1. Who we are and how to contact us

The controller of personal data processed through the autohub.md website and AUTOHUB services is TOP IMPORT CARS SRL, [IDNO TOP IMPORT CARS SRL], registered address: [Registered address TOP IMPORT CARS SRL] (hereinafter “AUTOHUB”, “we”). TOP IMPORT CARS SRL provides car rental, car sales and import, and sells spare parts, accessories and car care products.

For car wash and detailing services the controller is Auto Hub Detail SRL, [IDNO Auto Hub Detail SRL], [Registered address Auto Hub Detail SRL]. For car repair and maintenance services the controller is DAS RV SRL, [IDNO DAS RV SRL], [Registered address DAS RV SRL]. The three companies belong to the AUTOHUB group, use a common customer management system and act as joint controllers for the data of shared customers; their responsibilities are allocated by an internal agreement, and the single point of contact for you is the one indicated below.

Office and point of contact: 88 Uzinelor St., MD-2023, Chișinău, Republic of Moldova. Phone: +373 79 75-22-22. E-mail for personal data matters: [email protected]. Requests concerning personal data are handled by the person responsible for data protection appointed within AUTOHUB, who can be reached at the same e-mail address with the subject “Personal data”.

2. What this policy applies to

The policy applies to all natural persons whose data we process: visitors of autohub.md (including its Romanian, Russian and English versions), registered users, online shop customers, customers of the car rental service, the workshop and the car wash, persons who contact us through forms, by phone, chat, messengers or AI assistants, and subscribers to our marketing communications.

The website terms of use, the delivery terms and the return terms are separate documents published in the “Documents” section of the website. In case of conflict regarding data processing, this policy prevails.

The terms “personal data”, “processing”, “controller”, “processor” and “data subject” have the meaning defined by Law No. 195/2024 and Regulation (EU) 2016/679.

3. What data we collect

We collect only the data needed for the purpose for which we ask for it. Depending on the service used, this may include:

— Website account: e-mail address, password (stored only in encrypted, irreversible form), name, favourites and comparison lists, order and request history.

— Online shop: name, phone, delivery address (locality, street, house, apartment, entrance, floor), recipient name and phone, order comment, chosen payment method and payment status. Bank card details are entered only on the pages of the payment provider (Bpay/MIA, PayPal); they do not reach us and are not stored by us.

— Car rental: first and last name, date of birth, phone, e-mail, pick-up and return place and address, comment, chosen extras (child seat, unlimited mileage, CASCO insurance, etc.), promo code; at hand-over of the car: identity document and driving licence details, photos of the car at hand-over and return, mileage and fuel level, the signed contract and hand-over report, including electronically signed; during the rental: the car's GPS telematics data (see section 6).

— Contact forms and requests: name, phone, e-mail, message text, VIN or description of the car for spare parts, import or vehicle history report requests.

— Vehicle history reports (VIN): VIN number, buyer's phone and e-mail, payment data.

— Website chat, phone and messengers: name and phone (if you provide them), content of conversations and messages, recordings and transcripts of phone calls (see sections 7 and 8).

— Bookings through AI assistants: the data you gave the assistant for the booking — first and last name, date of birth, phone, e-mail, rental dates and places, comment (see section 8).

— Marketing: e-mail, phone, date of birth (for greetings), communication preferences, participation in the referral programme and bonus balance.

— Reviews: displayed name, review text and rating.

— Technical data: IP address, device and browser type, language, pages visited, referral source, cookie identifiers and website usage events (see section 9).

We do not ask for and do not intentionally process special categories of data (health, beliefs, ethnic origin, etc.). If you disclose them on your own initiative, for example in a comment, we process them only to the extent needed to answer your request.

4. Where the data comes from

Most data we receive directly from you: when you create an account, place an order or booking, fill in forms, chat with us, call us or write in messengers.

Some data we receive from third parties: from AI assistants (ChatGPT, Claude and others) if you book a car through them; from classifieds and messaging platforms (999.md, WhatsApp, Telegram) if you write to us there; from payment providers (payment confirmation); from partners who refer customers (hotels, agents) under the promo code programme.

