Last updated: 25.09.2026 · Version 2.1
The confidentiality of your personal data is one of the main concerns of ARLENGO SRL, as data controller.
This document is intended to inform you about the processing of your personal data in the context of your use of the tandem.md website (hereinafter „the Site”), in accordance with the provisions of Law No. 195 of 25 July 2024 on personal data protection (Legea nr. 195/2024), in force from 23 August 2026 (hereinafter „Law 195/2024”).
Field
Value
Name
ARLENGO SRL
IDNO
1011600034004
VAT code
0405407
Administrator
Antonina Baturinskaia
Registered office
mun. Chișinău, str. Nicolae Milescu Spătarul 8/5, MD-2044
Showroom address
mun. Chișinău, str. Petricani, 15/1
Phone
+373 79 057 770
Website
https://tandem.md
As the controller, ARLENGO SRL determines the purposes and means of the processing of data and is responsible for the processing it carries out, in accordance with the applicable legislation. Independent controllers are responsible for the processing they carry out on their own behalf (section 6.2).
For any question related to the processing of your personal data, or to exercise the rights provided by Law 195/2024, you can contact us by:
· Email: [email protected], with the reference „Personal data” in the subject line.
· Phone: +373 79 057 770.
· Postal address: ARLENGO SRL, str. Nicolae Milescu Spătarul 8/5, MD-2044, Chișinău.
We will respond to your request within a maximum of 30 calendar days from receipt, under the terms of Art. 12 of Law 195/2024. In the case of complex requests, this period may be extended by up to two months, with prior notice to you.
Depending on the type of interaction with the Site, we may process the following categories of data:
· First and last name.
· Email address.
· Phone number.
· Delivery address / furniture installation address.
· Ordered products, quantity, specifications (dimensions, colours, materials).
· Order value, payment method.
· Order history.
· Special requests (measurements, custom design).
· Design preferences, indicative budget.
· Photographs of the space voluntarily provided by you for design purposes.
· Showroom appointments.
· IP address.
· Device type, operating system, browser.
· Date and time of visits to the Site.
· Pages visited, time spent, source of the visit.
· Cookie identifiers (see the Cookie Policy).
· Record of your cookie choice (the consent log): a random identifier (the tandem_consent_id cookie), the choice made (all accepted, all rejected or a custom choice) and the options for each category, the version of the Cookie Policy, the source of the choice (the cookie banner, the “Cookie settings” panel or the dedicated Microsoft Clarity window), the language, the region, the page of the Site on which you made the choice, and the date and time — without the IP address.
If you allow the “Session recordings (Microsoft Clarity)” category, the following data is also collected through Microsoft Clarity:
· Data about your interaction with the Site: clicks, scrolling, mouse movements and screen taps, as well as the content of the pages as we display it to you — the content of form fields is always hidden and is not transmitted, and other personal data displayed on the page is masked.
· The addresses of the pages visited and the page you came from (referrer).
· Device data: device type, browser, operating system, screen size.
· Approximate location, determined on the basis of the IP address — the IP address is processed by Microsoft.
· The Microsoft Clarity user identifier (the _clck cookie) and the Microsoft identifiers stored in cookies on the clarity.ms and bing.com domains (for example, MUID).
· The names of certain actions on the Site — for example, starting or submitting a form, the steps of a price calculator, pressing a contact button — and general information: the language and type of the page, the product category, the package chosen in the calculator and the indicative range of the calculated value or of the area — without the content of form fields.
Microsoft Clarity recordings are not anonymous: they are linked to the Clarity identifier of your browser and to the approximate location, which is why we treat them as personal data.
Analytics and marketing cookie identifiers, as well as Microsoft Clarity data, are collected only after you give your consent in the cookie banner — for all categories, via “Accept all”, or for each category individually, via “Settings”. Microsoft Clarity data is collected only if you have allowed the “Session recordings (Microsoft Clarity)” category, which is separate from the “Analytics” category (Google Analytics). Details in section 13 and in the Cookie Policy.
· Consent to receive commercial communications.
· Interactions with the emails sent (open rate, click rate) — via the MailChimp service.
