Privacy policy
This policy explains which personal data we process, why, on what basis, for how long and what rights you have — under Law no. 195/2024 on personal data protection (in force from 23 August 2026), which transposes Regulation (EU) 2016/679.
1. Who processes the data (the controller)
BROKER DE ASIGURARE - REASIGURARE CMR IDEAL BROKER S.R.L. (trading as Expres Asig), IDNO 1021600040802, registered office MD-2012, Chișinău, 12 Tighina St., insurance broker licensed by CNPF no. 000949 of 17.02.2022, listed in the Register of insurance (reinsurance) brokers of the National Bank of Moldova.
Data protection contact: date@expresasig.md, +373 69 567 969, or in writing at the address above. We are not required to appoint a data protection officer (art. 37); your requests are handled by the company's administrator.
2. What data we process and where it comes from
| Situation | Data | Source |
|---|---|---|
| Quote in the calculator | No personal data: vehicle parameters, locality, age/experience bands, declared bonus-malus class. The calculation runs in your browser; nothing is sent to us until you order. | — |
| Policy order | Name, phone, e-mail, plate number (optional), notes, quote parameters, language, page. | From you |
| Policy issue (after the order) | IDNP/IDNO, ID card or driving licence number, vehicle registration certificate data, claims history (bonus-malus class). | From you and from the NBM RCA Data system, under Law 106/2022 |
| Offer request (home, business) | Name, phone, e-mail, company name and IDNO, description of the property or activity. | From you |
| Messages, complaints, rights requests | Name, e-mail, phone, message content, policy number. | From you |
| Visiting the site | Server logs: IP address (truncated after 30 days), page requested, time, browser type. Your cookie choice, in your browser. | Automatically |
We do not process special categories of data (art. 9) through the site. We take no decisions based solely on automated processing and build no profiles (art. 22): the calculator applies public tariffs and every order is checked by a person.
3. Why we process data and on what basis (art. 6)
| Purpose | Legal basis |
|---|---|
| Preparing the offer and issuing the ordered policy | art. 6 (1) b) — performance of a contract and pre-contractual steps at your request |
| Intermediation with insurers; RCA Data check | art. 6 (1) b) and c) — contract and obligations under Law 106/2022 on RCA insurance and Law 92/2022 on insurance activity |
| Replying to messages and offer requests | art. 6 (1) b) and f) — at your request; legitimate interest in replying |
| Handling complaints and rights requests | art. 6 (1) c) — legal obligations (Law 195/2024, petitions and insurance legislation) |
| Keeping contractual and accounting documents | art. 6 (1) c) — Accounting Law 287/2017, insurance legislation |
| Site security (logs, rate limiting) | art. 6 (1) f) — legitimate interest in preventing abuse |
| Anonymous traffic statistics | art. 6 (1) a) — only with your consent from the cookie banner; no statistics tool is currently used |
We send no unsolicited commercial communications. Should we ever want to send you offers, we will ask for separate consent, which you can withdraw at any time (art. 7 (3)).
4. Who receives the data (recipients)
- The insurers with whom we intermediate the policy — independent controllers for the data in the insurance contract;
- The National Bank of Moldova / the RCA Data system — for registering RCA and Green Card policies and checking claims history, as required by law;
- The hosting provider of the site and e-mail — processor (art. 28), under contract, server in the European Union;
- Authorities (CNPF, NBM, CNPDCP, courts) — where the law obliges us.
We do not sell or rent data. The site loads no third-party scripts, fonts or images (Google, Facebook etc.): the font is self-hosted and the map is a link, not an embedded frame.
5. Transfers outside the Republic of Moldova
Data is stored on servers in the Republic of Moldova and in the European Union. The EU ensures an adequate level of protection (Regulation (EU) 2016/679, transposed by Law 195/2024). We transfer no data to other states without the safeguards of art. 46–49 and without informing you.
6. How long we keep data (art. 5 (1) e))
| Data | Period |
|---|---|
| Orders and offer requests not concluded with a policy | 12 months from receipt, then deletion |
| Issued policies and related documents | Contract term + 5 years (statutory limitation and archiving period under insurance and accounting law) |
| Contact form messages | 12 months |
| Complaints and rights requests | 3 years after the case is closed (proof of compliance) |
| Server logs | 30 days |
| Cookie choice | In your browser until you delete it, or 12 months |
7. Your rights (art. 15–22)
You have the right of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent and the right not to be subject to an automated decision. Exercise them free of charge on the Your rights page, by e-mail to date@expresasig.md or in writing at our office. We reply within one month (art. 12 (3)); for complex requests the deadline may be extended by two months, with notice. To avoid handing your data to someone else, we may ask you to confirm your identity (art. 12 (6)).
You have the right to lodge a complaint with the National Centre for Personal Data Protection (CNPDCP), 48 Serghei Lazo St., Chișinău, datepersonale.md, and to go to court.
8. Is providing data mandatory?
For a quote you need no account and we ask for no data. For an order, name, phone and e-mail are necessary so we can contact you and issue the policy; without them we cannot intermediate the insurance. Identification data (IDNP, ID card, registration certificate) is required by law to issue an RCA/Green Card policy (Law 106/2022).
9. Security (art. 32)
The site is served exclusively over HTTPS. Form data is stored outside the public area of the server, with restricted access, and transmitted by internal mail. We apply rate limiting, access logging and encrypted backups. In the event of an incident affecting your rights we inform you without delay and notify CNPDCP within 72 hours (art. 33–34).
10. Cookies
The site sets no tracking cookies. Details in the Cookie policy.
11. Changes
We update this policy when processing or legislation changes. The version in force is the one on this page; material changes are announced on the site at least 15 days in advance.