Privacy Policy

1. The data controller

The WebList platform (weblist.md) is operated by [Operator legal name], registered with IDNO [IDNO], registered office at [Registered address], Republic of Moldova, acting as controller of personal data.

We have not designated a data protection officer (DPO). For any questions about data processing, contact us at support@weblist.md — we respond to requests within 30 days.

2. What data we collect

We collect only the data necessary for the platform to operate:

• Account data: full name, email address, password (stored exclusively in encrypted form), preferred language.
• Organization data: name, description, logo, list of members with roles.
• Beneficiary data submitted through public forms: first and last name, email, phone, date of birth, gender, locality, document type, notes.
• Activity registrations: form answers, registration date and time, and the digital handwritten signature.
• Proof of consent: IP address and browser type recorded when the form was signed.
• Technical and security (audit) logs of actions performed in the platform.
• Aggregate usage statistics: enabled by default, disable them from cookie preferences (see the Cookie Policy).

3. Purposes and legal basis

• Performance of the service contract: managing your account and organization (articles in line with Law no. 195/2024).
• Consent: collecting registrations and signatures through public activity forms; withdrawal does not affect prior processing.
• Legitimate interest: securing the platform, preventing abuse and keeping audit logs.
• Legal obligations: situations provided for by the legislation of the Republic of Moldova.

4. Service providers (processors)

Beneficiary and registration data is visible exclusively to the organization that owns the activities. Platform administrators have technical access solely for support, maintenance and security incident investigation, and every access is logged. The following providers act for us as processors:

• [Hosting provider] — server and database hosting (Republic of Moldova).
• Cloudflare, Inc. — signature storage (Cloudflare R2) and protection of public forms against automated abuse (Turnstile).
• Resend, Inc. — delivery of transactional email (address verification, invitations, password reset).
• Sentry — collection of technical errors; it does not contain beneficiary data and is active only in production.

5. Cross-border transfers

Some providers above process data outside the Republic of Moldova (for example Cloudflare and Resend infrastructure operates in the EU and the US). For these transfers we apply the safeguards required by Law no. 195/2024: each provider receives only the data strictly necessary for the stated purpose, and their services provide equivalent guarantees (contractual measures and access controls). Upon request we provide additional information about where your data is stored.

6. How long we keep data

• Account and organization data: for as long as the account is active; upon deletion, data is permanently removed through the “Delete organization” flow in settings.
• Registrations and signatures: for as long as the activity and organization exist; the organization can delete them at any time.
• Audit logs: maximum 365 days.
• Failed registration attempts: maximum 7 days.
• Daily backup copies: maximum 14 days.

7. Your rights

Under Law no. 195/2024 on the protection of personal data, you have the right:

• of access to your data and information about the processing;
• to rectification of inaccurate data;
• to erasure („right to be forgotten”);
• to restriction of processing and to object;
• to data portability;
• to withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise your rights, write to support@weblist.md. We ask only for the information needed to identify your request. If you believe your rights are not respected, you may lodge a complaint with the National Center for Personal Data Protection (CNPDCP), the supervisory authority of the Republic of Moldova.

8. About the signature in the platform

The signature drawn with a finger or mouse in WebList is a digital graphic symbol attached to a registration. It serves as proof of attendance and of the consent given in front of the organizing organization.

A drawn signature is not a qualified electronic signature and does not produce the legal effects of one. Its effect between participant and organization is based on the consent expressed at the moment of signing.

9. Cookies

We use only strictly necessary cookies (the authentication session, form protection and language preference). We do not use marketing or cross-site tracking cookies.

The full list — name, lifetime and purpose — is on the Cookie Policy page.

10. Security

• Passwords are stored exclusively in encrypted form (bcrypt).
• Access to an organization's data is restricted to its members.
• All important actions are recorded in the audit log.
• Communication with the platform is encrypted (HTTPS), and signatures are stored separately with controlled access.
• The server makes daily database backups.

11. Automated decisions

We do not make automated decisions that produce legal effects. Data may be used for aggregated statistical reports (for example age or locality distribution) only at the express request of your organization.

12. Changes to this policy

This policy may be updated as the platform evolves. The date of the last update is shown at the top of the document. Significant changes will be communicated by email or through a notification in the platform.