Technical data is collected automatically by the website and analytics tools under the conditions described in section 9.

5. Purposes and legal bases of processing

We process data only for specified purposes and on the bases provided by law (Article 6 of Regulation (EU) 2016/679 and the corresponding provisions of Law No. 195/2024):

— Concluding and performing contracts: processing orders, bookings and rental contracts, providing repair and car wash services, delivery, invoicing, communication about the order. Basis: performance of a contract or steps at your request before entering into it.

— Legal obligations: accounting and tax records, issuing payment documents, keeping contracts, responding to requests of public authorities. Basis: legal obligation.

— Protection of rental cars and our property: GPS telematics during the rental, photos at hand-over and return, document checks, handling the deposit and damage cases. Basis: performance of the contract and our legitimate interest in protecting property and resolving disputes.

— Customer communication: answering requests, consulting, support, recording and transcribing calls, keeping the communication history. Basis: pre-contractual steps, performance of the contract and our legitimate interest in ensuring service quality.

— Website operation and security: login, fraud and abuse prevention, protection against attacks, technical logs. Basis: legitimate interest.

— Website usage analysis and service improvement: traffic statistics, feature testing. Basis: your consent for non-essential cookies and our legitimate interest for aggregated statistics.

— Marketing: sending offers, news and greetings by SMS, e-mail or browser notifications, the referral programme. Basis: your consent, which you can withdraw at any time.

— Publishing reviews: displaying the review with the name you provided. Basis: consent.

Where we rely on legitimate interest, we have assessed in advance that it does not override your rights and interests; you have the right to object to such processing (section 16).

6. Car rental: documents, electronic signature and GPS telematics

To conclude a rental contract we ask for the identity document and driving licence of the driver (and of the additional driver). The details are entered in the contract and copies are kept for the duration of the contract and the limitation period for possible claims, because the law and insurers may require them in case of an accident, offence or dispute.

The contract and the hand-over report can be signed electronically via a personal link sent to your phone or e-mail. We record the date, time and IP address from which the signature was applied in order to prove the conclusion of the contract.

Our rental cars are equipped with GPS telematics devices (the Wialon system). During the rental the device transmits the car's location, route, speed and operating parameters (harsh acceleration and braking, engine start). We use this data to: protect the car and locate it in case of theft, establish the circumstances of an accident or damage, verify compliance with the contract terms (driving area, mileage limit, aggressive driving), and calculate the cost correctly at return. We do not use telematics data for marketing and do not share it with third parties, except insurers, law enforcement authorities upon a lawful request and the telematics provider, which processes it on our behalf.

The security deposit and payment are recorded in our accounting; we do not store bank card details.

If law enforcement authorities or insurers are involved in an accident or offence, we provide them with the necessary data from the contract and the telematics within the limits set by law.

7. Recording of phone calls and correspondence

Calls to AUTOHUB phone numbers and our calls to you may be recorded and automatically transcribed into text. You are informed about the recording before the conversation starts; continuing the conversation means you have taken note of it. If you do not want to be recorded, you can write to us by e-mail or in the chat.

We use recordings and transcripts for: service quality control, resolving disagreements about orders and bookings, staff training and keeping the customer communication history in our records system (CRM). Basis: our legitimate interest in ensuring service quality and proving what was agreed; recordings are stored with restricted access.

Correspondence by e-mail, chat, WhatsApp, Telegram, 999.md and other channels is kept together with the customer history for the same purposes. Messengers and platforms also process data under their own privacy policies.

8. Website chat and AI assistants

The chat on autohub.md is served in the first line by an automated assistant based on the Claude artificial intelligence model by Anthropic. Your messages, name and phone (if provided) are sent to this provider to generate the reply; the provider acts as our processor, does not use the data to train its models and processes it on servers in the European Union or the USA under the safeguards described in section 13. When needed, an employee takes over the conversation. The chat history is stored in our system.