We do not process, through the Site, special categories of data (health data, racial/ethnic origin, political opinions, religious beliefs, genetic or biometric data).
In accordance with Art. 6 of Law 195/2024, processing is carried out on the following bases:
Purpose of processing
Legal basis
Data categories
Order intake and execution, delivery, installation
Performance of the contract (Art. 6(1)(b))
4.1, 4.2, 4.3
Issuing invoices, accounting records
Legal obligation — Tax Code, Accounting and Financial Reporting Law No. 287/2017
4.1, 4.2
Warranty and after-sales service
Legal obligation — Law No. 105/2003 on consumer protection
4.1, 4.2
Response to quote requests, consultancy, showroom appointments
Pre-contractual measures (Art. 6(1)(b))
4.1, 4.3
Sending commercial communications (newsletter, offers, news)
Consent (Art. 6(1)(a))
4.1, 4.5
Statistical analysis of traffic, improvement of the Site (Google Analytics 4)
Consent (Art. 6(1)(a)) — the “Analytics” category in the cookie banner
4.4
Analysis of how the Site is used through click maps and session recordings (Microsoft Clarity)
Consent (Art. 6(1)(a)) — the “Session recordings (Microsoft Clarity)” category; transfer of data to the USA — explicit consent (Art. 49(1)(a)); sharing with Microsoft Advertising — only if you have also accepted the “Marketing” category
4.4
Online advertising and campaign measurement (marketing cookies)
Consent (Art. 6(1)(a)) — the “Marketing” category
4.4
Proof of consent for cookies (the consent log)
Legal obligation — Art. 6(1)(c) in conjunction with Art. 7(1) of Law 195/2024 (the controller must be able to demonstrate consent)
4.4
Security of the Site, fraud prevention
Legitimate interest of the controller
4.4
Defence of rights in court, handling of complaints
Legitimate interest of the controller
4.1, 4.2
Communication with public authorities at their request
Legal obligation
All
Withdrawal of consent: where the basis for processing is consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal is done by email to [email protected] or via the unsubscribe link in each newsletter communication. For cookies — including session recording through Microsoft Clarity — consent can be withdrawn at any time from the “Cookie settings” panel, opened from the cookie icon in the bottom-left corner of the screen (section 13.3).
Your data may be communicated to the following categories of recipients, exclusively for the purposes mentioned above and only to the extent strictly necessary:
· Hosting service provider (website server).
· The Rocket Science Group LLC d/b/a MailChimp (United States of America) — for sending the newsletter to subscribers who have given their consent.
· Google Ireland Limited — for statistical traffic analysis (Google Analytics).
· Courier and transport companies for furniture delivery.
· Furniture assembly and installation companies (subcontractors).
· Providers of accounting services.
· Providers of legal services (in case of litigation).
With each processor we have concluded a data processing agreement (DPA) in accordance with Art. 28 of Law 195/2024, guaranteeing an adequate level of protection.
For Microsoft Clarity — the click map and session recording service we use on tandem.md — Microsoft is not our processor but an independent controller, in accordance with the Microsoft Clarity Terms of Use. That is why it is not listed in section 6.1, and there is no data processing agreement (DPA) with Microsoft for this service. Specifically:
· on Microsoft's side, the controller is Microsoft Corporation (One Microsoft Way, Redmond, Washington 98052, United States of America), including for visitors from the Republic of Moldova; only for persons located in the European Economic Area, the United Kingdom and Switzerland is the controller Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), in accordance with the Microsoft Privacy Statement;
· ARLENGO SRL decides to integrate Microsoft Clarity into the Site and, in doing so, to collect the data described in section 4.4 from your device and transmit it to Microsoft. We are responsible for this stage — including informing you and obtaining your consent;
· Microsoft is the controller for the processing it subsequently carries out on its own behalf and may use the data in accordance with its Privacy Statement (privacy.microsoft.com/privacystatement), including to improve its services and to create user profiles for purposes that include advertising;
· Microsoft may also collect or receive data through Clarity in order to provide Microsoft Advertising, Microsoft's advertising service; Clarity data is shared with Microsoft Advertising only if you have also accepted the “Marketing” category;
· the content of form fields is not transmitted to Microsoft, and other personal data displayed on the page is masked in the browser before transmission;
· the data is transferred to the United States of America, to Microsoft Corporation, only on the basis of your explicit consent (section 7); the retention periods are set out in section 8.
