Privacy Policy

This Privacy Policy (the “Policy”) explains how S.R.L. LOGISPHARM (the “Company”, “we”, “us” or “our”), as the operator/controller of the Vitapharm online store available at vitapharm.md (the “Website”), collects, uses, stores, discloses and otherwise processes personal data.

We are committed to protecting the privacy and personal data of our customers, Website visitors and other individuals whose personal data we process. We process personal data in accordance with the applicable legislation of the Republic of Moldova, including Law No. 195/2024 on Personal Data Protection, as well as other applicable legislation.

Where processing is based on your consent, we will request that consent separately where required by law.

1. Data Controller

The data controller responsible for processing your personal data is:

S.R.L. LOGISPHARM
IDNO: 1026611000498
Registered office: 61 Gavrilov Street, Comrat Municipality, Republic of Moldova
Office and Consultation Center: 37 Tighina Street, Chisinau Municipality, Republic of Moldova
E-mail: office@logispharm.md
Tel./Fax: (+373 22) 26-03-88
Mobile: (+373) 79 980 880

For questions concerning this Policy or the processing of your personal data, you may contact us at the e-mail address above.

Where applicable, the contact details of our Data Protection Officer will be published on the Website.

2. Scope of this Policy

This Policy applies to personal data processed in connection with:

• visiting and using the Website;
• browsing products and other Website content;
• placing orders as a registered or guest customer;
• creating and managing a customer account;
• arranging delivery and processing returns;
• communicating with us by e-mail, telephone or online forms;
• receiving commercial communications;
• using cookies and similar technologies; and
• interacting with third-party services through links or features available on the Website.

This Policy does not apply to the processing activities of third-party websites, applications or services that have their own privacy policies.

3. Personal Data We Collect

Depending on how you interact with the Website, we may process the following categories of personal data.

Identification and contact data

This may include:

• first and last name;
• e-mail address;
• telephone number;
• delivery address;
• billing address; and
• other contact information voluntarily provided by you.

Customer account data

Where you create an account, we may process:

• account credentials;
• account settings;
• order history;
• saved delivery or billing information;
• preferences; and
• other information associated with your account.

Order and transaction data

In connection with an order, we may process:

• products ordered;
• order number and date;
• delivery information;
• payment status;
• information concerning returns, refunds and complaints; and
• information required for accounting, tax and other legal purposes.

Online payments may be processed by a third-party payment service provider. Payment-card information may therefore be processed directly by that provider in accordance with its own privacy and security policies.

Technical data

When you use the Website, certain technical information may be collected automatically, including:

• IP address;
• browser type and version;
• operating system;
• device information;
• date and time of access;
• pages visited;
• referring website;
• online identifiers;
• information concerning interactions with the Website; and
• information collected through cookies and similar technologies.

Communications

If you contact us, we may process information contained in your communication, including your name, contact details and the contents of your request, question, complaint or other correspondence.

Special categories of personal data

Vitapharm does not intentionally request health information or other special categories of personal data through the Website unless such processing is necessary and legally permitted.

Because the Company operates in the pharmaceutical and health-related sector, information provided in connection with products or services may, in certain circumstances, reveal information concerning a person's health. Where such information constitutes a special category of personal data under applicable law, it will be processed only where an appropriate legal basis and the additional conditions required by law are satisfied.

Users should not provide health information or other sensitive information through free-text fields unless such information is specifically requested and necessary for the relevant service.

4. How We Collect Personal Data

We may collect personal data:

• directly from you when you create an account;
• when you place an order;
• when you complete an online form;
• when you contact us;
• when you request information or assistance;
• when you subscribe to commercial communications;
• automatically through cookies and similar technologies; or
• from other sources where permitted by applicable law.

You may browse certain areas of the Website without providing personal data. However, certain information is necessary to place an order or use particular Website functionalities.

Where personal data is required for the conclusion or performance of a contract or to comply with a legal obligation, failure to provide the required information may prevent us from providing the relevant service or fulfilling the relevant obligation.

5. Purposes and Legal Bases for Processing

We process personal data only for specified, explicit and legitimate purposes and only to the extent necessary for those purposes.

Depending on the circumstances, processing may be based on:

• your consent, where consent is legally required;
• the performance of a contract with you or taking steps at your request before entering into a contract;
• compliance with a legal obligation applicable to the Company;
• protection of your vital interests or those of another individual, where applicable;
• our legitimate interests or those of a third party, where permitted by law and where those interests are not overridden by your fundamental rights and freedoms; or
• another legal basis permitted by applicable legislation.

