PRIVACY POLICY

This Personal Data Processing Policy explains how the Insurance and Reinsurance Broker Company "MGP BROKER" S.R.L. collects, uses, stores, transfers and protects the personal data of the persons it interacts with.

In this Policy you will find, in particular:

• which categories of personal data we may process;
• for what purposes we use this data;
• the legal bases for the processing;
• where we may obtain the data from;
• how long we keep the data;
• to whom, and under what conditions, we may transfer the data;
• what rights you have as a data subject and how to exercise them;
• what measures we apply to protect personal data.

Personal data is processed in accordance with Legea nr. 195/2024 privind protecția datelor cu caracter personal and the other applicable legislation, including the legislation governing insurance intermediation.

This Policy applies to processing carried out by the Company both electronically and on paper.

The Policy applies to the processing of personal data in connection with:

• the website rapidasig.md and its subdomains, including the personal account ("Personal account") and the brand promotion agent's account;
• the RAPIDASIG mobile app (Android and iOS);
• your communications with us by phone, e-mail, chat, online forms or at our offices;
• the intermediation services we provide outside the platform, unless you have been given a separate notice.

This Policy should be read together with the Cookie Policy and the platform's Terms and Conditions. With regard to personal data processed by the insurer you choose when concluding and performing the insurance contract, the insurer has its own purposes and legal bases for processing, to the extent that it acts as a controller, as well as its own data protection policies and rules. Information on how the insurer processes your data is provided in the insurer's policy, notice or other data protection documents.

We are the Insurance and Reinsurance Broker Company "MGP BROKER" Limited Liability Company, hereinafter the "Company", a licensed insurance and reinsurance broker and the operator of the RAPIDASIG platform. In the course of our activities and services we process your personal data as a controller, determining the purposes and means of the processing. We process data in good faith, securely and in compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.

Name	Insurance and Reinsurance Broker Company "MGP BROKER" Limited Liability Company
IDNO	1008600020368
Registered office	12 Mihail Kogălniceanu St., Chișinău, MD-2001, Republic of Moldova
E-mail for personal data matters	[email protected] (subject: "Personal data")
Phone	022 93 01 91 · 079 93 01 91
Website	www.rapidasig.md

For any questions or requests regarding the processing of personal data, you can contact us at [email protected], marked "Personal data". Requests are handled by the Company's responsible staff within the period provided by applicable law.

The categories of data depend on the service you request. We collect only the data needed for the chosen product and for meeting our legal obligations.

Category	What it includes
Identification and contact	first name, surname, IDNP, date of birth, citizenship, home/residence address, phone, e-mail; series, number, issuing authority and validity of the identity document and, for products that require it, an image of the document.
Vehicle	registration number, VIN, make, model, year of manufacture, technical characteristics, registration certificate data, bonus-malus class and insurance history.
Driving licence and drivers	category, date of issue, driving experience; data of the persons authorised to drive the vehicle.
Insured persons and beneficiaries	data of other persons that you enter: travellers, family members, authorised drivers, insurance beneficiaries.
Insurance contracts and complementary services	offers requested, policies and road vignettes issued, validity, premiums, request history, correspondence regarding claims where you ask us for assistance.
Payments	amount, date, payment method, transaction identifier. We do not store full bank card details; payment is processed by the payment service provider.
User account	login data (e-mail/phone, password in encrypted form), order history, saved preferences.
Communications	the content of messages sent by e-mail, chat, forms or phone; recordings of phone calls with customer service; images from the video surveillance system in our offices.
Technical data	IP address, device and browser type, device identifiers, access logs, cookies and similar technologies (details in the Cookie Policy); in the mobile app — the device identifier and the notification token.
Marketing	the consent given, preferred channel, history of interaction with our messages. Consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Other people's data. If you enter data about other persons (for example, authorised drivers or insured persons), please make sure you are entitled to provide this data to us and inform those persons about its processing, including by bringing this policy to their attention.

Special categories of data. We do not request health data or other special categories of data through the platform. If a product or a claim requires them, they are processed by the insurer as a controller; we transmit them only at your request and only to the extent necessary.

Minors. The platform's services are intended for persons with full legal capacity. We do not knowingly process the data of minors as platform users; minors' data may be processed only as insured persons (for example, in travel medical insurance), provided by the legal representative.

• directly from you — through forms, your user account, the app, by phone, e-mail, chat or at our offices;
• automatically, from your device — when you use the website or the app, under the conditions described in the Cookie Policy;
• from insurers — for data validation, policy issuance and management of insurance contracts;
• from official databases and registers accessible under the law — the RCA (compulsory motor third-party liability) insurance information system, including the bonus-malus class, and the state registers of vehicles and of persons, directly or through the insurer;
• from our partners — when you interact with us through a referral programme or a commercial partner, under the law and, where applicable, with your consent;
• from assistants acting on our behalf — when the service or order is requested through them.

We process personal data only for specified purposes and on a legal basis provided by law, such as: performance of a contract or pre-contractual steps at your request, compliance with a legal obligation, our legitimate interest — after balancing it against your rights and interests — or your consent.

