Privacy and Cookie Policy

Website: www.alverstur.md
Last updated: 21 July 2026
Applicable from: 23 August 2026

This Policy explains how ALVALVER S.R.L. collects, uses, stores, transfers and protects personal data in connection with the website www.alverstur.md and Alverstur services.

From 23 August 2026, personal data will be processed in accordance with Law No. 195/2024 on personal data protection.

Until that date, the personal data protection legislation in force at the time of processing shall apply.

---

1. Data controller

The main controller of data collected through the website is:

ALVALVER S.R.L.
IDNO: 1004600026627
Registered address: Republic of Moldova, Strășeni District, Sireți village
Office: Republic of Moldova, Chișinău Municipality, 77 Ismail Street, Office 77
E-mail: info@alverstur.md
Telephone: +373 69 581 101

Requests relating to personal data may be sent to info@alverstur.md with the subject line “Data Protection”.

---

2. Scope

This Policy applies to data processed through:

• the website www.alverstur.md;
• the booking system;
• the Customer account;
• online payments;
• telephone bookings;
• e-mail;
• SMS;
• WhatsApp, Viber, Telegram or other messaging services used by Alverstur;
• official social media pages;
• offices and sales points;
• communications with carriers and drivers;
• contact, complaint and lost property forms;
• transport and transfer services.

---

3. Roles of Alverstur and partner carriers

Depending on the service, ALVALVER S.R.L. may act:

• as controller for booking, payment, ticket issuance and website administration;
• as carrier;
• jointly with a partner carrier where the purposes and means of processing are determined jointly;
• as an intermediary transferring data required for the journey to the carrier.

A carrier that receives data and uses it for its own legal or operational obligations may act as an independent controller.

Each recipient receives only the information necessary to perform its role.

---

4. Categories of personal data collected

4.1. Identification and contact details

We may collect:

• first and last name;
• telephone number;
• e-mail address;
• country or locality, where necessary;
• details of the person making the reservation;
• details of passengers included in the reservation.

4.2. Travel information

We may process:

• route;
• date and time;
• boarding and disembarkation station;
• seat number;
• vehicle or journey;
• carrier;
• ticket type;
• passenger category;
• luggage and optional services;
• transfers;
• booking history;
• booking and journey status.

4.3. Discount information

To grant a discount, we may process information indicating that the passenger is, for example:

• a child;
• a pupil;
• a student;
• a pensioner;
• a beneficiary of a promotion;
• a member of a loyalty programme.

Supporting documents are generally checked visually.

We do not retain copies of supporting documents unless this is necessary and permitted by law.

4.4. Payment information

For online payments, we may receive:

• amount;
• currency;
• transaction date and time;
• payment status;
• transaction identifier;
• payment method;
• masked card details, where supplied by the processor;
• refund information.

Alverstur does not store the full card number or CVV/CVC security code.

4.5. Customer account information

Where an account is created, we may process:

• name;
• telephone number;
• e-mail address;
• password in secured form;
• preferences;
• order history;
• actions and logins relevant to security.

4.6. Communications and requests

We may process information provided through:

• e-mail;
• contact forms;
• telephone;
• SMS;
• messaging services;
• social media;
• complaints;
• lost property forms;
• refund requests.

Telephone conversations are not recorded unless the passenger is informed in advance and an appropriate legal basis exists.

4.7. Technical and security data

The website and systems may automatically collect:

• IP address;
• access date and time;
• device and browser type;
• operating system;
• pages accessed;
• session identifiers;
• technical errors;
• login information;
• attempted unauthorised access;
• information necessary to prevent fraud and cyberattacks.

4.8. Preferences and consents

We may retain:

• cookie preferences;
• date and method of giving consent;
• selected marketing channel;
• withdrawal of consent;
• objection to marketing;
• inclusion on a suppression list.

4.9. Sensitive data

Alverstur does not normally request health data or other special categories of data.

