Privacy policy
This policy explains what personal data we collect when you use the Gift Box website or order from us, why we use it, how long we keep it and what rights you have. We process data in accordance with Law No. 195/2024 on personal data protection and other applicable legislation of the Republic of Moldova.
1. Who is responsible for your data
The data controller is Contactus Print SRL, IDNO 1025600013118, registered at str. Albișoara 42/1, Chișinău. For any question about your data, email contact@giftbox.md or call +373 68 998 847.
2. What data we collect and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You place an order | name, phone, email, delivery address, recipient’s name and phone, card message, products ordered | taking, preparing and delivering the order; contacting you about it | performance of a contract |
| You pay by card | amount, order number, payment status (you enter card details only with Paynet) | processing payment, refunds, fraud prevention | performance of a contract; legal obligation |
| You request a B2B quote | company name, IDNO, contact person, phone, email, request details, address list (if you send one) | preparing the quote and fulfilling the corporate order | pre-contractual steps at your request; performance of a contract |
| Invoicing and accounting | billing details, accounting records | meeting tax and accounting obligations | legal obligation |
| You sign up for reminders or offers | email, saved important dates | sending reminders and seasonal offers; we measure whether an email was opened and which links were clicked, so we send fewer and better-suited emails | your consent, which you can withdraw at any time |
| You sign in with Google | name, email, profile photo and Google account ID; the addresses, important dates and company details you save | creating and running your account, order history | performance of a contract (the account) |
| You contact us | details from your message, call or email | replying to you, handling complaints | our legitimate interest in replying; legal obligation for complaints |
| You browse the site | technical data (IP address, browser type), cookies | running and securing the site; analytics and advertising only with your consent | legitimate interest (necessary cookies); consent (all others) |
We do not process special categories of data and do not make decisions based solely on automated processing that have legal effects on you.
3. Gift recipients’ data
When you send a gift to someone else, you give us their name, phone and address. We use these only to deliver the gift. Please share them only if you have reason to believe the person would not object.
4. Who we share data with
We do not sell your data. We share it only as far as necessary with:
- Google, if you choose to sign in with Google (Google shares your name, email and photo with us);
- Paynet (our online payment processor) and the banks involved in the transaction;
- courier services delivering your order (name, phone, address);
- IT service providers: website hosting, email delivery (Brevo, Sendinblue SAS, France, EU) and, where used, chat and analytics tools, under contracts requiring them to protect the data;
- public authorities, where the law requires it.
Where some providers (for example email, analytics or advertising services) process data outside the Republic of Moldova, we make sure the transfer takes place with the safeguards required by law.
5. How long we keep data
- order data and accounting records: for the period required by accounting and tax law;
- customer account data: while the account is active and up to 2 years after the last activity;
- reminder and offer subscriptions: until you withdraw consent;
- B2B requests that did not become orders: up to 2 years;
- correspondence and complaints: up to 3 years after resolution;
- cookies: as set out in the Cookie policy.
6. Your rights
You have the right to:
- find out whether we process your data and get a copy of it (access);
- have inaccurate data corrected (rectification);
- have your data erased when we no longer have a legal basis to keep it;
- restrict processing;
- receive your data in a structured format and transfer it to another controller (portability);
- object to processing based on our legitimate interest and, at any time, to direct marketing;
- withdraw consent at any time, without affecting processing carried out before;
- lodge a complaint with the National Center for Personal Data Protection (datepersonale.md).
To exercise your rights, email contact@giftbox.md. We reply within one month and may ask for extra information to confirm your identity.
7. How we protect data
The site uses an encrypted connection (HTTPS). Payments take place on Paynet’s secure page, and we never see or store card details. Access to data is limited by role to staff who need it, and we use strong passwords and two-factor authentication for internal systems. If a security incident could affect your rights, we notify the supervisory authority and, where the law requires, you.
8. Minors
The site is not intended for people under 18 and we do not knowingly collect their data, except for a gift recipient’s name provided by an adult.
9. Changes
We may update this policy. The current version is always published on this page, with the date of the latest update.