gmail are kept on Google’s servers, including in the USA, under Gmail’s terms.

5. Your rights

• to know whether we process your data and get a copy (access);
• to have inaccurate or incomplete data corrected;
• to have your data erased;
• to have processing restricted;
• to receive your data in a structured format and pass it to another operator (portability);
• to object to processing based on our legitimate interest;
• not to be subject to a decision based solely on automated processing — we make no such decisions;
• to withdraw consent at any time where processing relies on it, without affecting processing before then.

These rights are set out in Articles 13–22 of Law No. 195/2024. Send your request to info@flatstudio.md, by phone at +373 60 810 810 or at the showroom. We answer free of charge within one month of receiving it; for a complex request this may be extended by two more months, and we tell you so within the first month. To protect your data we may ask you to confirm the request is yours, for example from the phone number in the request.

6. Complaints

If you believe we process your data unlawfully, you can complain to the National Center for Personal Data Protection, str. Serghei Lazo 48, MD-2004, mun. Chișinău, tel. 022 820 801, centru@datepersonale.md, datepersonale.md. Please write to us first: we usually sort it out faster together. You may also go to court.

7. How we protect the data

The site works only over an encrypted connection (HTTPS). Requests are kept in our internal platform, which only staff with a personal account and sign-in can open. We collect only what is needed, keep backups and review our security measures regularly.

If an incident puts your data at risk, we notify the National Center for Personal Data Protection within 72 hours of becoming aware of it, and you too if the risk to you is high.

8. Children

The site is meant for adults buying furniture. We do not knowingly collect data about children; if we learn a request came from a minor, we delete it.

9. Cookies

The cookies the site uses are described in the cookie policy.

10. Changes to this policy

We update this policy when the way we process data or the law changes. The version in force is published on this page with its date. With your request we also keep the version of the policy you read.