This policy explains what personal data we collect when you use www.storys.md, why we collect it, who we pass it to, and what you can ask of us. It is written under Law no. 195/2024 on the protection of personal data, in force since 23 August 2026.
1. Who processes your data
The controller is Azamet Plus SRL, IDNO 1015611001109, registered at str. Bugeacului 23, Ceadir-Lunga, Moldova, with its office at str. Bulevardul Dacia 58/25, Chisinau, Moldova.
For anything to do with your data, write to office@storys.md or call +373 78 22 00 88. We answer every request, even when the answer is a reasoned refusal.
2. What we collect, why, and for how long
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Taking, preparing and delivering your order | Your name and phone number — the only required fields. Optional: surname and email address. For delivery: city, street and house number, and optionally flat, entrance, floor and intercom. The contents of the order, the payment method, the time you asked for, and any comment you write. | Performance of the contract — art. 6(1)(b) | For as long as the order is being fulfilled, then for the period accounting and tax law requires us to keep the commercial record. |
| Booking a table | Name, phone, email, date, time, number of guests, room, and any note you add. | Performance of the contract — art. 6(1)(b) for the reservation itself; our legitimate interest in recognising a returning guest — art. 6(1)(f) — for keeping it afterwards. You can object to the second at any time. | For as long as the booking and the customer relationship need it. If you only ever book and never order, we clear the record after 5 years. |
| Considering a job application | Name, phone, email, and whatever you include in your CV. | Pre-contractual steps at your request — art. 6(1)(b) | Until recruitment for that position is finished. We delete the file permanently on request. |
| Card payment | Your IP address and browser type are passed to the bank at the moment of payment, to prevent fraud. You enter your card details directly on the bank's page and they never reach us. | Performance of the contract — art. 6(1)(b) | We do not keep card details, and we do not store your IP address. |
| Keeping your basket between visits | A random basket identifier, the items you added, and — if you started filling in the form — your phone and email. | Performance of the contract — art. 6(1)(b) | 90 days from the last activity, after which the basket is deleted automatically. |
| Measuring how the site is used | A random visit identifier, the country, region and city inferred from your connection, device type, browser, operating system, the pages you opened and where you came from. | Your consent — art. 6(1)(a) | 90 days, after which the data is deleted automatically every night. |
| Advertising and remarketing | Google's and Meta's cookie identifiers, the IP address they see, and the page you opened. | Your consent — art. 6(1)(a) | Per Google's and Meta's own policies. You can withdraw consent at any time. |
| Marketing messages by email or SMS | Name, email, phone number and order history, used to decide who to send a message to. | Your consent — art. 6(1)(a) | Until you withdraw consent. Every message carries an unsubscribe link. |
| Fraud prevention and site security | Technical signals about your browser and device, checked when you submit an order, a booking or a job application. | Our legitimate interest in preventing automated ordering and abuse — art. 6(1)(f) | As long as the check requires. |
| Recording your cookie choices | A random identifier for your browser, the categories you accepted, the policy version, the language, and the page you chose on. | Our legal obligation to be able to demonstrate consent — art. 7(1) | While the consent is in effect and for a reasonable period afterwards, as evidence. |
3. What we do not collect
We do not ask for your IDNP, ID card or passport number — there is no field for it. We do not keep your bank card number. We do not store your IP address in our databases: from your connection we keep only country, region and city.
Please do not write health information, serious allergies, or details about other people into the free-text fields — the order comment, the booking note. If you need to tell us something like that, call us: it is safer and faster.
4. Who we share data with
| Recipient | What they receive | Where |
|---|---|---|
| Our own staff | Order or booking details, strictly in order to fulfil it. | Republic of Moldova |
| Couriers and transport partners | Name, phone and delivery address. | Republic of Moldova |
| BC "Moldova Agroindbank" S.A. (MAIB) | What is needed to process a card payment, including IP address and browser. | Republic of Moldova |
| sms.md | Phone number and the text of the message. | Republic of Moldova |
| Supabase Inc. | Hosts our database, and therefore all of the data described above. | European Union (Frankfurt) |
| Vercel Inc. | Hosts the website and receives your browser's requests. | The code that takes your order runs in Frankfurt (European Union), next to the database. The company itself is American, and the service's technical logs are kept in the United States. |
| Plus Five Five, Inc. (Resend) | Your email address and the content of the messages we send you. | Messages are sent from Ireland (European Union), but the stored copy — content and delivery logs — is in the United States of America. |
| Google LLC | Only if you accepted the "Analytics" category: cookie identifiers, IP address, and the pages you opened. | United States of America |
| Meta Platforms, Inc. | Only if you accepted the "Marketing" category: cookie identifiers, IP address, and the pages you opened. | United States of America |
We do not sell your data and we do not pass it to anyone for their own marketing. We may disclose it to public authorities where the law requires us to.
