Privacy Policy
Processing of personal data through the carpetoutlet.md website · Document code: DP-08 · Approved on 21.08.2026
Translation. In case of discrepancies, the Romanian version prevails.
1. Who is the data controller
- Controller: SRL „PRODSTAR LUX” (commercial brand Carpet Outlet)
- IDNO: 1010600042749
- Registered office: Chișinău municipality, 15 Grădina Botanică St.
- Website: www.carpetoutlet.md
- Data protection email: privacy@carpetoutlet.md
2. About this Policy
The protection of personal data is an important part of the way in which SRL „PRODSTAR LUX”, hereinafter referred to as the “Company”, manages its relationship with the persons who access and use its websites.
This Policy explains how the Company collects and uses personal data through the www.carpetoutlet.md websites, the purposes for which this information is used, the legal bases for processing, the recipients of the data, the retention periods and the rights of data subjects.
The Policy applies to persons who browse the websites, request information, submit forms, place orders or requests for quotations, subscribe to commercial communications, participate in campaigns or use other online functionalities made available by the Company.
Data processing is carried out in accordance with Law No. 195/2024 on personal data protection and with the other rules applicable to the Company’s activity.
3. Relationship with other data protection information
This Policy specifically concerns the use of the websites.
For general information on how the Company processes the data of customers and visitors, the Data Processing Notice on the processing of personal data also applies.
The use of cookies, pixels and other similar technologies is explained separately in the Cookie Policy.
Where there is information specific to a particular process between the documents, the information specific to that process supplements this Policy.
4. Principles used by the Company
The Company seeks to ensure that the data collected through the websites is adequate and limited to what is necessary for the specific purpose for which it is requested.
Data is collected for specified purposes, explained to the person before or at the latest at the time of collection, and is used in accordance with those purposes.
Optional fields are distinguished from required ones.
Data collected for an order, request, delivery, complaint or participation in a promotion is not automatically used for marketing.
Internal access is limited according to role, and data is retained only for the period necessary for the purpose, legal obligations and the defence of the rights of the Company or of the person.
5. Categories of data subjects
Through the websites, the Company may process data concerning website visitors, customers and potential customers, persons who submit requests, recipients of orders or deliveries, persons who subscribe to commercial communications, participants in promotions and contests and, if the website offers such functionality, candidates who submit an application.
A person may belong to several categories at the same time. For example, a visitor may later become a customer or may separately subscribe to the newsletter.
For each activity, the corresponding purpose and legal basis apply.
6. Data collected automatically when you use the website
When you access the website, certain technical information may be generated or recorded automatically to enable its operation, security and administration.
This information may include the IP address, the date and time of access, the pages requested, technical session identifiers, information about the browser and device, the operating system, information about technical errors and other data necessary for the operation of the server and the protection of the website.
This information is used mainly for providing the website, ensuring security, detecting incidents, preventing abusive use and diagnosing technical problems.
To the extent that certain tools are used for analytics, advertising or other optional purposes, they are managed separately in accordance with the Cookie Policy and the options expressed by the user.
7. Legal basis for the processing of technical data
The data strictly necessary for the operation and security of the website are processed based on the Company’s legitimate interest in ensuring the availability, security, integrity and proper functioning of its online services and, where applicable, for carrying out the steps requested by the user.
Optional technologies requiring consent are activated according to the user’s choice, under the conditions described in the relevant policies.
8. Contact forms
When you submit a request via the contact form, the Company may collect the information you provide, such as your name, telephone number, e-mail address, locality and the content of the message.
The data are used to record the request, contact you, provide the requested information and continue communication in connection with the indicated subject.
If the request concerns the intention to purchase a product, the data may also be used to prepare an offer, verify availability, clarify specifications and take other steps at your request before concluding a transaction.
9. Mandatory nature of the fields
Fields marked as mandatory are necessary for the request to be processed properly.
Optional fields allow you to provide additional information when you consider it relevant.
The Company avoids requesting information that is not necessary for the purpose of the form.
We recommend that you do not enter sensitive data, copies of identity documents or other information that is not necessary for resolving the request in free-text fields.
10. Requests for offers and consultation regarding products
If you use the website to request an offer, information about a product, dimensions, availability or other commercial details, the Company may process your name, contact details, information about the products of interest, the dimensions or other specifications you provide and the history of communication related to the request.