Passengers are requested not to enter the following information in free-text fields:

• diagnoses;
• copies of medical documents;
• complete banking information;
• passport series and number;
• personal identification number;
• other sensitive information that is not necessary.

Where a passenger requests special assistance, only the minimum information necessary to organise the journey and protect the person will be collected.

---

5. Sources of personal data

Data may be obtained:

• directly from the Customer or Passenger;
• from the person making the reservation for other passengers;
• from an agent or partner registering the reservation;
• from the carrier performing the journey;
• from the payment processor or bank;
• through interaction with the website and security systems;
• from communications submitted to Alverstur;
• from authorities where permitted or required by law.

A person supplying the details of other passengers must inform them of the reservation and this Policy.

---

6. Purposes and legal bases of processing

6.1. Booking and performance of the transport service

Data is used for:

• searching for and booking a journey;
• seat allocation;
• ticket issuance;
• payment confirmation;
• organising boarding;
• arranging transfers;
• informing passengers of changes;
• providing the transport service.

Legal basis: performance of a contract or taking steps requested before entering into a contract.

6.2. Operational communications

Data is used to send:

• tickets;
• confirmations;
• boarding time and location;
• operational journey information;
• notifications of delays, changes or cancellations;
• attendance reconfirmation requests.

Legal basis: performance of a contract and legitimate interest in efficiently organising the transport service.

6.3. Payments and financial records

Data is used for:

• processing payment;
• issuing documents;
• refunds;
• transaction reconciliation;
• accounting and tax compliance;
• fraud prevention.

Legal basis: performance of a contract, legal obligations and legitimate interest.

6.4. Assistance, complaints and disputes

Data is used for:

• handling requests;
• managing complaints;
• recovering lost property;
• defending the rights of Alverstur or passengers;
• preserving necessary evidence.

Legal basis: performance of a contract, legal obligation and legitimate interest.

6.5. Security

Technical data may be used for:

• protecting accounts;
• preventing attacks;
• detecting fraudulent bookings;
• investigating incidents;
• ensuring service continuity.

Legal basis: legitimate interest and legal obligations relating to data security.

6.6. Service improvement

We may analyse aggregated or, where possible, anonymised data to:

• improve routes;
• optimise the website;
• analyse the use of functions;
• correct errors;
• improve passenger relations.

Legal basis: legitimate interest.

6.7. Marketing

Advertising messages may be sent by e-mail, SMS or other channels only where an appropriate legal basis exists.

Where consent is required, it will be:

• separate from acceptance of the Terms and Conditions;
• expressed through an affirmative action;
• specific to the channel used;
• easy to withdraw.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

---

7. Mandatory and optional information

Fields marked as mandatory are necessary for booking, payment or transport.

If this information is not provided, we may be unable to:

• make the reservation;
• issue the ticket;
• confirm the payment;
• communicate changes;
• provide the service.

Free-text comment fields are optional and must be used only for information relevant to the journey.

---

8. Recipients of personal data

Data may be transferred, to the extent necessary, to:

8.1. Carriers and operational staff

• the carrier operating the journey;
• drivers;
• dispatchers;
• transfer operators;
• boarding staff;
• agents or contractual partners.

Drivers and operational personnel receive only information required for the assigned journey.

8.2. Banks and payment processors

Data required to process, confirm or refund payments may be transferred to authorised banks and payment processors.

8.3. Technical suppliers

We may use suppliers for:

• hosting;
• databases;
• maintenance;
• software development;
• backups;
• cybersecurity;
• anti-DDoS protection;
• fraud prevention;
• CAPTCHA services.

8.4. Communication providers

We may use providers for sending:

• e-mails;
• SMS messages;
• notifications;
• operational messages;
• tickets.

8.5. Professional advisers

Data may be disclosed to accountants, auditors, lawyers or consultants where necessary and subject to confidentiality obligations.

8.6. Public authorities

Data may be provided to public authorities where there is:

• a legal obligation;
• a valid request;
• a need to protect a person;
• a need to defend a legal right.