The table below sets out the main purposes of processing, the applicable legal bases and the retention periods.

Purpose	Legal basis	How long we keep the data
Calculating the premium, presenting and saving offers	Pre-contractual steps at your request	Offers that do not become a contract: 12 months from the last interaction
Concluding, issuing, delivering and managing insurance contracts, road vignettes and complementary services	Performance of the contract; legal obligations under insurance legislation	For the duration of the contract and, after expiry, for the statutory limitation, intermediary record-keeping and archiving periods — 5 years
Identity verification, fraud prevention, prevention and combating of money laundering	Legal obligation; legitimate interest (fraud prevention)	Periods required by the relevant legislation — 5 years from the end of the relationship
Collecting premiums, payment records, accounting and tax reporting	Legal obligation; performance of the contract	Periods provided by accounting and tax legislation
User account and agent's account	Performance of the contract (Terms and Conditions)	Until the account is deleted; inactive accounts are deleted after 3 years
Communicating with you, support, handling complaints and requests regarding your rights	Performance of the contract; legal obligation; legitimate interest (record of requests)	Complaints — periods required by insurance legislation; routine correspondence — 3 years
Recording of phone calls	Legitimate interest: evidence of instructions and of information provided, service quality. You are informed at the start of the call.	12 months
Video surveillance in offices	Legitimate interest: safety of persons and property. Areas are signposted.	30 days
Platform security, access logs, preventing unauthorised access and investigating incidents	Legitimate interest; legal obligation to ensure the security of processing	12 months
Audience measurement, service improvement and feature testing	Legitimate interest, for cookieless measurement and aggregated data; consent, for optional cookies	As per the Cookie Policy; aggregated data does not identify you
Reminders about the expiry of contracts concluded through us (e-mail, SMS, push notifications)	Legitimate interest: continuity of insurance cover and avoiding driving without compulsory insurance, with the risk of penalties. You can object or unsubscribe at any time.	Until the contract is renewed or you object, but no longer than 12 months after the contract expires
Direct marketing: e-mail, SMS, push notifications, personalised offers and promotions	Consent, given separately; may be withdrawn at any time	Until consent is withdrawn or 3 years from the last interaction
Promotions, contests, referral programmes	Performance of the contract (the promotion rules); legal obligation (tax records)	As per the promotion rules; tax documents — statutory periods
Establishing, exercising or defending our rights; inspections by authorities	Legitimate interest; legal obligation	Until the limitation periods expire or the procedure is completed

Legitimate interests. Where we rely on our legitimate interest, we check that the processing is necessary and that our interest does not override your rights. You can object to such processing at any time (section 10).

Are you required to provide your data? Data marked as mandatory in forms is necessary for concluding the contract or required by law; without it we cannot calculate the premium or issue the policy. Marketing data is optional, and refusing it does not affect the price or the terms you receive.

Consent. Where processing is based on consent, we ask for it through a separate, unticked option, distinct from accepting the Terms and Conditions. You can withdraw your consent at any time from your account, via the link in every message or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Erasure and anonymisation. When the applicable retention periods expire, we erase personal data or irreversibly anonymise it, once it is no longer needed for the purposes it was collected for or to comply with a legal obligation. Backups are managed and overwritten according to our technical backup cycle and are not used for other purposes.

The platform's calculators automatically apply the insurers' tariffs to the data you enter and to the official data available (for example, the bonus-malus class). Some policies (for example, travel medical insurance) are issued automatically after payment is confirmed; the others are checked by an operator before issuance.

We do not make decisions based solely on automated processing that would refuse you a service or affect you in a similar way, and we do not create profiles for purposes other than those described in this policy. You can ask at any time for a calculation to be checked by an operator.

We do not sell or rent personal data. We transfer it to the recipients listed below when necessary for the purposes described in this Policy, to provide the requested services or to comply with legal obligations.

• The insurers you choose (the list is published on the "Insurance companies" page) — independent controllers for the insurance contract; they inform you separately about their processing.
• Distributors of complementary services — PAYNET SERVICES S.R.L. and LEMONLINE PRODUCTION S.R.L., for road vignettes and road tax — independent controllers for the respective service, with which we have contractual relationships.
• Payment service providers and banks — for processing and confirming payments; we do not receive full card details.
• Courier services — for delivering paper policies, by transmitting the data needed for delivery, such as name, phone number and address.
• Brokerage assistants and brand promotion agents — acting on our behalf, within the powers and mandate granted, to provide and promote RAPIDASIG services.
• Processors that process data on our behalf, under contract and only on our instructions: hosting and infrastructure (including Cloudflare), IT development and maintenance, the CRM and chat system (Kommo / QSOFT LLC), e-mail and SMS services, the call-back widget (Moldcell), measurement and advertising tools (Google, Meta — as per the Cookie Policy), archiving services.
• Consultants, auditors and lawyers — where necessary for our business, subject to confidentiality obligations and applicable law.
• Public authorities — the National Bank of Moldova as the insurance supervisory authority, the State Tax Service, the National Centre for Personal Data Protection, criminal investigation bodies, courts and other competent authorities — only in the cases and within the limits provided by law.
• Legal successors, in the event of a reorganisation, with this policy maintained.