These data are used to respond to the request, prepare the offer and organise any subsequent stages of the purchase.
The legal basis for processing is the steps taken at the person’s request before entering into a contract and, for organising and documenting communication, the Company’s legitimate interest, as the case may be.
11. Orders placed through the website
To the extent that the website allows placing an order, the Company may process the data necessary for recording and performing it.
These may include the surname and first name, telephone number, e-mail address, delivery address, locality, ordered products, quantity, order value, information regarding the payment method and information necessary for communication with the customer.
In the case of an order for a legal entity, the data of the contact person and its representative may also be processed.
The data are used for order confirmation, preparation of products, invoicing, payment, delivery, communication with the customer and management of any returns, warranties or complaints.
The main legal basis is the performance of the contract and compliance with the legal obligations applicable to the Company.
12. Data of the recipient of a delivery
When the person placing the order indicates another recipient, the Company may receive their name, telephone number and address.
The person providing the data of another recipient must transmit only the information necessary for delivery and ensure that they may legitimately communicate these data to the Company.
The Company uses this information exclusively for organising and carrying out the delivery and activities directly related thereto, unless the recipient subsequently enters into a relationship of their own with the Company.
13. Payment
If the website allows electronic payment, the information necessary for the transaction may be transmitted to the payment service provider.
The Company does not seek to collect or store complete card data if the payment is processed directly through the infrastructure of an authorised provider.
The information that the Company receives may include payment confirmation, the amount, the date, the transaction identifier and other data necessary for reconciling and documenting the operation.
The payment service provider may process certain information as an independent controller, in accordance with its legal obligations and its own policies.
14. Delivery of products
For the performance of the delivery, the Company may transmit to the transport provider or courier the necessary data, as a rule the recipient’s name, telephone number, address, the order information necessary to identify the delivery and any relevant instructions.
The provider receives only the information necessary for the performance of the service.
The legal role of the delivery provider is established according to the specific manner of provision and its own obligations.
15. Favourite products, cart and preferences
If the website offers functionalities such as the list of favourite products, shopping cart, storage of certain preferences or viewing history, certain information may be associated with your session or account.
The purpose is to provide the requested functionality and improve interaction with the website.
16. Request to be contacted
If the website allows the option “call me”, “contact me”, “request a call” or an equivalent functionality, the telephone number and related information are used to make the requested contact.
This does not automatically turn the telephone number into a contact eligible for marketing campaigns.
Separate policies apply to subsequent commercial communications.
17. Notifications regarding product availability
If you request to be informed when a certain product is back in stock or becomes available, the contact data are used to send the requested notification.
If the mechanism is designed exclusively for that notification, the data are not automatically used for the newsletter or other commercial campaigns.
The retention period is related to the purpose of the notification and the availability of the product.
18. Newsletter and commercial communications
If you subscribe separately to the newsletter, offers or other commercial communications, the Company may use the contact data and selected options to send the respective messages.
Where marketing is based on consent, subscription is optional and does not condition access to the basic products or services.
The fields and checkboxes related to marketing are not enabled by default.
You may withdraw consent or object to communications at any time through the available unsubscribe mechanism or by contacting the Company.
19. Evidence of marketing preferences
In order to comply with and demonstrate the person’s choice, the Company may retain information regarding the date and manner of subscription, the selected channel, the version of the form and any withdrawals or objections.
After unsubscribing, the Company may retain the minimum necessary information in an exclusion list in order to avoid accidental subsequent contact.
This information is not used to continue marketing.
20. Promotions, raffles and contests carried out online
If the website is used to participate in a promotion, raffle or contest, the Company collects the data necessary for the campaign mechanism.
At the participation stage, the aim is to collect a minimum set of information.
Additional data may be requested only from potential winners when necessary for verifying eligibility, handing over the prize or fulfilling legal obligations.
The specific details are set out in the rules and the Information Notice related to the campaign.
Participation in a campaign does not automatically entail subscription to marketing.
21. Complaints, returns and after-sales requests
If you submit through the website a complaint, a request regarding return, warranty or another issue related to a product or order, the Company may process the data necessary to identify the transaction and resolve the situation.