For the processing carried out by Microsoft on its own behalf, you can also exercise your rights directly with Microsoft, through the channels indicated in its Privacy Statement. For the collection and transmission stage on tandem.md, you can contact us at [email protected]. You can withdraw your consent at any time (section 13.3).
State Tax Service, courts, criminal investigation bodies, the National Centre for Personal Data Protection (CNPDCP), upon their request under the law.
The processors listed in section 6.1 process your data only on our behalf; Microsoft, as an independent controller, may also use it for its own purposes described in section 6.2 — only if you have allowed session recording.
The Site and the data collected through it are hosted primarily on servers located in Romania (a member state of the European Union and of the European Economic Area); transfers to states of the European Economic Area take place without any special authorisation (Art. 44(2) of Law 195/2024). Some services we use also involve the transfer of your data outside the Republic of Moldova:
· Google Analytics (Google Ireland Limited, with possible transfer to the United States of America) — for traffic analysis on the Site.
· MailChimp (The Rocket Science Group LLC, United States of America) — for sending the newsletter.
· Microsoft Clarity (Microsoft Corporation, United States of America) — for click maps and session recordings, only with your explicit consent (section 6.2); for persons located in the European Economic Area, the United Kingdom and Switzerland, the data is received by Microsoft Ireland Operations Limited, which may transfer it to Microsoft Corporation.
For the United States of America there is no decision of the National Centre for Personal Data Protection (CNPDCP) on the adequacy of the level of protection: the USA is not listed in CNPDCP Decision No. 41 of 20.08.2026. Transfers to the USA take place:
· on the basis of standard data protection clauses adopted by the European Commission or approved by the CNPDCP (Art. 46(2)(c) of Law 195/2024), where these have been concluded with the provider, together with additional technical and organisational measures (pseudonymisation, encryption);
· for Microsoft Clarity — only on the basis of your explicit consent, given after you have been informed of the risks (Art. 49(1)(a) of Law 195/2024), as described below.
Microsoft Clarity: for this service, no standard data protection clauses have been concluded between ARLENGO SRL and Microsoft, and Microsoft Corporation receives the data as an independent controller (section 6.2). Consent to the “Session recordings (Microsoft Clarity)” category — given via “Accept all”, via the switch for this category in the “Cookie settings” panel or via the “Allow” button in the dedicated window — is also your explicit consent to the transfer of data to the USA. The risks: US authorities may have access to the data under conditions different from those provided for by the legislation of the Republic of Moldova, and exercising your rights in relation to Microsoft Corporation may be more difficult. Microsoft Corporation is certified under the EU-US Data Privacy Framework, but this framework concerns transfers from the European Union and does not constitute a basis for transfers from the Republic of Moldova. You can withdraw your consent at any time (section 13.3); withdrawal does not affect transfers made before the withdrawal.
You may request a copy of the safeguards applied by writing to [email protected].
We store your data only for as long as necessary for the purposes of the processing:
Category
Retention period
Data relating to the order, contract, delivery
For the duration of the contract + 3 years (general limitation period, Art. 267 Civil Code)
Accounting documents (invoices, primary records)
Minimum 6 years from the end of the fiscal period (Art. 188 Tax Code, Art. 17 Accounting Law No. 287/2017)
Warranty data
For the duration of the legal warranty + 3 years
Contact data for newsletter
Until consent is withdrawn or 3 years from the last interaction (after which it is automatically deleted)
Unfinished quote requests
12 months from the last interaction
Analytical cookies (Google Analytics)
26 months (Google Analytics default setting)
Microsoft Clarity data (session recordings, click maps)
At Microsoft: session recordings — 30 days; click maps and click data, sessions marked by our team (tagged or saved as favourites) and a random sample of recordings — up to 9 months. Clarity cookies set by the Site: _clck — 365 days, _clsk — 1 day, _cltk (sessionStorage) — until the tab is closed; Microsoft cookies on the clarity.ms and bing.com domains — from a few minutes to approximately 13 months (details in the Cookie Policy). For the processing it carries out on its own behalf, Microsoft may retain the data in accordance with its own Privacy Statement.
