Security Policy

1. General Provisions

This Security Policy regarding the processing of personal data establishes the rules, principles, and organizational and technical measures applied by S.R.L. "PANDA TUR" to ensure an adequate level of protection and security of personal data processed in the course of the company's business activities.

This Policy is developed in accordance with:

• Law No. 195/2024 on personal data protection;
• normative acts applicable in the field of personal data protection and information security;
• the principles of Regulation (EU) 2016/679 (GDPR), transposed into national legislation through Law No. 195/2024;
• other normative acts applicable to the activities of S.R.L. "PANDA TUR".

Starting from August 23, 2026, the general framework applicable to personal data protection in the Republic of Moldova is established by Law No. 195/2024 on personal data protection.

This Policy applies to all personal data processing activities carried out by S.R.L. "PANDA TUR", regardless of whether they are performed via IT systems, applications, websites, paper-based documents, or other means.

2. Data Controller

The personal data controller is:

S.R.L. "PANDA TUR" determines the purposes and means of personal data processing and is responsible for ensuring the compliance of processing operations with applicable legislation.

3. Purpose of the Policy

The purpose of this Policy is:

1. protecting the rights and freedoms of natural persons in the processing of personal data;
2. preventing unauthorized access to data;
3. preventing loss, destruction, alteration, or unauthorized disclosure of data;
4. establishing the responsibilities of employees and collaborators who have access to data;
5. ensuring data confidentiality, integrity, and availability;
6. mitigating risks associated with personal data processing;
7. ensuring an adequate level of security relative to the nature, volume, and risks of processing.

4. Principles of Data Processing

S.R.L. "PANDA TUR" processes personal data in accordance with the following principles:

1. lawfulness, fairness, and transparency;
2. purpose limitation;
3. data minimization;
4. data accuracy;
5. storage limitation;
6. integrity and confidentiality;
7. controller accountability.

Personal data is collected and used only to the extent necessary for the declared purposes and to fulfill applicable legal or contractual obligations.

5. Categories of Data Subjects

Depending on the business activity, S.R.L. "PANDA TUR" may process data related to:

• clients;
• potential clients;
• persons requesting information or offers;
• persons making bookings;
• users of the pandatur.md website;
• representatives of partners and suppliers;
• persons included in travel documentation;
• employees and collaborators;
• other persons whose data is necessary for providing travel services or fulfilling legal obligations.

6. Categories of Personal Data

Depending on the purpose of processing, the following categories of data may be processed:

6.1. Identification Data

• last name;
• first name;
• date of birth;
• citizenship;
• details from travel documents when required for completing a booking or performing the service.

6.2. Contact Data

• phone number;
• email address;
• domicile or residential address, when necessary.

6.3. Travel Services Data

• destination;
• travel period;
• preferences regarding tourist services;
• booking information;
• information required for issuing travel documents;
• information on requests and communications with the client.

6.4. Technical Data

When using the website and online services, depending on user settings and applicable legal basis, the following may be processed:

• IP address;
• browser type and version;
• operating system;
• technical identifiers;
• device data;
• website access data;
• data from cookies and similar technologies.

6.5. Communication Data

Information regarding requests sent to the company may be retained, including:

• request content;
• date and time of communication;
• contact details;
• history of communication with the client.

7. Purposes of Processing

Personal data may be processed for:

1. providing travel services;
2. requesting and managing offers;
3. making and managing bookings;
4. issuing required travel documents;
5. communicating with clients;
6. executing contracts;
7. fulfilling legal obligations;
8. managing relationships with partners and suppliers;
9. handling complaints and inquiries;
10. ensuring the security of IT systems;
11. preventing fraud and service abuse;
12. improving services and website functionality;
13. conducting statistical analysis under the law;
14. sending commercial communications when an appropriate legal basis exists;
15. protecting legitimate rights and interests of the company within legal limits.

Data will not be subsequently used in a manner incompatible with the purposes for which it was collected.

8. Legal Bases for Processing

Personal data processing is carried out solely based on a legal ground provided by applicable law.

Depending on the situation, the legal basis may constitute:

• the consent of the data subject;
• the necessity of performance of a contract or taking steps at the request of the data subject prior to entering into a contract;
• compliance with a legal obligation;
• protection of vital interests;
• performance of a task carried out in the public interest, where applicable;
• legitimate interest of S.R.L. "PANDA TUR" or a third party, while respecting the rights and freedoms of the data subject.

Consent shall not be used as a legal basis when processing can and must be carried out on another applicable legal ground.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9. Data Processing via the pandatur.md Website

The pandatur.md website may use information storage and access technologies, including cookies and similar technologies.

Cookies strictly necessary for the website's operation may be used to the extent permitted by applicable law.

Cookies or technologies used for analytics, advertising, marketing, or other purposes requiring consent will be activated only if the data subject has given valid consent.

The user must have the option to:

• accept cookie categories for which they wish to express consent;
• refuse cookies that require consent;
• subsequently modify choices;
• withdraw consent.

Cookie management is detailed in the Cookie Policy of S.R.L. "PANDA TUR".

10. Data Transfer to Third Parties

To provide travel services, personal data may be transferred, to the extent necessary, to:

• tour operators and travel service providers;
• hotels and accommodation facilities;
• airlines;
• transport operators;
• transfer companies;
• insurance companies;
• reservation systems;
• IT service providers;
• communication service providers;
• payment service providers;
• public authorities and other entities, when disclosure is required or permitted by law.

Data will be disclosed only to the extent necessary to achieve the relevant purpose and based on an appropriate legal ground.

11. Processors and Service Providers

When a third party processes data on behalf of S.R.L. "PANDA TUR", the company will take measures to ensure that processing is carried out under contractual terms and adequate guarantees of security and confidentiality.