Alverstur does not sell passenger databases.

---

9. Processors acting on our behalf

Suppliers processing data solely on Alverstur’s instructions must comply with contractual obligations relating to:

• confidentiality;
• security;
• limited use of data;
• notification of incidents;
• deletion or return of data;
• control of subprocessors.

---

10. International data transfers

Alverstur’s activities involve international transport and cooperation with carriers or suppliers located in other countries.

Data may be transferred outside the Republic of Moldova where required for:

• performing the transport service;
• organising a transfer;
• using a technical service;
• sending a communication;
• processing a payment;
• complying with a legal obligation.

Transfers are carried out based on an adequacy decision, contractual clauses, appropriate safeguards or another mechanism permitted by law.

---

11. Retention periods

Data is retained only for as long as necessary for the purpose for which it was collected.

11.1. Reservations, tickets and transactions

Data is retained for the duration of the service and afterwards for the period required by accounting, tax and transport legislation and the applicable time limits for complaints or disputes.

After expiry of these periods, data is deleted, anonymised or restricted.

11.2. Incomplete reservations

Abandoned or unconfirmed reservations may be retained for an operational period of up to 90 days, after which they are deleted or anonymised unless there is a security reason or dispute justifying further retention.

11.3. Customer accounts

Account information is retained while the account remains active.

Accounts not used for 24 months may be closed or anonymised after notification, subject to retention of documents required by law.

11.4. Messages and complaints

Messages, complaints and refund requests may be retained until the matter is resolved and generally for a maximum of three years after closure, unless a legal obligation or dispute justifies a longer period.

11.5. Lost property

Lost property requests may be retained until resolution and for a maximum of 12 months after closure.

11.6. Security logs

Technical and security logs are generally retained for a maximum of 12 months.

In the event of an incident, the period may be extended until the investigation or legal proceedings are completed.

11.7. Marketing

Data used for marketing is retained until consent is withdrawn or, in the absence of interaction, for a maximum of 24 months.

Minimum information regarding an objection or unsubscribe request may be retained for a longer period to prevent further unwanted communications.

11.8. Cookies

The retention period of each cookie is indicated in the settings panel or in the technical information relating to the cookie.

Cookie consent preferences are requested again periodically and generally at least once every 12 months.

---

12. Rights of the data subject

Under Law No. 195/2024, the individual has the right:

• to be informed about processing;
• to obtain access to their data;
• to request correction of inaccurate data;
• to request completion of incomplete data;
• to request deletion where applicable;
• to request restriction of processing;
• to object to processing based on legitimate interest;
• to object at any time to direct marketing;
• to receive data in a structured format and request portability where applicable;
• to withdraw consent;
• not to be subject to a decision based solely on automated processing in the cases provided by law;
• to lodge a complaint with the competent authority;
• to apply to a court.

Certain rights may be limited where retention or processing is necessary to comply with a legal obligation, perform a contract or defend a legal right.

---

13. Exercising your rights

Requests may be sent to:

E-mail: info@alverstur.md
Recommended subject: Data Protection
Address: 77 Ismail Street, Office 77, Chișinău Municipality

The request must describe sufficiently clearly the right being exercised and the data or reservation concerned.

To protect personal data, Alverstur may request reasonable additional information to verify identity.

A response will be provided without undue delay and generally within one month of receipt.

For complex requests or a large number of requests, the period may be extended in accordance with the law, and the person will be informed of the extension and the reasons for it.

Requests are handled free of charge, except where they are manifestly unfounded or excessive, as permitted by law.

---

14. Right to lodge a complaint

Where a person believes that their data is being processed improperly, they may first contact Alverstur to resolve the matter.

The person also has the right to lodge a complaint with:

The National Centre for Personal Data Protection of the Republic of Moldova – NCPDP

Updated contact information is available on the official website datepersonale.md.

---

15. Objection to marketing

A person may unsubscribe at any time:

• by using the unsubscribe link in an e-mail;
• by replying “STOP” where this option is indicated in the message;
• by contacting Alverstur;
• by changing preferences in the account, where this function is available.