Cookie consent log
Up to 3 years (36 months) from the date of the choice — the maximum period within which a complaint may be lodged with the CNPDCP (Art. 72(2) of Law 195/2024); after this period, the records are deleted automatically
Site security logs
12 months
Data for legal defence
For the duration of the proceedings + 3 years
Upon expiry of these terms, data is securely deleted or anonymised.
In accordance with Law 195/2024, you have the following rights:
9.1. Right of access — to obtain confirmation that we process your data and a copy thereof.
9.2. Right to rectification — to request correction of inaccurate data or completion of incomplete data.
9.3. Right to erasure („right to be forgotten”) — to request the erasure of data, under the conditions provided by law (e.g. when data is no longer necessary for the purpose or when you withdraw consent).
9.4. Right to restriction of processing — to request the limitation of processing in the cases provided by law (e.g. during verification of data accuracy).
9.5. Right to data portability — to receive your data in a structured, commonly used, machine-readable format, or to request their transmission directly to another controller.
9.6. Right to object — to object at any time to processing based on legitimate interest, including direct marketing.
9.7. Right not to be subject to an automated decision, including profiling, which produces legal effects or significantly affects you.
9.8. Right to withdraw consent at any time, for processing based on consent. For cookies and session recording (Microsoft Clarity), consent is withdrawn from the “Cookie settings” panel (section 13.3).
9.9. Right to lodge a complaint with the supervisory authority: National Centre for Personal Data Protection (CNPDCP).
· Address: MD-2004, mun. Chișinău, str. Serghei Lazo 48.
· Phone: (022) 820 801.
· Email: [email protected]
· Web: datepersonale.md
How to exercise your rights: send a request to [email protected] (with the reference „Personal data” in the subject line) or by post to the registered office. We will respond within 30 calendar days. The service is free of charge; for manifestly unfounded or excessive requests, we reserve the right to charge a reasonable fee or to refuse the request.
We do not address ourselves directly to persons under the age of 14. In accordance with Art. 8 of Law 195/2024, the processing of data of minors under 14 years of age is carried out exclusively with the consent of the legal representative.
If we find that we have collected data from a minor under 14 without parental/guardian consent, we will delete such data without delay.
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or destruction:
· SSL/TLS encryption for all communications with the Site.
· Role-based access control for employees.
· Regular backups.
· Periodic staff training.
· Confidentiality agreements (NDA) with employees and collaborators.
In the case of a security incident that may affect your data, we will notify the CNPDCP within 72 hours of becoming aware of it and, if the incident presents a high risk to your rights, we will inform you directly.
The Site uses cookies and similar technologies. Details on the types of cookies, purposes, duration and consent management arrangements are described in the Cookie Usage Policy.
On your first visit to the Site, all non-essential cookies — analytics, marketing, functional and session recording (Microsoft Clarity) cookies — are disabled. They are activated only after you press “Accept all” in the cookie banner or after you allow them individually via “Settings”. The “Session recordings (Microsoft Clarity)” switch is never switched on in advance, and Microsoft Clarity does not load at all until you allow this category. Consent to this category also includes your explicit consent to the transfer of data to the USA (section 7).
If, before Microsoft Clarity was introduced, you accepted at least one category of non-essential cookies, we ask you separately, through a small dedicated window, whether you allow session recording (“Allow” / “Don't allow”). Your answer concerns Microsoft Clarity only — your previous choices for the other categories remain unchanged; if you previously accepted the “Marketing” category, after “Allow” Microsoft Clarity may also transmit data to Microsoft Advertising (section 6.2). If you rejected all non-essential cookies at that time, we do not ask you again: recording stays off and you can turn it on at any time from “Cookie settings”. Consent to session recording is valid for 9 months; after this period we ask you again.