Processors will process data only in accordance with the controller's instructions and for the established purposes.

12. International Data Transfers

In case personal data is transferred to recipients located outside the Republic of Moldova or in other jurisdictions, S.R.L. "PANDA TUR" will apply the requirements of applicable legislation governing international data transfers.

The transfer will be carried out only when an appropriate legal ground and safeguards provided by applicable law exist.

13. Employee Access to Data

Employee access to personal data is granted on a "need-to-know" basis. Each employee shall only have access to data necessary for performing their job duties.

Employees and collaborators who have access to data are obliged to:

• maintain data confidentiality;
• use data exclusively for professional purposes;
• not disclose data to unauthorized persons;
• not copy or transfer data without authorization;
• comply with internal security procedures.

The obligation of confidentiality continues even after the termination of employment or collaboration, to the extent provided by law and contract.

14. Technical Security Measures

S.R.L. "PANDA TUR" applies adequate technical measures proportionate to identified risks, including, as appropriate:

• use of secure connections;
• system access control;
• user authentication;
• individual passwords and protective measures for them;
• limitation of access rights;
• updating software and systems;
• malware protection;
• performing data backups;
• monitoring system access;
• logging relevant events;
• protecting databases;
• segmenting resource access;
• measures to protect devices used for data processing;
• other technical measures established according to risk assessment.

15. Organizational Measures

The company applies organizational measures to protect data, including:

• defining personnel responsibilities;
• periodic employee training;
• rules governing data access;
• incident management procedures;
• procedures for exercising data subject rights;
• risk assessment;
• regular verification of security measures;
• oversight of suppliers and processors;
• updating internal data protection documentation.

16. Security Incident Management

Any employee or collaborator who discovers or suspects:

• unauthorized access;
• data loss;
• accidental disclosure;
• data destruction;
• unauthorized modification;
• account compromise;
• cyberattack;
• loss of a device containing data;

is obliged to immediately inform the designated responsible person appointed by the company.

S.R.L. "PANDA TUR" will evaluate the incident and undertake necessary measures to limit consequences, document the incident, and, where applicable, notify the competent authority and/or inform data subjects according to applicable law.

17. Risk Assessment

S.R.L. "PANDA TUR" assesses risks associated with personal data processing and applies measures proportionate to the risk level.

The evaluation shall consider, as appropriate:

• nature of data;
• volume of data;
• number of data subjects;
• purposes of processing;
• technologies used;
• data recipients;
• international transfers;
• probability of an incident occurring;
• potential impact on data subjects.

For processing operations likely to result in a high risk to the rights and freedoms of natural persons, the company will evaluate the need to conduct a Data Protection Impact Assessment (DPIA).

18. Data Retention Period

Personal data is retained only for the period necessary to achieve the purpose for which it was collected or for the period required by applicable legislation.

After the expiration of the relevant period, data is:

• deleted;
• destroyed;
• anonymized; or
• archived, where retention is required by law.

Retention periods will be established depending on data category and processing purpose.

19. Data Subject Rights

Data subjects benefit, under statutory conditions, from applicable rights, including:

• right to be informed;
• right of access to data;
• right to rectification of data;
• right to erasure of data ("right to be forgotten");
• right to restriction of processing;
• right to data portability, where applicable;
• right to object;
• right to withdraw consent;
• rights regarding automated decision-making and profiling, where applicable.

Requests from data subjects are examined in accordance with timeframes and procedures specified by applicable law.

20. Exercise of Rights

To exercise rights regarding personal data, the data subject may contact S.R.L. "PANDA TUR" using contact details published on the company's website or through other official communication channels.

The company may request additional information necessary to verify the identity of the applicant when required to protect data and prevent unauthorized access.

21. Minors' Data

In cases where the provision of travel services involves processing minors' data, S.R.L. "PANDA TUR" will process such data only to the extent necessary to fulfill the legitimate purpose and in accordance with applicable legal requirements.

Minors' data will not be used for purposes incompatible with the purpose for which it was collected.

22. Personal Data Included in Travel Documents

When identity or travel document data is required for booking or providing travel services, it will be requested only to the extent necessary to perform the service or fulfill a legal obligation.

Access to such data will be limited to personnel who require it to perform their duties.

23. Use of Email and Communication Systems

S.R.L. "PANDA TUR" may use email, telephone, and other communication channels for:

• handling inquiries;
• booking-related communication;
• providing services;
• sending documents;
• notifying about service changes;
• commercial communications, provided an appropriate legal basis exists.

Commercial communications will comply with legal requirements regarding direct marketing and the individual's right to object or unsubscribe.

24. Responsibilities

Management of S.R.L. "PANDA TUR" is responsible for providing resources necessary for implementing data protection measures.

Designated personnel within the company are responsible, within their scope of duties, for:

• implementing security measures;
• managing access rights;
• monitoring incidents;
• training staff;
• handling data subject requests;
• collaborating with suppliers;
• periodically reviewing security measures.

In case the company designates a Data Protection Officer (DPO), their contact details will be communicated to data subjects and published in relevant company documentation.

25. Policy Review

This Policy is reviewed periodically and whenever:

• legislation changes;
• new IT systems are introduced;
• new processing operations are implemented;
• new categories of data emerge;
• new risks are identified;
• security incidents occur;
• organizational structure or responsibilities change within the company.

The updated version of the Policy shall be approved by company management.

26. Final Provisions

This Policy is mandatory for employees, collaborators, and persons who, in performing their duties for S.R.L. "PANDA TUR", have access to personal data.

No individual may process personal data outside the purposes and authority defined by the company and applicable law.

This Policy enters into force on the date of approval.