Meta — a special role. If you accepted the “Marketing” category, the Meta Pixel collects data on this site and transmits it to Meta Platforms Ireland Limited. For that step — collection on our site and transmission to Meta — we and Meta Ireland are joint controllers within the meaning of art. 26 of Law no. 195/2024. Responsibilities are allocated as follows: we are responsible for obtaining your consent before the pixel loads and for the information set out in this policy; Meta is responsible for everything it does with the data once it receives it — advertising, measurement, its own products — and for your rights under arts. 15–20 in respect of that processing. You may exercise your rights against either of us, regardless of this allocation. If you refuse the “Marketing” category, the pixel does not load at all and nothing is transmitted.
5. Transfers outside the Republic of Moldova
Our database and the code that takes your order are in the European Union. Some of the providers listed above also process data in the United States. For Vercel, Supabase and Resend those transfers rely on the standard contractual clauses provided for in art. 46(2)(c) of Law no. 195/2024; for Google, on its data processing terms, which incorporate the same clauses. In Meta's case the transfer from Ireland to the United States is made by Meta itself, under its own safeguards including the EU–US Data Privacy Framework. You can ask for details by writing to office@storys.md.
Transfers to Google and Meta happen only if you accepted the matching cookie category. If you refuse, those services do not load at all.
6. Your rights
You hold the following rights against us, set out in arts. 13–22 of Law no. 195/2024:
- Access — to find out what data we hold about you and to receive a copy.
- Rectification — to correct inaccurate data or complete it.
- Erasure — to have data deleted where we no longer have a legal reason to keep it.
- Restriction of processing — to have us pause processing while we check an objection.
- Objection — to object to processing based on our legitimate interest. Two things run on that basis. Traffic measurement — it stores nothing on your device and does not identify you; switch it off wherever you open the cookie settings, under "Traffic measurement". And keeping your details after a table booking, so we can recognise you if you come back; to object to that one, write or call us using the contacts above and we will erase the record.
- Objection to direct marketing — at any time and without giving a reason. We stop immediately.
- Portability — to receive the data you gave us in a structured, machine-readable format.
- Withdrawal of consent — at any time, as easily as you gave it. Withdrawal does not affect processing carried out before it.
Write to office@storys.md. We answer within one month of receiving your request. If the request is complex the deadline may be extended by up to two further months, but we will tell you about the extension and its reasons within the first month. Our answer is free of charge. To avoid handing your data to someone else, we may ask you to confirm your identity.
If you are not satisfied with our answer, you have the right to lodge a complaint with the supervisory authority or to go to court:
National Centre for Personal Data Protection — str. Serghei Lazo 48, MD-2004, Chișinău. Tel. +373 22 820 801, centru@datepersonale.md, datepersonale.md.
7. Cookies
We use strictly necessary cookies without asking, because the site does not work without them, and analytics and marketing cookies only with your consent. The full list, with each one's lifetime, is in the Cookie Policy. You can change your choice at any time from the "Cookie settings" control in the footer of every page.
8. Automated decisions and profiling
When you submit an order, a booking or a job application, an automated service checks whether the request comes from a person or from a program. Occasionally a genuine request is refused by mistake. If that happens to you, call us on +373 78 22 00 88 — we will take the order by hand and review the decision. You have the right to human intervention, to state your point of view, and to contest the decision.
If you accepted marketing messages, we choose who to send one to based on order history — for example how many orders you have placed and when the last one was. This selection has no legal effect on you and does not change the price you pay. You can object at any time.
9. Children
The site is not directed at children under 14. Under art. 8 of Law no. 195/2024, consent for information society services is valid from the age of 14; below that age a legal representative must consent. If you are a parent or legal representative and believe a child under 14 has given us data, write to office@storys.md and we will delete it.
10. Security
Staff access to customer data is limited by role, and actions on that data are logged. The connection to the site is encrypted. We keep database backups. No system is perfect: if an incident occurs that could affect your rights, we notify the National Centre for Personal Data Protection within 72 hours and tell you directly where the risk is high.
11. Changes to this policy
We may update this policy when the way we work changes. The date of the last update is shown at the top of the page. If a change concerns cookies or the purposes you consented to, we ask for your consent again before applying it.