· Strictly necessary: session cookies and the cookies that store your cookie choice (tandem_consent, tandem_consent_prefs, tandem_consent_id and tandem_consent_rec — the latter stores your decision on session recording and its date) — used without consent, as they are strictly necessary to provide the service you have requested, under Art. 116(6) of Electronic Communications Law No. 72/2025 (Legea comunicațiilor electronice nr. 72/2025);
· Analytics: Google Analytics 4 (G-9WN6S1VLCM) — used only after consent;
· Marketing: online advertising and campaign measurement — used only after consent. If you have also allowed session recording, consent to marketing additionally allows Microsoft Clarity to share data with Microsoft Advertising (section 6.2);
· Functional: embedded content from third-party providers (Google Maps and videos) — used only after consent; disabling them may limit the display of this content;
· Session recordings (Microsoft Clarity): click maps (heatmaps) and session recordings — a category separate from the analytics category (Google Analytics), with its own switch, off by default; used only after your separate consent, which also covers the transfer of data to the USA, to Microsoft Corporation, on the basis of your explicit consent (section 7). The cookie names and their durations are set out in the Cookie Policy.
You can change your choices at any time from the “Cookie settings” panel, which you open with the round button with the cookie icon in the bottom-left corner of the screen (“Cookie settings”) or, while the cookie banner is displayed, with the “Settings” button in the banner. Changes do not affect data collected before — they apply only from then on.
To stop session recording: open the “Cookie settings” panel (the round button with the cookie icon in the bottom-left corner of the screen), switch off “Session recordings (Microsoft Clarity)” and press “Save choices” (or “Reject all”). The page reloads, recording stops, and the Clarity cookies set by the Site (_clck, _clsk) and the _cltk session identifier are deleted. Cookies set by Microsoft on its own domains (clarity.ms, bing.com) cannot be deleted by the Site — you can delete them in your browser settings. Data already transmitted to Microsoft remains subject to the periods set out in section 8.
We use Microsoft Clarity click maps and session recordings only to see how the Site is used and to improve it — we do not use them to evaluate you as a person, and we do not take automated decisions based on them that produce legal effects concerning you or similarly significantly affect you (section 9.7). Microsoft, as an independent controller, may, under its own responsibility, create user profiles for purposes that include advertising, in accordance with its Privacy Statement; Clarity data is shared with Microsoft Advertising only if you have also accepted the “Marketing” category (section 6.2). This processing takes place exclusively after your consent and can be stopped at any time (section 13.3); for data already received by Microsoft, you can also contact Microsoft directly.
We reserve the right to update this policy. Any modification will be published on the Site with an indication of the date of the last update. In the case of substantial changes, we will notify you by email or through a visible notice on the Site.
Where a change introduces new consent-based processing (for example, a new service that uses cookies), it does not apply to you until you give a new and separate consent, through the cookie banner or a dedicated window; if you do not give your consent, the new processing does not take place, and your previous choices for the other categories remain valid.
The previous version of this policy (2.0, of 23.08.2026) is available on request at [email protected].
What changed in version 2.1 (25.09.2026): we added Microsoft Clarity (click maps and session recordings) — a new cookie category, active only with your separate consent; Microsoft as an independent controller; the transfer of Microsoft Clarity data to the USA on the basis of your explicit consent, and the bases for transfers to the USA; hosting of the Site on servers in Romania; traffic analysis with Google Analytics — only with your consent; retention periods; profiling by Microsoft; the consent log; how we ask for your consent to new processing (sections 2, 4.4, 5, 6, 7, 8, 9.8, 13 and 14).
In case of any discrepancy between the Romanian version of this policy and its translations, the Romanian version prevails.
For any question related to the processing of your personal data:
· Email: [email protected] (with the reference „Personal data”).
· Phone: +373 79 057 770.
· Postal address: ARLENGO SRL, str. Nicolae Milescu Spătarul 8/5, MD-2044, Chișinău.
· Supervisory authority: CNPDCP, datepersonale.md