Privacy Statement

In this privacy statement, we aim to provide you, in a transparent manner, with information that will give you an overview of the processing of personal data (hereinafter “personal data”) carried out by RESOURCE ALLIANCE S.R.L. (hereinafter “we”, “the company”, “the controller”).

The controller of personal data is RESOURCE ALLIANCE S.R.L., with its registered office at MD-2051, Chișinău municipality, 84 Ion Creangă St., apt. (office) 3.

If you have any questions regarding this document or the way in which we process your personal data, or if you wish to exercise your rights under personal data protection legislation, you can contact us using any of the following methods:

• Email address: [email protected]
• Telephone: +373 69 417 415
• Postal address: MD-2051, Chișinău municipality, 84 Ion Creangă St., apt. (office) 3.

We process your personal data for purposes such as:

• registering and managing the customer account on [www.moonglow.md](https://www.moonglow.md);
• receiving, confirming, processing and delivering orders, as well as managing payments and order-related requests;
• managing the Beautycoin loyalty program, reviews and the referral mechanism;
• granting and communicating promotional benefits, including discount codes for the first order and for birthdays;
• providing customer support and handling requests and complaints;
• sending commercial communications by newsletter, email or SMS, in accordance with the law and the preferences expressed by the customer;
• operating, protecting and improving the website, including traffic analysis and the use of cookies, in accordance with the law;
• complying with legal obligations, including accounting and tax obligations, and managing any disputes.

Personal data will be processed on the basis of one or more legal grounds provided for by the applicable legislation, such as:

• Performance of a contract or taking pre-contractual steps at the customer’s request, for orders and related services;
• Compliance with applicable legal obligations, including accounting and tax obligations;
• The data subject’s consent, where required, for example for certain commercial communications and cookies;
• The legitimate interest of the controller, to the extent permitted by law, for website security, fraud prevention and the establishment, exercise or defence of rights.

In certain situations, we process your personal data on the basis of our legitimate interests or those of third parties, provided that these legitimate interests of ours do not prevail over your fundamental rights and freedoms.

The legitimate interests pursued may include: ensuring the operation and security of the website and customer accounts, preventing abusive or fraudulent access, resolving incidents, handling complaints, as well as establishing, exercising or defending the rights and legitimate interests of the controller.

When assessing the legitimate interest, we analyse the impact of the processing on the rights and freedoms of data subjects and apply appropriate measures to protect them.

Further information on the legitimate interest we rely on and on the outcome of the assessment carried out may be obtained upon request.

Depending on the services used and the information you provide to us, we may directly process the following categories of data: first name and last name, contact details (telephone number and email address), delivery and, where applicable, billing addresses, customer account data and order history, information about the Beautycoin program and promotional benefits, reviews, preferences regarding commercial communications, and date of birth, if provided for birthday benefits.

Where we do not obtain personal data directly from you, we may process categories of personal data such as: transaction confirmations and status information from payment service providers, delivery information from couriers, as well as technical identifiers or information on interaction with the website from analytics tool providers, to the extent that such information is transmitted to the controller.

In all cases, we ensure that we process only personal data that are adequate, relevant and limited to what is necessary for the purposes for which they are used.

We may disclose your personal data only to the extent necessary to fulfil the purposes described in this document entitled “Privacy Statement”.

Depending on the context, personal data may be disclosed to:

• courier and delivery service providers;
• payment service providers and financial institutions, as applicable;
• hosting, maintenance and IT support providers;
• email, SMS or newsletter service providers, to the extent they are used;
• traffic analysis and advertising service providers, where applicable;
• providers of CRM platforms and customer relationship management services, to the extent they are used;
• public authorities, in the cases provided for by law.

In certain situations, your personal data may be transferred to recipients located outside the Republic of Moldova or the European Economic Area, where this is necessary for the provision of our services or for fulfilling the purposes described in this document entitled “Privacy Statement”.

In the event of a transfer, we ensure that a transfer mechanism recognised by personal data protection legislation is applied and that appropriate safeguards are implemented to protect personal data.

We keep your personal data only for the period necessary to fulfil the purposes for which they were collected.

• For data related to orders, payments and tax documents, the retention period is determined by the applicable accounting and tax obligations;
• For customer account data, the retention period is determined by the period of use of the account and by subsequent retention obligations;
• For commercial communications, the retention period is determined by the duration of the subscription or of the consent, as applicable;
• For technical data and cookies, the retention period is determined by the time limits applicable to each technology.

Under the conditions provided by the applicable personal data protection legislation, you have the right to request access to your personal data, rectification or erasure thereof, or restriction of processing, or to object to processing, as well as the right to data portability.

We will review your request and provide you with information in response to it without undue delay and, in any event, within one month of receipt of the request. Where necessary, this period may be extended by two further months, taking into account the complexity and number of requests. If an extension is required, we will inform you within one month of receipt of the request and will communicate the reasons for the delay.

Where the processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You can contact us directly at [email protected] or use the unsubscribe mechanism indicated in the message.

You have the right to lodge a complaint with the National Center for Personal Data Protection (NCPDP) if you consider that the processing of your personal data infringes the provisions of personal data protection legislation.

NCPDP contact details: MD-2004, Chișinău municipality, 48 Serghei Lazo St.
Email address: [email protected]
Telephone number: (022) 820 801

Before contacting the NCPDP, we encourage you to contact us to exercise your rights and to resolve any concerns regarding our processing of personal data.

Where the processing of personal data is necessary for compliance with a legal obligation, for the conclusion or performance of a contract or for the provision of a requested service, failure to provide the mandatory data requested may prevent the establishment or continuation of the relationship with you or the provision of the respective services. Where the provision of certain data is mandatory, we will inform you of this and of the possible negative consequences of not providing them.

Where the provision of data is optional, failure to provide them will not have any negative effects, except for the inability to benefit from certain functionalities, services or specific communications.

We collect personal data directly from you. In certain situations, we may obtain personal data from sources other than the data subject, where this is permitted by law and necessary to fulfil the purposes described in this document entitled “Privacy Statement”.

Such personal data may originate from information provided by payment service providers, courier and delivery services, and digital or analytics service providers used by the controller, to the extent that they transmit data on payments, deliveries or use of the website.

Your personal data are not subject to automated decision-making that produces legal effects concerning you or similarly significantly affects you.

Information about the cookies and other similar technologies we use is provided in our “Cookie Policy”

The provision of certain personal data is either a statutory or contractual requirement or a requirement necessary to enter into and perform a contract.

Failure to provide such data may result in the inability to provide the requested services, to conclude the contract or to fulfil the controller’s legal obligations.

Where certain data are optional, you will be explicitly informed that the provision of such data is not mandatory and that you will not suffer any negative consequences if you choose not to provide them.

We may update this Privacy Statement whenever necessary to reflect legislative, technological or operational changes. The updated version will be published on this page together with the date of the last revision. All versions of this Privacy Statement are available here.