Privacy Policy

About this draft and the website operator

Draft for review — updated 11 October 2026. This policy describes the current Come to Moldova website. It is not ready for public launch until the operator’s legal name, address, privacy contact, hosting provider, data locations and retention schedule are completed. Come to Moldova is the project name, not a confirmed legal entity. Use Contact Us for questions during this review. Do not include passport numbers, payment card details or other sensitive information in a message.

Information you provide and why we use it

Contact Us and Work with us collect your name, email address, selected topic and message; partnership enquiries also collect a company name. Transport requests collect relevant journey details, such as dates, flight number, pickup and destination addresses, passenger count, car category, trip duration and driver waiting time. We use this information to respond, assess availability and discuss your request. Submissions are stored in a private server-side SQLite database and are accessible through a password-protected admin inbox. No email or WhatsApp notification is currently sent automatically. Sending a request does not confirm a booking. Before launch, the operator must confirm and document the legal basis for each use, including requested pre-contractual steps, security interests and any applicable legal obligations.

Preferences and optional analytics

Trip preferences are stored for the browser session. A manually selected language is remembered in a first-party cookie for up to one year. Your cookie choice is stored locally for 180 days. Google Analytics and the local click counter remain disabled until you accept optional analytics. They help measure page visits and interactions; our tracking code does not send enquiry messages, precise coordinates or URL query parameters as event data. Google receives technical browser and network information, including an IP address when requests reach its servers. Choose Accept all, Reject optional or Customise in the cookie banner. You can change or withdraw your choice through Cookie settings in the footer. Withdrawal stops future analytics collection and clears accessible first-party analytics cookies and local click counts; it does not delete information already received by Google. Analytics is disabled on localhost. The production Google retention settings must be confirmed before launch.

Country suggestions and optional device location

IPWhois receives your IP address when the website requests a country suggestion. The request asks for a success flag and country code, not a precise address. The suggestion can be inaccurate, for example when using a VPN. You can choose your departure country and airport manually. Show nearest airport requests your browser’s location permission only when you choose that feature. If permitted, distances to listed airports are calculated in your browser. Our site does not save those coordinates in session storage or send them to IPWhois or a booking provider. Your browser or device location service has its own privacy arrangements.

Spam protection, external providers and international processing

Cloudflare Turnstile protects enquiry forms. It processes technical browser and network information to check for automated abuse. Our server verifies its token before accepting a request and does not store that token with the enquiry. Temporary request-rate limits also help prevent abuse. Google Analytics, Cloudflare and IPWhois have their own privacy information and may process data outside your country. Flight and accommodation links open external services, including Kiwi.com, Booking.com and property websites. Those services receive information when you visit them and handle their own bookings, payments and privacy practices. A partner link may include an affiliate identifier when a programme is enabled. We do not automatically send your enquiry message to a booking website. Before launch, document the actual recipients, processing locations, contracts and any required international-transfer safeguards.

Storage, access and retention

The enquiry database is stored outside the public website files. Access to the inbox requires authentication, and submission checks restrict invalid or automated requests. No system can guarantee absolute security. The current development database is local; production hosting and backups have not yet been configured. Enquiry records currently have no automatic deletion schedule. Before accepting public enquiries, set and implement retention periods for requests, security logs, backups and analytics, based on their purpose and any applicable obligations. Browser preferences can also be removed through browser settings. Necessary security and preference storage is separate from optional analytics.

Your privacy choices and rights

Depending on the law that applies, you may have rights to request access, correction, deletion, restriction, portability or to object to certain uses of your personal data. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may also complain to the relevant data protection authority. Requests may require proportionate identity verification, and some rights have legal limits. Use Contact Us during the review stage; a dedicated privacy contact and the operator’s details must be published before launch. The current site does not use enquiry data for automated decisions with legal or similarly significant effects. We will update this policy when services or data practices change.