Privacy Policy

This Policy applies to backstage.md and explains the processing of personal data of visitors and people who contact Backstage about services or collaboration.

The Policy was prepared with regard to Moldova's Law No. 195/2024 on personal data protection, effective from 23 August 2026. The law establishes principles of lawfulness, transparency, data minimisation, storage limitation, accuracy, integrity and confidentiality.

The personal data controller is Backstage Media SRL, operating under the Backstage / Backstage Media brand and determining the purposes and means of processing data through this website.

The state identification number and other registration details of Backstage Media SRL are not yet available in the project. If publication is required, they will be added after confirmation by the website owner.

Depending on the form, you may provide your first name, last name, phone number, email address, company name, message, website address and selected service. Where a form includes a separate consent field, its value is recorded.

The submission also records the language and submitting page, date and enquiry ID, any available UTM parameters – source, medium, campaign, content and term – and the referrer, meaning the referring page address without its query string. Technical information is also stored to prevent duplicate processing and track notification delivery.

For spam protection and rate limiting, the backend uses an HMAC identifier based on the IP address and date. The full IP address is not stored in the enquiry record. This does not exclude processing of the IP address in the hosting provider’s server logs.

If you contact us directly by phone or email, Backstage may receive the contact details and message content you voluntarily provide through that channel.

The website does not request special categories of data, including health information, political or religious views, biometric, genetic or other sensitive data. Please do not include such information in your enquiry.

The website forms are connected to a server-side handler. After submission, the data is validated on the server and saved in private storage outside the website’s public directory. An enquiry is considered accepted only after it has been saved.

A background worker then sends notifications about the new enquiry to leads@backstage.md and to a closed Telegram group for authorised Backstage staff. The notifications contain the enquiry details and any available information about the visit source. Email and Telegram are staff notification channels; acceptance on the website does not mean both notifications have already been delivered.

If a user voluntarily provides data through a website form, by email or by phone, it may be used to respond to the enquiry, clarify requirements, prepare a proposal, select a team and communicate before a possible contract is concluded.

Depending on the circumstances, the basis may be consent under Article 6(1)(a) of Law No. 195/2024 or steps requested by the user before entering a contract under Article 6(1)(b). Where the law requires certain information to be retained, compliance with a legal obligation may be the basis.

By submitting the form, the user confirms that they have read the Privacy Policy. This acknowledgement is recorded separately and does not constitute consent to promotional messages, marketing or optional tracking.

The site has a consent management panel. Strictly necessary features remain available; optional categories are disabled until you choose. Google Analytics 4, Google Tag Manager, Google Ads, Meta Pixel, TikTok Pixel and Bitrix24 are not currently connected. Contact details from forms are not stored in localStorage or sessionStorage.

Only with Marketing allowed do we store UTM parameters and the visit source without the query string in sessionStorage for the session and send them with your enquiry. Withdrawal clears this data from the current tab and stops collection. It does not erase data already sent with an enquiry; contact contact@backstage.md about deletion.

Your choice is stored locally in your browser as backstage.consent.production (or backstage.consent.test for testing) for 180 days: categories, choice time, expiry and settings version. This record respects your decision and is not used for tracking. Clearing browser storage, expiry or a new settings version triggers a new request. If storage is unavailable, the choice lasts only until reload.

Functional consent allows Google Maps, YouTube and the Google Partner badge to load. No requests to these embedded services are sent before consent. When loaded, Google receives your IP address and technical browser data and may use its own storage technologies. Disabling the category removes embedded content from the page. We cannot erase data or cookies already stored on Google domains; manage these through your browser and the provider. Ordinary messenger and social links open only when you choose them.

The mention of Google Analytics on the SEO page describes an agency service for clients and does not confirm that Analytics is connected to backstage.md.

Google tag and Meta Pixel identifiers: will be included in this Policy after creation and actual connection. Until then, no values are published or replaced with placeholders.

Once connected, Google tag and Meta Pixel may process technical and behavioural information: IP address, device and browser details, approximate location, URL and visit time, referral source, pages viewed, interactions with website elements, conversion events, cookies and other online identifiers. The exact data depends on tag configuration and must be checked before launch.

Future use will aim to measure traffic and advertising performance, analyse conversions, produce aggregate reports and optimise campaigns. Google and Meta may receive data as independent controllers or process certain information on behalf of Backstage, depending on the selected products, settings and contractual terms.

