Privacy policy

1. Who we are

The la12 platform is run by Societatea cu Răspundere Limitată „ICD SOFT DEV” (a limited liability company; “ICD SOFT DEV”, “we”), registered in the Republic of Moldova.

2. Who is responsible for the data

We process personal data in accordance with Moldova's Law no. 195/2024 on personal data protection, which is aligned with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). For users in the European Union, the GDPR also applies.

Our role depends on whose data it is:

• Employee and office manager accounts. The company decides who gets an account and what the data is used for (organising lunch at the office). The company is the controller, and ICD SOFT DEV processes the data on its behalf, as processor, only on the company's instructions.
• Company administrator and supplier accounts, the website. For company administrators' and suppliers' own accounts (including their couriers'), for subscription billing and for visits to the website, ICD SOFT DEV is the controller.

If you are an employee and have questions about how your company uses your data, please ask your employer first. We can help too: we pass your request on to the company and support it in answering you.

3. What data we process

We process only the data we need to organise lunch at the office:

• Account data: name, work email address, phone number (if you provide it, for example for couriers), role on the platform, company and office, password (stored only in irreversibly encrypted form) and, optionally, a profile photo.
• Employee username: the supplier and the courier only see the employee's username, not their real name.
• Orders and attendance: the lunch picked each day, order history, days you are away (if you mark them), the allowance set by the company and the difference you have to pay, as well as monthly reports.
• Dietary preferences and allergens: only if you enter them yourself. Allergy information may reveal health data, so we use it only to flag dishes containing those allergens. Your note about foods you don't eat is sent to the kitchen with the order. You can change or delete them at any time in your profile.
• Offices and suppliers: office delivery addresses and contact persons; for suppliers, their name, menus, prices, delivery areas and uploaded photos (dishes, cover images).
• Notifications: which notifications you want to receive and on which channel (email or Telegram). If you choose Telegram, we keep the identifier needed to send you messages.
• Technical data: IP address, browser and device type, date and time of access, error logs, the session tokens that keep you logged in and an audit trail of changes (who changed what and when).

Employees' basic data (name, email, office) is usually entered by the company; the rest is added as you use the platform.

4. Why we process data and on what legal basis

• Providing the service: accounts, lunch picks, sending the order to the supplier at the deadline, delivery, reports and monthly calculations. Basis: performance of the contract with the company or the supplier; for employee data, the instructions of the company, which is the controller.
• Flagging allergens: only on the basis of your explicit consent, given by entering them in your profile. You can withdraw it at any time by deleting the information.
• Notifications and service messages (reminders, confirmations, changes to the terms or prices). Basis: performance of the contract and our legitimate interest in keeping you informed. We do not send marketing messages without your consent.
• Security and abuse prevention: technical logs, the audit trail, protection against attacks. Basis: our legitimate interest in keeping the platform secure.
• Website visit statistics (Google Analytics), only on la12.md and only if you accept them in the cookie banner. Basis: your consent, which you can withdraw at any time from “Cookie settings” in the site footer.
• Legal obligations: accounting, subscription invoicing, responding to requests from authorities. Basis: legal obligation.

We do not sell personal data, we do not use advertising trackers and we do not make automated decisions that have legal effects on you.

5. Who we share data with

Data is available only to those who need it to get lunch to the office:

• Your company: administrators and office managers see the orders, absences and reports of employees in the offices they manage.
• The lunch supplier chosen by the company receives the orders: the employee's username, the dishes, the note on foods to avoid, the office and the delivery address. The supplier's couriers see the addresses and the day's delivery list. The supplier uses this data to prepare, label, deliver and invoice orders.
• Technical service providers (processors), contractually bound to keep the data confidential and secure: a hosting provider, for servers in the European Union, and Cloudflare, Inc. (USA), for content delivery, DNS and protection against attacks; traffic to the platform passes through Cloudflare.
• Google Ireland Limited (Ireland), together with Google LLC (USA), for Google Analytics statistics, only if you have accepted them.
• Telegram, only if you choose to receive notifications there. Telegram is an independent service with its own privacy policy.
• Public authorities, only when the law requires us to.

If the platform's business were taken over by another company (for example, through a reorganisation), the data would pass to it with the same safeguards, and we would notify you in advance.