These may include identification and contact data, the order or invoice number, information regarding the product, the description of the problem, photographs of the product and correspondence.
The data are used to resolve the request, comply with legal obligations and, where necessary, establish, exercise or defend rights.
22. Chat and communication through external platforms
If the website integrates chat, WhatsApp, Messenger or another external communication service, its use may entail the transmission of certain information to the platform provider.
Before activating such functionality, the Company analyses the provider, the data transmitted and the relevant international transfers.
The conversation initiated by the person is used for the purpose for which that person contacts the Company.
23. Social networks
The website may contain links to the Company’s pages on social networks.
If a user accesses such a platform, the processing carried out by the platform is also subject to its own terms and policies.
24. Third-party embedded content
The Website may use, as applicable, external services for maps, video, fonts, reviews, or other functionalities.
Some such services may receive the IP address, technical identifiers, or other information when the content is loaded.
Where loading is not strictly necessary for the operation of the Website and requires a choice by the user, the service is activated in accordance with the preferences expressed through the cookie mechanism.
25. Cookies and similar technologies
The Websites use cookies and may use similar technologies.
Strictly necessary cookies support the technical operation and security of the Website.
Optional technologies for preferences, analytics, marketing, or external content are managed according to the applicable configuration and the user's options.
Complete information is available in the Cookie Policy
and preferences can be changed via Cookie Settings / Cookie Preferences
available on the Website.
26. Analytics
The Company may use analytics tools to understand how the Website is used and to identify performance issues or elements that can be improved.
Depending on the tool, technical data, information regarding pages accessed, visit duration, navigation events, and online identifiers may be processed.
Where activation of the tool requires consent, it remains blocked until the corresponding option is expressed.
27. Online advertising
If the Company uses pixels, tags, or other advertising technologies, these may enable measuring campaign effectiveness and, depending on configuration, creating audiences.
These technologies are administered in accordance with the relevant policies.
28. Data we receive from other persons or systems
In most cases, data is received directly from the data subject.
In certain situations, the Company may receive information from the person placing an order for another recipient, from providers involved in payment or delivery of an order, from partners of a campaign, or from internal systems that support the customer relationship.
If the data comes from another source and the law requires informing the data subject, the Company provides the relevant information within the applicable time and manner.
29. Sensitive data and identity documents
The Websites are not designed, as a general rule, for the collection of sensitive data or copies of identity documents through ordinary forms.
Please do not upload such information in a general contact form unless the Company has expressly indicated that they are necessary and has provided you with an appropriate channel.
Where an identity document becomes necessary in a particular process, the Company applies the principle that verification of the original and recording of strictly necessary data are preferred to the automatic retention of a copy.
Copies are retained only where there is an appropriate legal or documented justification.
30. Legal bases used
Depending on the specific activity, the Company may process data based on one or more legal bases.
Performance of a contract or pre-contractual steps are used for quote requests, orders, deliveries, and other activities requested by the data subject in connection with a possible or existing contractual relationship.
Legal obligations are used for processes such as accounting, taxation, certain consumer protection requirements, and other obligations imposed on the Company.
Legitimate interest may be used for system security, prevention of abuse, organization and defense of the business, resolution of complaints, and other purposes in which the interests and rights of the data subject have been appropriately assessed.
Consent is used when the data subject must benefit from a real choice, including for certain forms of marketing, optional cookies, and other activities for which this mechanism is applicable.
In the
31. When the provision of data is mandatory
Some information is necessary for the Company to be able to carry out the person's request.
For example, without a means of contact it may be impossible to confirm an order or send a response, and without a delivery address home delivery cannot be arranged.
Where the provision of data is optional, this must be apparent from the form or from the context.
Refusal to provide an optional field does not affect access to the service for which the respective information is not necessary.
32. External providers
The Company may use external providers for the administration of the website and the performance of related activities.
Depending on the actual configuration, these may include hosting providers, web maintenance, e-commerce platform, CRM, email, SMS, cloud services, payments, delivery, analytics, advertising, IT security and other services.
Providers that process data on behalf of the Company are selected and managed in accordance with internal procedures and are obliged to protect the data within the limits of their role.
Providers acting as independent controllers have their own legal obligations regarding the information they receive.