You can also search for and book a rental car through third-party AI assistants (for example ChatGPT or Claude) connected to our technical interface for assistants (an MCP server). In that case the assistant is an independent controller for your conversation with it under its own privacy policy; we receive from it only the data needed for the booking (first and last name, date of birth, phone, e-mail, rental dates and places, comment) and process it like any other booking. A booking made through an assistant is a request that an employee confirms by phone.

Assistants do not make decisions with legal effect on you: availability, price and conditions are determined by our system, and the final confirmation is given by an employee.

9. Cookies and similar technologies

The website uses cookies (small files saved by the browser) and similar technologies (localStorage, pixels, analytics scripts). Strictly necessary cookies always work; analytics and marketing cookies are enabled only with your consent given through the cookie banner or your browser settings.

Strictly necessary cookies (first-party): login session (token) — keeping you signed in — until sign-out, at most 30 days; interface language (i18n_redirected) — 1 year; selected currency — 1 year; localStorage: favourites, comparisons, cart, form drafts — until you delete them.

Security and performance — Cloudflare, Inc.: __cf_bm (30 minutes), cf_clearance (up to 1 year) — protection against attacks and bots, content delivery; Cloudflare Web Analytics uses no cookies and does not identify a person.

Analytics — Google Tag Manager and Google Analytics (Google Ireland Ltd.): _ga (2 years), _ga_* (2 years), _gid (24 hours) — traffic and website usage statistics. The IP address is truncated. Enabled only with consent.

Analytics — Yandex Metrica (Yandex LLC): _ym_uid (1 year), _ym_d (1 year), _ym_isad (2 days), _ym_visorc (30 minutes) — statistics and session recording. The data is processed on Yandex servers outside the Republic of Moldova and the European Union; the tool is enabled only with your explicit consent and can be disabled at any time.

Chat — Jivo widget (JivoSite), if enabled: jv_* (up to 1 year) — chat session identification.

Browser notifications (web push): sent only if you allowed them in your browser; you can disable them in the browser settings.

You can delete or block cookies in your browser settings; blocking strictly necessary cookies may affect the operation of the website. To disable Google analytics you can also use the Google Analytics Opt-out extension. Your cookie consent can be changed at any time via the cookie banner on the website.

10. Marketing and commercial communications

We send offers, news, birthday greetings and information about promotions by SMS (via the SMS.md service), e-mail, browser notifications or messengers only if you have given your consent: when creating an account, placing an order or through a separate subscription.

You can unsubscribe at any time: via the link in the e-mail, by replying to the SMS, in your account settings or by writing to [email protected]. Unsubscribing does not affect service messages (order confirmation, booking status, documents), which are part of the performance of the contract.

Referral programme and promo codes: if you take part, we process the data needed to calculate and pay bonuses (name, account, history of referred orders). The partner who referred you learns only that their code was used and the bonus amount, not your data.

We do not sell your data and do not share it with third parties for their marketing.

11. Reviews and public content

Reviews left on the website or on partner platforms (Google, Facebook) are public: the name you provided, the text and the rating are displayed. Publication is based on your consent; you can request the modification or deletion of your review at any time at [email protected].

Photos and videos taken on our premises with customers are published only with their consent.

12. Who we share data with

We share data only to the extent necessary for the purpose and only with the following categories of recipients:

— Processors (providers that process data on our behalf under a contract): the server hosting provider (Hetzner Online GmbH, Germany), Cloudflare (security and CDN), Google (analytics, service e-mail), Anthropic (chat assistant), the telephony provider and transcription services, the GPS telematics provider (Wialon), the SMS.md service, IT service and website maintenance providers.

— Independent recipients: insurance companies (in case of damage), banks and payment providers (Bpay/MIA, PayPal), courier services (for order delivery), vehicle history report providers (Carfax, AutoCheck, NMVTIS, European registries — they receive only the VIN), notaries and lawyers (in case of disputes), auditors.

— Public authorities: law enforcement, tax authorities, courts and other authorities — when the law obliges us or when necessary to defend our rights.