Order processing and fulfilment

We process personal data in order to:

• receive and process orders;
• confirm orders;
• communicate with you concerning orders;
• arrange delivery;
• process returns and refunds;
• provide customer support; and
• issue invoices, receipts and other legally required documents.

The relevant legal bases may include performance of a contract and compliance with legal obligations.

Customer accounts

We process account information in order to:

• create and maintain your account;
• authenticate your access;
• provide account functionality;
• display order history; and
• manage account preferences.

Customer service and correspondence

We process personal data to respond to questions, requests, complaints and other communications and to maintain appropriate records concerning such communications.

The relevant legal basis may include performance of a contract, taking steps at your request before entering into a contract, our legitimate interests, or compliance with legal obligations, depending on the circumstances.

Legal, accounting and regulatory obligations

We may process personal data where necessary to comply with applicable tax, accounting, consumer-protection, pharmaceutical, regulatory and other legal obligations.

Website security and administration

We may process technical information to:

• maintain and operate the Website;
• detect and prevent unauthorized access;
• protect the security and integrity of our systems;
• investigate security incidents;
• prevent fraud and abuse; and
• establish, exercise or defend legal claims.

Such processing may be based on our legitimate interests or a legal obligation, as applicable.

Website analytics and improvement

Where permitted by law and, where required, with your consent, we may use analytics technologies to understand how visitors use the Website and to improve its structure, content, functionality and performance.

Marketing communications

Where required by law, promotional e-mails, SMS messages or other marketing communications will be sent only where you have provided the necessary consent or where another legally permitted basis applies.

You may withdraw your consent or unsubscribe from marketing communications at any time by using the unsubscribe mechanism included in the relevant communication or by contacting us at office@logispharm.md.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Transactional communications necessary to process an order or provide a requested service are not considered promotional communications merely because they are sent electronically.

6. Recipients and Service Providers

To operate the Website and provide our services, we may disclose personal data to recipients or categories of recipients where this is necessary and legally permitted.

Depending on the circumstances, these may include:

• courier and delivery service providers;
• payment service providers;
• hosting and infrastructure providers;
• IT and technical support providers;
• accounting and financial service providers;
• e-mail and communications providers;
• analytics and Website-performance providers;
• marketing service providers, where applicable;
• professional advisers, including legal and accounting advisers; and
• public authorities or other entities where disclosure is required or permitted by law.

Delivery services

For the purpose of fulfilling orders, we may provide the courier service provider with the personal data necessary to arrange and complete delivery.

Our courier service provider includes FAN TRANSPORTATION SRL, operating under the FAN Courier brand in the Republic of Moldova. Depending on the delivery method, this may include your name, telephone number, delivery address, e-mail address, shipment reference and other information necessary for delivery.

FAN Courier's published data-processing policy confirms that it processes recipient information including name, address, telephone number, e-mail address and shipment/AWB information in connection with courier services.

FAN TRANSPORTATION SRL is responsible for its own processing activities in accordance with applicable law and its own privacy policy.

7. International Transfers of Personal Data

Where personal data is transferred or made accessible to recipients outside the Republic of Moldova, we will take the measures required by applicable law to ensure an appropriate level of protection.

Depending on the circumstances, such measures may include an adequacy decision, appropriate safeguards, contractual safeguards or another legally permitted transfer mechanism.

Where required by law, information concerning the relevant transfer and applicable safeguards will be made available to you.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.

Different categories of personal data may therefore be retained for different periods.

Retention periods are determined taking into account:

• the purpose for which the data was collected;
• the nature and sensitivity of the data;
• contractual obligations;
• applicable accounting, tax, consumer-protection and other legal requirements;
• applicable limitation periods; and
• the need to establish, exercise or defend legal claims.

In particular:

• Order and transaction data may be retained for the period required to fulfil contractual, accounting, tax, consumer-protection and other applicable legal obligations.
• Delivery information may be retained for as long as necessary to arrange and document delivery, handle returns, complaints or disputes, and comply with applicable legal obligations.
• Customer-account data may be retained while the account remains active and, where necessary, for an appropriate period after account closure.
• Correspondence and customer-support records may be retained for as long as reasonably necessary to resolve the relevant matter and, where appropriate, for legal or evidentiary purposes.
• Marketing consent records may be retained for as long as necessary to demonstrate compliance with applicable requirements and manage marketing preferences.
• Technical, analytics and cookie information is retained in accordance with the applicable technology, cookie settings and legal requirements.