6. Where data is stored

We keep the platform's data in the European Union, where the GDPR applies.

Cloudflare may process technical data (for example, IP addresses) outside the EU as well, including in the USA. These transfers are protected by the standard contractual clauses approved by the European Commission and by Cloudflare's certification under the EU-U.S. Data Privacy Framework.

If you accept statistics, Google may transfer Google Analytics data to the USA under the EU-U.S. Data Privacy Framework and the standard contractual clauses.

7. Cookies and local storage

Strictly necessary. The platform cannot work without these, so they do not require your consent:

• The la12-locale cookie remembers your chosen language for one year.
• Login data (session tokens) is kept in your browser's storage while you are logged in and is deleted when you log out.
• Interface preferences, such as the theme (light or dark) and the last office you opened, are kept in your browser's local storage.
• Your cookie choice is kept in your browser's local storage (the la12-consent key), so we don't ask you on every visit.
• Cloudflare security cookies help us tell real visitors from bots.

Statistics (Google Analytics 4). Only on the la12.md website and only if you accept them in the cookie banner:

• Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), together with Google LLC (USA).
• Purpose: anonymous statistics about site traffic (pages visited, approximate location at city or country level, device and browser, how visitors arrived at the site), so we can improve the site.
• We do not use advertising features, Google Signals or ad personalisation. Google Analytics 4 does not store full IP addresses.
• Cookies: _ga and _ga_<ID> (first-party cookies, valid for up to 14 months). Analytics data is kept in Google Analytics for 14 months.
• Basis: your consent. Until you accept, Google Analytics stays in “consent denied” mode (Consent Mode v2) and sets no analytics cookies.
• You can change or withdraw your choice at any time from the “Cookie settings” link in the site footer.

We do not use advertising cookies. You can delete cookies and local storage at any time in your browser settings; you will then need to log in again.

8. How long we keep data

• Account data and orders: while the company's or supplier's account and contract are active. After the account is closed or the contract ends, we delete or anonymise them within 90 days at most.
• Accounting documents (invoices and the monthly reports used for invoicing): for the period required by the accounting and tax laws of the Republic of Moldova.
• Allergens and dietary preferences: until you delete them or the account is closed.
• Technical logs and the audit trail: 12 months at most.
• Google Analytics statistics (only with your consent): 14 months.
• Backups: overwritten periodically; deleted data disappears from them within 30 days at most.

We may keep certain data longer only if it is needed to investigate a security incident or to establish, exercise or defend legal claims.

9. Your rights

You have the right to:

• find out whether we process your data and receive a copy of it (right of access);
• have inaccurate data corrected (right to rectification);
• have your data deleted (right to erasure);
• ask for processing to be restricted;
• object to processing based on legitimate interest;
• receive your data in a structured, commonly used format and pass it to another controller (right to data portability);
• withdraw your consent at any time, without affecting the lawfulness of earlier processing;
• lodge a complaint with the National Centre for Personal Data Protection (CNPDCP), datepersonale.md, and, if you are in the EU, with the supervisory authority in your country.

To exercise your rights, write to us at [email protected]. We reply within 30 days at most. We may ask for additional information to confirm your identity.

If your data is processed on behalf of your company, the request is handled together with the company, which is the controller. You can view and correct much of your data directly in your profile.

10. Data security

We protect data with appropriate technical and organisational measures: encrypted connections (HTTPS), passwords stored only in irreversibly encrypted form, role-based access (everyone sees only what they need), restricted access by our staff, backups and an audit trail of changes.

No system is completely secure. If a personal data breach occurs that poses a risk to you, we notify the CNPDCP within 72 hours of becoming aware of it and, if the risk is high, we also inform the people affected without undue delay. When we process data on behalf of a company, we notify that company without undue delay.

11. Minors

la12 is a service for companies and their employees and is not intended for people under 18. We do not knowingly collect data about minors; if we find out that this has happened, we delete it.

12. Changes to this policy

We may update this policy when the platform or the law changes. The current version is published on this page with the date of the last update. We will notify you of material changes by email or on the platform before they take effect.

13. Contact

For any question about personal data, write to us at [email protected] or by post to: MD-3100, mun. Bălți, str. Tudor Vladimirescu 8, of. 55, Republica Moldova.