— AUTOHUB group companies (TOP IMPORT CARS SRL, Auto Hub Detail SRL, DAS RV SRL) — within the common customer management system, to provide the requested service.

— Third-party platforms and AI assistants: only the data you provide to them directly (see sections 8 and 22).

13. Transfers of data outside the Republic of Moldova

Our main servers are located in the European Union (Germany). Some of our providers process data in other countries: Cloudflare, Google, Anthropic and PayPal — in the European Union and the United States of America; VIN report providers — in the USA and the EU; Yandex — in the Russian Federation.

Transfers are made in compliance with the chapter on transfers of Law No. 195/2024 and Articles 44–49 of Regulation (EU) 2016/679: to countries ensuring an adequate level of protection (EU member states and countries recognised by adequacy decisions, including the USA for companies certified under the EU-U.S. Data Privacy Framework), on the basis of standard contractual clauses approved by the European Commission and concluded with the providers, or, in their absence, on the basis of your explicit consent (for example, for Yandex Metrica, which is enabled only through the cookie banner) or the necessity of performing the contract.

You can request information about the safeguards applied to a particular transfer at [email protected].

14. How long we keep data

We keep data for as long as necessary for the purpose for which it was collected, then delete or anonymise it. Main periods:

— Rental contracts, orders, invoices and accounting documents: for the period set by the accounting and tax legislation of the Republic of Moldova (as a rule, at least 5 years after the end of the financial year); copies of identity documents and driving licences — for the duration of the contract and the general limitation period (3 years) after the car is returned.

— GPS telematics data of a rental: 12 months after the car is returned; in case of an accident, damage or dispute — until its final resolution.

— Call recordings and transcripts, chat and messenger history: 12 months; in case of a dispute — until it is resolved.

— Requests and forms without a contract: 24 months after the last interaction.

— Website account: until you delete the account or after 3 years of inactivity with prior notice; data required for accounting is kept for the statutory periods.

— Marketing consent and related data: until consent is withdrawn, after which only the record of the withdrawal is kept.

— Technical data and server logs: up to 12 months; cookies — for the periods indicated in section 9.

— Backups: overwritten cyclically within 90 days at most.

15. How we protect data

We apply technical and organisational measures appropriate to the risk: encrypted HTTPS connections, encryption of passwords and access keys, employee access to data strictly by role and only to the extent required by their duties, two-factor authentication for internal systems, logging of actions on data, backups stored in the European Union, regular system updates, protection against attacks via Cloudflare, confidentiality agreements with employees and providers, staff training.

In the event of a data security breach likely to result in a risk to your rights, we will notify the National Center for Personal Data Protection within the period set by law and, where the risk is high, we will also inform you.

16. Your rights

Under Law No. 195/2024 and Articles 15–22 of Regulation (EU) 2016/679 you have the following rights:

— Right of access: to learn whether we process your data and to receive a copy of it together with information about the processing.

— Right to rectification: to correct inaccurate data or complete it.

— Right to erasure (“right to be forgotten”): to request deletion of data when it is no longer needed, you have withdrawn consent, you have objected to processing or the data was processed unlawfully — except where the law obliges us to keep it.

— Right to restriction of processing: to request that processing be “frozen” while the accuracy of the data is verified or your objection is examined.

— Right to data portability: to receive the data you provided in a structured, commonly used and machine-readable format, or to have us transmit it to another controller, where processing is based on consent or a contract.

— Right to object: to object to processing based on legitimate interest on grounds relating to your particular situation, and, at any time and without giving reasons, to processing for direct marketing.

— Right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects you.

— Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, write to [email protected] or to the postal address in section 1. To protect your data we may ask you to confirm your identity (for example, by replying from the e-mail or phone linked to your account). We respond within one month of receiving the request; in complex cases the period may be extended by up to two further months, and we will inform you. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

17. Withdrawing consent and unsubscribing

Marketing consent can be withdrawn via the unsubscribe link in the e-mail, by replying to the SMS, in your account settings or by a message to [email protected]. Consent to analytics and marketing cookies can be withdrawn via the cookie banner or your browser settings. Browser notifications are disabled in the browser settings.