Objection to marketing does not affect communications necessary for an active booking or the performance of the transport service.

---

16. Automated decision-making

Alverstur does not currently make decisions based solely on automated processing that produce legal or similarly significant effects for passengers.

Certain automated processes may be used for:

• payment confirmation;
• ticket generation;
• technical fraud detection;
• route display;
• price calculation in accordance with system rules.

If a system involving significant automated decisions is introduced, the persons concerned will be informed separately in accordance with the law.

---

17. Minors

Personal data relating to minors may be processed for booking and performance of the transport service.

A reservation for a minor must be made by a parent, guardian or authorised person to the extent required by law.

Alverstur does not seek to collect personal data directly from minors for marketing purposes and does not request excessive information about them.

---

18. Data security

Alverstur applies technical and organisational measures appropriate to the risks, including, where applicable:

• access control;
• individual staff accounts;
• role-based access rights;
• password protection;
• secure connections;
• backups;
• monitoring of access and errors;
• limiting carrier and driver access;
• system updates;
• incident management procedures;
• staff training;
• confidentiality obligations.

Access to personal data is granted only to persons who require it to perform their duties.

---

19. Data security incidents

A security incident may include loss, destruction, unauthorised disclosure, alteration or unlawful access to personal data.

Alverstur documents and investigates incidents.

Where required by law, Alverstur notifies the NCPDP without undue delay and, where possible, within no more than 72 hours after becoming aware of the incident.

Where the incident may result in a high risk to affected persons, they will be informed in accordance with the law.

---

20. Cookies and similar technologies

The website uses cookies and similar technologies.

20.1. Necessary cookies

These are necessary for:

• website operation;
• maintaining the session;
• making a reservation;
• authentication;
• security;
• storing privacy preferences;
• fraud prevention.

Strictly necessary cookies cannot be disabled through the website panel but may be controlled through the browser. Blocking them may prevent the booking system from functioning.

20.2. Functional cookies

These allow additional functions, such as:

• remembering language or currency;
• chat services;
• maps;
• external content;
• personalised preferences.

They are activated only under the conditions displayed in the consent panel.

20.3. Analytics cookies

These help us understand:

• which pages are visited;
• how the website is used;
• where errors occur;
• how the user experience can be improved.

Non-essential analytics cookies are activated only after the corresponding choice has been made.

20.4. Marketing cookies

These may be used for:

• measuring campaigns;
• limiting repeated advertisements;
• analysing conversions;
• displaying advertising on third-party platforms.

Marketing cookies are disabled by default and activated only after consent.

20.5. Managing preferences

The user may:

• accept all cookies;
• reject all non-essential cookies;
• select certain categories;
• subsequently change preferences through “Cookie Settings”.

Rejecting non-essential cookies must be as easy as accepting them.

---

21. Third-party services and content

Certain pages may include third-party services, such as:

• payment processors;
• maps;
• CAPTCHA systems;
• analytics tools;
• video services;
• social networks;
• chat systems.

Where a service is not strictly necessary, it will be loaded only after the corresponding choice has been made in the cookie panel.

Third parties may process data in accordance with their own privacy policies.

---

22. Links to other websites

The website may contain links to carriers, authorities, maps, social networks or other services.

Alverstur does not control the privacy policies of external websites. Users are encouraged to review those policies.

---

23. Amendments to this Policy

This Policy may be updated where:

• legislation changes;
• new functions are introduced;
• suppliers are changed;
• processing purposes or processes are modified;
• clarifications are required.

The updated version will be published together with the date of the latest amendment.

Where the amendment is important, Alverstur may inform users through the website, e-mail or other appropriate channels.

---

24. Contact

For questions or requests relating to data protection:

ALVALVER S.R.L.
E-mail: info@alverstur.md
Telephone: +373 69 581 101
Address: Republic of Moldova, Chișinău Municipality, 77 Ismail Street, Office 77