This policy explains what personal data Î.M. „INCASO” SRL (“INCASO”, “we”) processes, why, on what legal basis, how long we keep it, to whom we give it and what rights you have. It applies to persons whose debts we manage or have acquired, to the representatives and contact persons of our clients, to those who write to us or call us, and to visitors to the incaso.md website. We have drawn it up in accordance with Law no. 195/2024 on personal data protection.
1. Who we are
The data controller is Î.M. „INCASO” SRL, IDNO 1009600029036, with its registered office at mun. Chișinău, str. Calea Ieșilor 10B, et. 5, Republic of Moldova. Contact: info@incaso.md, +373 22 89 66 89.
2. The data protection officer
We have designated a data protection officer (DPO): „Privacy by default” SRL. You can write to the DPO directly, with any question about your data, at office@gdpr.md, or by post, to our registered office, marked “For the attention of the data protection officer”.
3. What data we process, why and on what legal basis
3.1. Debt recovery
We manage receivables on behalf of creditors (under our contracts with them) and receivables that we have acquired by assignment. For this purpose we process the data of debtors and, where applicable, of their guarantors, heirs and representatives:
- identification data: surname, first name, patronymic, maiden name, date and place of birth, IDNP, identity document details;
- contact data: home address and other addresses, telephone numbers, e-mail address, language spoken;
- details of the receivable: the contract it arises from, the amount, the due dates, the payments, the history of communications with us;
- data on the economic situation, needed for recovery: occupation, workplace and income, assets owned (real estate, cars), other loans and financial obligations;
- correspondence and, when calls are recorded (we tell you at the start of the call), recordings of telephone conversations with you.
Legal basis: performance of the contract to which you are a party (when the receivable has been assigned to us, we are your creditor); the legitimate interest of the creditor and our own in recovering a debt that has fallen due; the legal obligations incumbent on us (accounting records, enforcement of court judgments, requests from authorities).
Source of the data: we receive it from the original creditor (assignor or principal), from you and, under the conditions laid down by law, from state registers and databases (for example, the State Population Register, through the Public Services Agency) and from credit history bureaus. We do not process special categories of data (for example, health data) for this purpose.
How long we keep it: for as long as the receivable is being managed and then 5 years, archived, in accordance with accounting and archives legislation.
3.2. Complaints
When you file a complaint (on the website, by phone, in writing), we process the data you give us: your name, your IDNP or IDNO (if you provide it), phone number, e-mail, address, the capacity in which you are writing, the description of the situation and the attached documents.
Your name, phone number, the subject and the description of the complaint are required, plus your e-mail or postal address, depending on how you want to receive the answer: without them we cannot examine the complaint or answer you. The IP address and browser type from which you sent the form are kept for 90 days, for the security of the form.
Legal basis: the legal obligation to examine complaints (NCFM Regulation no. 25/6). How long we keep it: 5 years from receipt, after which the closed complaint and its documents are deleted automatically from the website.
3.3. Personal data requests
When you exercise your rights (section 7), we process the data in the request so that we can resolve it and so that we can prove that we have answered. Legal basis: legal obligation. How long we keep it: 3 years from receipt, for resolved requests.
Requests received by e-mail, by post or at our office are entered in the same register, with the same deadline for answering. For requests sent through the form, the IP address and browser type are kept for 90 days.
3.4. Our clients (creditors) and prospective clients
The name, position, phone number and e-mail of the contact persons of companies that ask us for an offer or with which we have a contract. Legal basis: steps taken prior to entering into the contract, its performance and the legitimate interest in communicating with our partners. How long we keep it: for the duration of the contractual relationship and then 5 years, in accordance with accounting legislation.
3.5. Online payment
On the payment page you give us your IDNP or reference number, name, address, e-mail and phone number, so that we can record the payment in your case file and send you the receipt. You enter your card data on the page of the bank or payment processor (Victoriabank, PayPal), which processes it; we do not receive or store the full card number or its codes. From the bank we receive the payment confirmation: the amount, the date, the authorization code, the transaction number and the masked card number (only the first and last digits). From PayPal we receive the amount and the text you entered (your IDNP or reference number). Legal basis: performance of the contract and the legal obligation to keep accounting records. How long we keep it: the same as the receivable data (point 3.1); the technical payment log (the consent given, the bank’s messages) — 5 years, and the IP address the form was sent from — 90 days, for payment security.
3.6. Visiting the website
- Technical data (IP address, browser, pages requested, time): needed for the website to work and to be secure. Legal basis: the legitimate interest in ensuring the operation and security of the website. The website’s error logs are kept for 14 days; the server logs are kept by the hosting provider, for security purposes.
- Cookies: those strictly necessary for the website to work and, only with your consent, those for external content (maps, video), statistics (Google Analytics), marketing (Meta Pixel). Details in the Cookie Policy. The log of the choices made in the banner (a random identifier, the choice, the date, the policy version and the browser type, without the IP address) is kept for 3 years, as proof of consent.
3.7. Marketing messages
We send you offers or news by e-mail only if you have given us your consent for this. Legal basis: consent, which you can withdraw at any time, without giving a reason, at info@incaso.md or through the link in the message. Withdrawal does not affect processing carried out before then, nor processing on another legal basis.
3.8. Messages via messaging apps (Telegram, Viber, WhatsApp, Facebook)
You can also write to us through messaging apps: Telegram (including the INCASO bot, @INCASO_Bot, to which you send your IDNP or the reference number from our letter to find out what debts you have with INCASO), Viber, WhatsApp or our Facebook page. Using them is optional: you can get the same information by phone, by e-mail or at our office. We process what you write to us there (including your IDNP or reference number) and the account details the app shows us (account name and identifier, possibly your phone number), in order to reply to you. The messages pass through the servers of the operators of these apps (Telegram, Viber, Meta), which also process them under their own policies, outside the Republic of Moldova (see section 5).