When personal data is no longer necessary and there is no legal or legitimate reason to retain it, it will be securely deleted, anonymized or otherwise disposed of in accordance with applicable requirements.

We therefore do not apply a single fixed retention period, such as 24 months, to all personal data.

9. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against:

• unauthorized or unlawful processing;
• accidental loss;
• destruction;
• alteration;
• unauthorized disclosure; and
• unauthorized access.

These measures may include access controls, authentication mechanisms, restricted access to personal data, security monitoring, secure infrastructure and other appropriate safeguards.

No method of electronic transmission or storage can be guaranteed to be completely secure. Nevertheless, we take appropriate measures to reduce the risks associated with the processing of personal data.

10. Automated Decision-Making and Profiling

We do not currently use personal data for decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects concerning you.

If this changes, we will provide the information required by applicable law concerning the existence of such processing, the logic involved, and its significance and envisaged consequences for you, together with information concerning your applicable rights.

11. Your Rights

Subject to the conditions and limitations established by applicable law, you may have the following rights:

• Right to information — to receive clear information about how your personal data is processed;
• Right of access — to obtain confirmation as to whether your personal data is being processed and, where applicable, access to that data and relevant information concerning its processing;
• Right to rectification — to request correction of inaccurate or incomplete personal data;
• Right to erasure — to request deletion of your personal data where the legal conditions are met;
• Right to restriction of processing — to request restriction of processing in circumstances provided by law;
• Right to data portability — where applicable, to receive certain personal data in a structured, commonly used and machine-readable format or request its transmission to another controller;
• Right to object — to object to certain processing activities where the conditions established by law are met, including direct marketing;
• Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time; and
• Right to lodge a complaint — to lodge a complaint with the National Centre for Personal Data Protection of the Republic of Moldova.

The exercise of a particular right may be subject to legal conditions and exceptions.

12. Exercising Your Rights

To exercise your rights or ask questions concerning the processing of your personal data, please contact:

E-mail: office@logispharm.md

We may request information necessary to verify your identity before responding to a request.

We will process your request within the period required by applicable law.

You also have the right to lodge a complaint with the National Centre for Personal Data Protection of the Republic of Moldova (NCPDP) if you consider that your rights have been infringed.

NCPDP contact details:
48 Serghei Lazo Street, Chisinau, Republic of Moldova
Tel.: +373 22 820 801
E-mail: centru@datepersonale.md
Website: datepersonale.md

13. Children's Data

The Website is not intended to knowingly collect personal data directly from children except where such processing is permitted by applicable law and is necessary for the relevant service.

Where applicable legislation requires parental or legal-representative consent for the processing of a child's personal data, we will take the measures required by law.

14. Personal Data Breaches

In the event of a personal data breach, we will assess the incident and take the measures required by applicable law, including notification to the competent supervisory authority and/or affected individuals where such notification is legally required.

15. Third-Party Websites and Services

The Website may contain links, buttons or other features connected to third-party websites or services, including social media platforms.

When you interact with such services, your personal data may be processed by the relevant third party under its own privacy policy.

We do not control the privacy practices of third-party websites or services and recommend reviewing their respective privacy policies.

16. Changes to this Policy

We may update this Policy from time to time to reflect:

• changes in applicable legislation;
• changes to our services or business activities;
• changes to the Website;
• changes to technologies used by the Website;
• changes to service providers; or
• changes to our personal-data processing practices.

The updated version will be published on this page together with the relevant “Last updated” date.

Where required by law, we will provide additional notice or obtain renewed consent before implementing material changes affecting your rights or the purposes or legal bases of processing.

17. Contact

For questions concerning this Policy, the processing of your personal data, or the exercise of your rights, please contact:

S.R.L. LOGISPHARM
IDNO: 1026611000498
Registered office: 61 Gavrilov Street, Comrat Municipality, Republic of Moldova
Office and Consultation Center: 37 Tighina Street, Chisinau Municipality, Republic of Moldova
E-mail: office@logispharm.md
Tel./Fax: (+373 22) 26-03-88
Mobile: (+373) 79 980 880