33. Authorities and other recipients
Data may be provided to public authorities, courts, competent bodies or other recipients where disclosure is required by law or is necessary for the establishment, exercise or defense of a right.
In the event of a dispute or an investigation, lawyers, consultants, experts, bailiffs or other persons who have a legitimate role in the respective proceedings may be involved.
The Company limits the information provided to what is relevant for the purpose of the disclosure.
34. International transfers
Some online service providers may store or allow access to data from outside the Republic of Moldova.
A transfer may exist even when the main server is located in a certain state, but technical support, backup or subprocessors involve other states.
The Company verifies such flows and applies the appropriate legal mechanism in accordance with applicable legislation.
35. Retention period
The Company does not retain all data collected through the website for the same period.
The duration depends on the purpose and applicable obligations.
The data of an inquiry that does not lead to an order are retained for the period established for pre-contractual communications and any clarifications.
Order data and financial-accounting documents are retained in accordance with the periods applicable to commercial, accounting and tax documentation.
Data concerning complaints and warranties are retained for the duration necessary for their resolution and for the period justified by the exercise or defense of rights.
Technical data and logs are retained in accordance with the security and administration needs of the system.
When the applicable period expires, the data are deleted, anonymized or archived only if there is a basis for continued retention.
36. Data security
The Company applies technical and organizational measures intended to protect data against unauthorized access, loss, disclosure, modification or inappropriate destruction.
Depending on the system and risk, these include access control, individual accounts, authentication, communication security measures, backup, logging of certain operations, system updates and restriction of administrative rights.
Providers that administer the website infrastructure are assessed in relation to the nature of the data and services provided.
No technical measure can entirely eliminate all risks, but the Company seeks to maintain a level of protection appropriate to the processing.
37. Security of communication with the Company
When you transmit information through the website or email, we recommend that you use the channels indicated by the Company and avoid including excessive data.
If a certain operation requires sensitive information or important documents, the Company may indicate a channel different from the general form.
The Company's employees will not ordinarily request your passwords or complete card information by email or general forms.
38. Automated decisions
In the current configuration of the processes described in this Policy, the Company does not use, merely by accessing the website, decisions based exclusively on automated processing that produce legal effects concerning the user or similarly significantly affect the user, if this corresponds to the actual technical configuration at the date of publication.
39. Your Rights
You have the right to request information regarding the data that the Company processes about you and, as provided by law, a copy of such data.
The response will be provided in an intelligible form and will include the information necessary to understand the processing.
If the data are inaccurate or incomplete, you may request their rectification or completion.
The Company will update the information in the relevant systems to the extent that the request is justified.
In the situations provided by law, you may request the erasure of the data.
This right is not absolute.
The Company may retain certain information where this is necessary for compliance with a legal obligation, the exercise or defense of a right, or for another reason provided by law.
If part of the data may be erased and another part must be retained, the request may be resolved in part.
In the situations provided by law, you may request the temporary restriction of the manner in which certain data are used.
During the restriction period, the data may be retained, and their use is restricted in accordance with the applicable conditions.
Where the legal conditions are met, you may request to receive certain data in a structured, commonly used and machine-readable format.
Where feasible and lawful, direct transmission to another controller may be requested.
Where the processing is based on legitimate interest, you may object under the conditions provided by law.
The Company will assess the particular situation and the grounds for continuing the processing.
In the case of direct marketing, the objection is applied in accordance with the rules specific to this purpose.
Where the processing is based on consent, you may withdraw it at any time.
Withdrawal takes effect for the future and does not affect the lawfulness of the processing carried out before withdrawal.
If the same data must be retained under another obligation or on another legal basis, the withdrawal of consent does not result in the deletion of those separate operations.
If the Company introduces processing involving decisions based solely on automated processing with the effects provided by law, the data subject will benefit from the rights and safeguards applicable to such processing.
The specific information will be provided before or at the time the process is introduced.
If you consider that your data are processed in breach of applicable legislation, you may contact the Company to clarify the situation.
You also have the right to lodge a complaint with:
National Center for Personal Data Protection of the Republic of Moldova (CNPDCP)
in accordance with the procedures and contact details published by the authority.
The exercise of this right does not prevent the use of other remedies available under the law.
The Privacy Policy for the Carpet Outlet Loyalty mobile application is published separately at /privacy/.