3.9. Instalment requests, offer requests, questionnaires and CVs
- Instalment plan request: the data in the request (name, date of birth — optional, address, phone, e-mail, reference number, amount and desired duration), to review the request and reply to you, at your request. We keep it for one year from receipt.
- Offer request (creditors): the company's contact details, to prepare the offer. We keep them for 3 years if no contract is concluded.
- Questionnaires: the answers, to improve our services. In the client questionnaire the name, company and e-mail are optional; we keep them for one year, after which only the answers remain, without a name. The debtor questionnaire is anonymous.
- CVs: the CV and contact details, only for recruitment. We keep them for 6 months from receipt or, with your separate consent, for 2 years for future positions; you can withdraw consent at any time at info@incaso.md.
These forms are seen only by the staff who handle them, in the website's administration panel, and every opening is recorded in the access log.
4. To whom we may disclose the data
Only employees who need the data for their duties have access to it. We may disclose the data, only to the extent necessary for the purpose:
- to the creditor on whose behalf we manage the receivable;
- to credit history bureaus, under the conditions of the Law on credit history bureaus;
- to courts, bailiffs, lawyers and notaries, when recovery reaches these stages;
- to authorities, at their request based on law: the State Tax Service, law enforcement bodies, the National Commission for Financial Markets, the consumer protection authority, the National Centre for Personal Data Protection (CNPDCP);
- to banks and payment processors (Victoriabank, PayPal), for the payments you make;
- Google (Google Analytics) and Meta (Meta Pixel), only for the statistics and marketing you accept in the cookie banner;
- to processors engaged by us, who work on our instructions and under a duty of confidentiality: hosting and IT service providers, equipment and software maintenance providers, e-mail providers, postal and courier services, financial auditors.
- the operators of messaging apps (Telegram, Viber, Meta — for WhatsApp and Facebook), when you write to us through them (section 3.8);
- our data protection officer („Privacy by default” SRL), who receives copies of personal data requests and advises us.
We do not sell your data and we do not give it to other persons without a legal basis. Before answering a request from an authority, we check that it states the purpose and the legal basis.
5. Transfer of data abroad
We process the data in the Republic of Moldova. It leaves the country only in these cases:
- when you pay via PayPal: the payment data is processed by PayPal, including in the European Union and in the USA, in accordance with PayPal’s policy;
- when you choose to view the Google map or a YouTube video on the website: your browser connects to Google (USA). Without your consent, this content is not loaded.
- when you accept statistics (Google Analytics) or marketing (Meta Pixel) in the cookie banner: data about the visit goes to Google or to Meta Platforms respectively, including in the USA.
- when you write to us via Telegram (including the INCASO bot), Viber, WhatsApp or Facebook: the messages pass through these apps' servers outside the Republic of Moldova, under their rules.
For payments, external content and measurement, PayPal, Google and Meta undertake in their contractual terms to apply data protection safeguards (standard contractual clauses). For messaging apps, their operators' policies apply.
6. Automated decisions
We do not take decisions based solely on automated processing of data, including profiling, that produce legal effects concerning you or affect you in a similar way. Should we do so, we will inform you in advance through this policy.
7. Your rights
- Access: to find out whether we process your data and to receive a copy of it, together with the information in this policy.
- Rectification: to have us correct inaccurate data and complete incomplete data.
- Erasure: to have us erase the data when it is no longer needed, when you have withdrawn your consent or when it has been processed without a legal basis. This is not an absolute right: we may keep the data for as long as the law requires us to, or for as long as we need it to establish, exercise or defend a right in court (for example, an unpaid debt).
- Restriction: to have us temporarily stop the processing, for example while we check the accuracy of data you have contested.
- Portability: to receive the data you have given us in a structured, commonly used format, or to have us transmit it to another controller, when the processing is based on consent or on a contract and is carried out by automated means.
- Objection: to object to processing based on legitimate interest, on grounds relating to your situation. We continue only if we have legitimate and compelling grounds or if the processing is necessary in connection with a right in court. An objection to direct marketing is always respected.
- Withdrawal of consent, at any time, for processing based on consent.
- The right not to be subject to a decision based solely on automated processing (section 6).
How to exercise your rights: through the personal data request form, by e-mail to office@gdpr.md or info@incaso.md, or by post, to our registered office. We answer free of charge, no later than one month from receipt of the request. If the request is complex or there are many requests, this time limit may be extended by no more than two months; we will let you know, with the reasons, within the first month. So that we do not give your data to someone else, we may ask you to confirm your identity.
8. The right to lodge a complaint
If you consider that we are processing your data in breach of the law, you can write to us at any time (section 2). You also have the right to lodge a complaint with the National Centre for Personal Data Protection (Centrul Național pentru Protecția Datelor cu Caracter Personal (CNPDCP)): datepersonale.md, centru@datepersonale.md, +373 22 82 08 01, and to apply to the courts.
9. How we protect the data
We apply technical and organisational measures appropriate to the risk: access to data only for the employees who need it, an encrypted connection (HTTPS) on the website, encryption of the personal identification codes received through forms, documents attached to complaints kept outside the public area of the server, and a duty of confidentiality for employees and processors. If a personal data breach poses a high risk to you, we will notify you without undue delay.
10. Changes to this policy
We update the policy when the processing or the law changes. The version in force is always this one, with the date at the top of the page; if a change concerns you directly, we will let you know.