Privacy Policy

Who we are. This website, guest.md, presents the services of Guest — Personal Concierge & Lifestyle Management (the "Operator", "we", "us"). The Operator determines the purposes and means of processing personal data collected through this site. Legal identity of the Operator: GUEST S.R.L., IDNO 1026023028828, registered address MD-2068, mun. Chișinău, sect. Rîșcani, str. Alecu Russo 7/1, ap. 23. For any question regarding your personal data or this policy, write to us at [email protected].

What data we collect and how. The main channel through which we collect personal data is the contact form on this website. When you submit it, we receive the data you enter yourself: your name, your contact detail (email address and/or phone number) and the text of your message. We also process a limited set of technical data required for the site to work: strictly necessary cookies (remembering your choice in the cookie banner) and the log of these decisions on our server (see "Cookie decision log" below) and data handled by the anti-spam service Turnstile (Cloudflare), which verifies that the form is submitted by a person and not by an automated bot. Only if you accept analytics in the cookie banner do we also collect aggregated data about visits through Google Analytics and data on how the pages are used through Microsoft Clarity (see "Cookies" below). We do not use advertising trackers on this site.

Purposes and legal grounds. We process your data solely to receive your enquiry and reply to it — that is, to handle you as a lead and provide the information or service you asked about. The legal grounds are, under Law no. 195/2024 of the Republic of Moldova and art. 6 of Regulation (EU) 2016/679 (GDPR): your consent, given when you tick the consent box and submit the contact form; and our legitimate interest in responding to enquiries addressed to us and in protecting the form against abuse and spam. We switch on visit analytics (Google Analytics and Microsoft Clarity) only on the basis of your consent (art. 6(1)(a) GDPR) given in the cookie banner; refusing does not limit your access to the site in any way, and you can withdraw consent at any time. We do not use your data for automated decision-making or profiling.

Cookies. Cookies are small files that a website stores in your browser. We use two categories. Necessary cookies are always set: the site and the contact form do not work without them, so they do not require consent. Analytics cookies are set only after you consent in the banner; until then, no Google or Microsoft scripts are loaded on the page at all.

Necessary cookies. guest_cookie_consent — your choice in the cookie banner, the identifier of that decision in the log and the edition of this policy it was given for; kept for 1 year. Cloudflare Turnstile — checks that the contact form is submitted by a person; it runs in Cloudflare's own verification frame and uses Cloudflare's technical data for the duration of the check.

Analytics cookies (only with your consent). _ga and _ga_FBF1B1855N — Google Analytics 4 (Google Ireland Limited), loaded through Google Tag Manager. They tell visits apart so that aggregated statistics can be counted: pages viewed, country and city, device and browser type, and how you reached the site. Kept for up to 2 years. Google Analytics does not store IP addresses; Google Signals and links to Google's advertising services are not enabled, and the site sets no advertising cookies.

Microsoft Clarity (only with your consent). Clarity is a Microsoft service that shows how visitors use the pages: it builds click and scroll maps (heatmaps) and records sessions — pointer movements, clicks, scrolling and moves between pages. The content of input fields is masked: what you type into the form does not reach Clarity. Clarity loads only after you accept analytics in the banner; we do not pass it consent to advertising storage, so Clarity data is not used for advertising. Cookies on guest.md: _clck — the Clarity visitor identifier, kept for 1 year; _clsk — groups page views into one session, kept for 1 day. On Microsoft's domains (clarity.ms, bing.com) Microsoft may set: MUID — a browser identifier, about 13 months; CLID — a Clarity identifier, 1 year; and the service cookies MR, SM, ANONCHK and SRM_B.

How to refuse and change your mind. In the banner shown on your first visit, "Accept all" and "Only necessary" carry equal weight, and leaving the page without choosing is not consent. You can change or withdraw your choice at any time via the "Cookie settings" link at the bottom of every page: on withdrawal, the analytics cookies on guest.md (Google Analytics and Microsoft Clarity) are deleted, Clarity is told that consent has been withdrawn, and the page reloads. The site cannot delete cookies on Microsoft's domains — you can do that in your browser settings. You can also delete or block cookies in your browser settings; if you block necessary cookies, the banner will keep reappearing.

Cookie decision log. Every decision you make in the banner — consent, refusal or a change of choice — is recorded on our server so that we can prove, if needed, that consent was given (art. 7(1) GDPR). A record contains: a random decision identifier (also stored in the guest_cookie_consent cookie), the categories chosen, the edition of this policy, the date and time, the site language, your IP address with the last octet set to zero (for IPv6, only the network prefix) and your browser details (user agent). The log is kept for 3 years, after which the records are deleted; it is not used for any other purpose.

How long we keep your data. We keep the data submitted through the contact form only for as long as needed to achieve the purpose for which it was collected — to process and answer your enquiry and to maintain the resulting correspondence — and no longer than is reasonable for that purpose. If your enquiry does not lead to a working relationship, we delete or anonymise the data once the exchange is closed. Visit data in Google Analytics is kept for 14 months and then deleted automatically. In Microsoft Clarity, session recordings are kept for 30 days, and click data and heatmaps for 9 months. If you withdraw your consent, we stop the processing based on it and remove the corresponding data, unless we are required to keep it by law.

Sharing and international transfers. We do not sell your personal data and we do not share it with third parties for their own purposes. To operate the anti-spam protection of the contact form we use Cloudflare, Inc. as a processor for the Turnstile service; in this context limited technical data may be processed on infrastructure located outside the Republic of Moldova and outside the European Union, under safeguards provided by that processor. If you accept analytics, visit data is processed by Google Ireland Limited as our processor; it may be transferred to Google LLC in the United States on the basis of the European Commission's adequacy decision (EU–US Data Privacy Framework) and standard contractual clauses. Microsoft Clarity data is received by Microsoft Ireland Operations Ltd. and Microsoft Corporation; it may be transferred to the United States on the same basis — the EU–US Data Privacy Framework and standard contractual clauses. Apart from these cases, and except where disclosure is required by law or by a competent authority, your data stays with us.

Your rights. Under Law no. 195/2024 and the GDPR you have the right to access your data, to rectify inaccurate data, to erasure (the "right to be forgotten"), to restriction of and objection to processing, to data portability, and to withdraw your consent at any time (without affecting the lawfulness of processing carried out before withdrawal). To exercise any of these rights, write to us at [email protected] and we will respond within the legal time limits. You also have the right to lodge a complaint with the National Centre for Personal Data Protection (CNPDCP), mun. Chișinău, str. Serghei Lazo 48, MD-2004, web: cnpdcp.md; if you are in the European Union, you may also contact the supervisory authority of your country of residence.

Security. All data exchanged with this website is transmitted over an encrypted HTTPS/TLS connection. We apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or loss, and we limit access to your data to what is necessary to answer your enquiry.

Changes to this policy. We may update this Privacy Policy to reflect changes in our practices or in the applicable legislation. The current version and its effective date are always published on this page. This edition of the policy is effective from 25.10.2026 (the previous one from 02.10.2026). When the rules on cookies change, the banner asks for your consent again. We encourage you to review it from time to time; for any clarification you can always reach us at [email protected].