You can accept available optional categories, reject them or save individual choices. Privacy settings in the footer lets you change or withdraw consent at any time. Analytics cannot be enabled until a corresponding service is connected. New providers require an updated policy and a fresh consent request.

Google and Meta may process data outside the Republic of Moldova. Before launch, the relevant provider legal entities, processing locations, safeguards for cross-border transfers, specific cookies and their lifetimes, event retention settings and consent withdrawal methods must be established.

The website is hosted by TopHost.MD. TopHost has directly confirmed that the Backstage hosting account and information stored within it, including the website and private server-side storage, are hosted on TopHost servers in the Republic of Moldova. Email infrastructure for the backstage.md domain and SMTP are provided by TopHost.MD; the provider has confirmed that the hosting account and its information are stored on servers in the Republic of Moldova.

The hosting provider may process IP addresses, request times, URLs and browser information in server logs to operate, maintain and secure its infrastructure. The contents of the logs and the retention periods for logs and backups depend on the service settings and have not yet been separately confirmed.

Access to private storage is restricted to the hosting account owner or administrator and technically authorised persons who need it to maintain the website. Access to leads@backstage.md is limited to the Backstage owner and authorised staff responsible for incoming enquiries. Only authorised Backstage staff who need access to handle enquiries may access the closed Telegram group. Enquiries are not publicly accessible; no separate public CRM or public administration panel is used for them.

TopHost provides hosting, email and SMTP infrastructure. Enquiry data is transmitted through the email infrastructure and the Telegram service to deliver staff notifications. For direct enquiries by email or phone, the providers of the relevant communication channel may also participate in processing.

Telegram remains a separate notification channel and may involve processing data outside the Republic of Moldova. The storage location of data in Telegram infrastructure and the applicable contractual transfer mechanisms have not been separately confirmed. TopHost’s confirmation that hosting account information is stored in the Republic of Moldova does not extend to Telegram. This Policy does not claim that specific data transfer agreements are in place.

Data may be disclosed to public authorities only in response to a binding legal requirement. Backstage must not sell personal data or share it for independent third-party marketing without a separate legal basis.

Once Google tag and Meta Pixel are connected, data or online identifiers may be transmitted to Google and Meta according to the chosen configuration. Before activation, the specific providers, processing locations and applicable transfer safeguards must be determined and this Policy updated.

Personal data is retained for no longer than necessary to handle the enquiry, conduct subsequent business communications and fulfil applicable legal obligations, after which it is deleted or anonymised in accordance with established internal procedures.

Specific retention periods have not yet been approved. Automatic deletion of enquiries from private storage after a retention period is not currently implemented. Copies of an enquiry may remain in email and Telegram; deleting the server record does not itself delete those copies.

The procedure for deleting and archiving copies in each channel requires separate approval. Retention periods for backups and server logs depend on hosting and provider settings and have not yet been separately confirmed. For questions about data retention or deletion, please use the contact details in this Policy.

Law No. 195/2024 requires technical and organisational measures proportionate to risk: access restrictions, confidentiality, system integrity and availability, secure transmission, recovery after incidents and regular assessment of protection effectiveness.

Enquiries are stored outside the website’s public directory with restricted file and directory permissions. The server validates incoming data and request origins, limits submission frequency and prevents duplicate storage of the same enquiry. Access is granted only to authorised persons to the extent needed for their tasks. These measures do not mean that automatic deletion has been implemented or that separate backup deletion procedures have been confirmed.

Where provided by law, people have the right to confirmation of processing and access to data; correction of inaccurate data, deletion or restriction; receipt of data in a portable format; objection to processing; and protection against certain decisions based solely on automated processing.

Where processing is based on consent, it can be withdrawn at any time as easily as it was given. Withdrawal does not make prior processing unlawful. You can submit a request by writing to contact@backstage.md, providing enough information to identify the enquiry. Backstage may request reasonable identity verification without collecting excessive data.

Users may also lodge a complaint with Moldova's National Centre for Personal Data Protection (CNPDCP).

The Policy is reviewed when enquiry handling, processing purposes, providers, retention periods or legislation change, and before Google tag, Meta Pixel, a CRM or new cookies are introduced. Before new integrations are activated, the Policy must reflect their actual configuration, cookies, retention periods, recipients and consent management mechanism. The current version is published on this page with its update date.