Most data is processed in the Republic of Moldova. Some of our providers — Google, Meta, Cloudflare, Kommo (QSOFT LLC), the Apple and Google app stores — process data on infrastructure located in the European Union, the United States or other countries.

We transfer data outside the Republic of Moldova only:

• to countries that ensure an adequate level of protection;
• on the basis of appropriate safeguards provided by law, such as standard contractual clauses;
• for optional measurement and advertising tools — on the basis of your explicit consent, given through the cookie banner. You can request information about the safeguards applied by writing to the address in section 2.

We apply technical and organisational measures appropriate to the risks, including:

• encryption of communications with the platform (TLS) and of passwords;
• access to data only for employees who need it for their duties, based on authentication, with access logging;
• confidentiality obligations and periodic staff training;
• contracts with processors, binding them to the same level of protection;
• backups, security updates and periodic testing of the measures;
• a security incident management procedure, with notification of the National Centre for Personal Data Protection within the statutory period and of the affected persons where the incident presents a high risk to them.

You can also contribute to data security: keep your account password confidential, do not share it with others and inform us as soon as possible if you suspect unauthorised access to or use of your account.

Under Legea nr. 195/2024, you have the following rights:

• Information — you have the right to know how we process your personal data. This Policy is one of the main means by which we inform you.
• Access — you have the right to find out whether we process your data and to receive a copy of it, together with the information about the processing provided by law.
• Rectification — you have the right to request the correction of inaccurate data or the completion of incomplete data. Data in your account can be corrected directly in the account.
• Erasure — you have the right to request the erasure of your data under the conditions provided by law, including when it is no longer necessary or when you withdraw your consent, as applicable. We will not erase data that we are legally required to keep or that is necessary for establishing, exercising or defending a legal claim.
• Restriction — you have the right to request the restriction of processing in the cases provided by law, for example when you contest the accuracy of the data.
• Portability — you have the right to receive the data you have provided to us in a structured, commonly used format, or to request its transmission to another controller, where the conditions provided by law are met.
• Objection — you have the right to object to processing based on our legitimate interest; we will stop it unless we have compelling legitimate grounds. In the case of direct marketing, you can object at any time and we will stop processing for that purpose.
• Withdrawal of consent — where processing is based on consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Protection against automated decisions — you have the right, under the conditions provided by law, not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, and to request human intervention in the decision-making process.
• Complaint — if you consider that the processing of your data breaches applicable law, you have the right to lodge a complaint with the National Centre for Personal Data Protection and to seek a judicial remedy, under the conditions of the law.

How to exercise your rights

Write to us at [email protected], with the subject "Personal data", or submit your request at our registered office. To protect your data, we may ask you to confirm your identity, proportionately to the nature of the request.

We reply within one month of receiving the request. In complex cases the period may be extended under the conditions of the law, and we will inform you of the extension and its reasons. Exercising your rights is free of charge; only for manifestly unfounded or excessive requests may we charge a reasonable fee or refuse, giving reasons.

The website uses essential cookies for its operation and, only with your consent, analytics, functional and advertising cookies. The full list, the providers, the durations and how to change your choice are described in the Cookie Policy. Your choice can be changed at any time via the "Cookie settings" link in the page footer.

The app processes the same categories of data as the website, for the same purposes and on the same legal bases. In addition:

• Camera — used only if you choose to photograph your identity document or registration certificate; the image serves solely to complete the order.
• Push notifications — we send them when you allow them in your device settings. Notifications about orders and requested services are distinct from marketing notifications, which you can disable at any time.
• Technical data — device identifier, operating system version and error reports, for the operation and stability of the app.
• App stores — Apple App Store and Google Play may process data about downloading and using the app in accordance with their own privacy policies.

For the brand promotion agents we work with, we process identification and contact data, contractual data, and data about the activity performed and remuneration, on the basis of the contract and applicable legal obligations. We keep this data for the duration of the collaboration and afterwards for the periods provided by law.

For brand promotion agents taking part in our referral programme, we process the data needed to register and manage the account, to keep records of referrals and activity, and to calculate and pay remuneration, under the terms of the programme and the applicable contract.

Where agents or brokerage assistants enter or transmit customer data through the platform, they must comply with the applicable personal data protection requirements and the obligations set out in their contractual relationship with us.

We update the policy when our services, providers or legal requirements change. The version and effective date are indicated in the header. We notify you of significant changes by e-mail, in your account or in the app before they take effect. Previous versions can be requested at the address in section 2.

"MGP BROKER" S.R.L.
IDNO: 1008600020368
Registered office: 12 Mihail Kogălniceanu St., Chișinău
E-mail: [email protected], [email protected]
Phone: 022 93 01 91
Website: www.rapidasig.md
Supervisory authority: National Centre for Personal Data Protection — datepersonale.md

Updated on 18.09.2026: BAR "MGP BROKER" SRL – rapidasig.md.