Withdrawal of consent takes effect for the future and does not affect processing carried out before.

18. Where to lodge a complaint

If you believe we process your data in breach of the law, please write to us first at [email protected] — we will examine your complaint as a priority.

You have the right to lodge a complaint with the supervisory authority: the National Center for Personal Data Protection of the Republic of Moldova (CNPDCP), MD-2004, Chișinău, 48 Serghei Lazo St.; phone (022) 820 801; e-mail [email protected]; www.datepersonale.md.

If you live in the European Union, you can also lodge a complaint with the data protection authority of your country of residence and bring an action before a court.

19. Children and minors

Our services are intended for persons aged 18 and over; car rental is available to drivers aged at least 21 who have held a licence for at least 3 years. We do not knowingly collect children's data. If we learn that we have received a minor's data without the consent of a legal representative, we delete it. Parents or legal representatives can contact us at [email protected].

20. Automated decisions and profiling

We do not make decisions based solely on automated processing that would produce legal effects on you or similarly significantly affect you. The system automatically calculates the price and availability according to the published rates, and AI assistants may suggest options, but confirming a booking, approving an order or refusing it is decided by an employee.

We use automated tools to prevent fraud and abuse (for example, limiting the number of requests from the same IP address). Website usage statistics are aggregated and are not aimed at building individual profiles for marketing without your consent.

21. Integrations with third-party platforms used by our staff (Meta, Google/YouTube, TikTok)

To publish our own materials (car photos and videos, news) on the official AUTOHUB pages on Facebook, Instagram, YouTube, TikTok and Telegram, our internal system connects to the company's accounts through the platforms' official interfaces (Meta Graph API, YouTube Data API, TikTok Content Posting API, Telegram Bot API). In this process only the company's account data and the access keys of the administrator employees who authorised the connection are processed: account/page/channel identifier and name, profile image, access tokens and publication statistics. We do not collect, store or use data of other users of these platforms.

Use of YouTube API Services: through this integration we use YouTube API Services. The employee connecting the channel accepts the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google's processing of data is described in the Google Privacy Policy (https://www.google.com/policies/privacy). Data obtained through the YouTube API (channel information and access tokens) is stored only while the connection is active and is used exclusively to upload our own videos and read their status. The access granted to our application can be revoked at any time on the Google account security page: https://security.google.com/settings/security/permissions. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Meta (Facebook, Instagram) and TikTok: access tokens of the company's pages and accounts are stored encrypted, are used only to publish company content and read statistics of our own posts, and can be revoked in the settings of the respective account (Facebook: Settings → Apps and Websites; TikTok: Settings → Security → Connected apps). We do not process data of platform users who interact with our posts beyond what the platform displays publicly.

Data processed in this way is not sold, is not used for personalised advertising and is not shared with third parties other than the platforms concerned.

22. Links to third-party websites and social networks

The website may contain links to third-party websites and services (payment providers, maps, social networks, partners). These websites have their own privacy policies, for which we are not responsible.

Our pages on Facebook, Instagram, YouTube, TikTok and Telegram are hosted by the respective platforms; when you interact with them, the data is processed by the platform under its policy, and we see only what the platform makes available to the page administrator (aggregated statistics, messages and comments addressed to us).

23. Changes to this policy

We may update this policy when our services, providers or the legislation change. The current version, with its effective date, is permanently published at https://autohub.md/docs/privacy. We will inform you about significant changes through the website or by e-mail if we have your address. Continued use of the services after the changes take effect means you have taken note of the new version; where the law requires consent, we will ask for it separately.

24. Contact

TOP IMPORT CARS SRL (AUTOHUB), 88 Uzinelor St., MD-2023, Chișinău, Republic of Moldova. Phone: +373 79 75-22-22. E-mail: [email protected] (subject “Personal data” for requests about your rights). Website: https://autohub.md.

This policy is available in Romanian, Russian and English. In case of discrepancies, the Romanian version prevails.