Privacy and Cookie Policy

Version 1.0 · Effective from 25 August 2026

finskillbox.com is the platform through which MGS Fintech Prof S.R.L. provides online finance and accounting courses, certification, learning materials and mentoring. In order to create your account, enrol you on a course, issue your invoice and your certificate, we process the data described in this document.

This document explains what personal data we collect, why, on what legal basis, who we share it with, how long we keep it and what rights you have. It is drafted in accordance with Law no. 195/2024 of the Republic of Moldova on the protection of personal data (in force since 23 August 2026), which transposes Regulation (EU) 2016/679 (GDPR) and replaces Law no. 133/2011.

1. Who the data controller is

Controller	MGS Fintech Prof S.R.L.
IDNO	1022600053889
Registered office	65 Mitropolit Varlaam str., of. 231, MD-2012, Chișinău
Website	finskillbox.com
Contact for personal data matters	the contact form at finskillbox.com/contacts · phone +373 60 115 151 · in writing, at the address above
Phone	+373 60 115 151

The “controller” is the party that decides why and how your data is processed. For any question about this policy, or to exercise your rights, use the contact details above.

Data protection officer. We have not designated a data protection officer, because our core activity does not consist of large-scale systematic monitoring of individuals, nor do we process special categories of data on a large scale — the cases in which designation would be mandatory under art. 37 of Law no. 195/2024. The contact point for any personal data matter is the one given in section 1.

2. Applicable legal framework

Law no. 195/2024 on the protection of personal data — the principal act;
Law no. 284/2004 on electronic commerce;
Law no. 105/2003 on consumer protection;
Law no. 287/2017 on accounting and financial reporting, together with tax legislation — for the retention of accounting records.

The principles we observe (art. 5 of Law no. 195/2024): lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.

3. What data we collect, for what purpose and on what basis

We do not collect data “just in case”. Every category below has a concrete purpose and a legal basis provided by art. 6 of Law no. 195/2024.

Category of data	Purpose	Legal basis	Retention period
First name, last name, e-mail address, phone number	Creating your account, enrolling you on a course, course communication, learner support	art. 6(1)(b) — performance of a contract	for the life of the account, then 3 years
Account data: username, password (stored encrypted), settings, sign-in history	Authenticating you on the platform and keeping the account secure	art. 6(1)(b) — performance of a contract	until the account is deleted
Billing data: name or company name, IDNO/tax code, address, product purchased, amount	Issuing the invoice, bookkeeping and tax reporting	art. 6(1)(c) — legal obligation	5 years (accounting and tax records)
Payment transaction data: identifier, amount, status, last 4 digits of the card. Full card details are entered on Paynet’s secure page and are never disclosed to us	Confirming payment, issuing refunds under the refund policy	art. 6(1)(b) — performance of a contract; art. 6(1)(c) — legal obligation	5 years
Course participation data: courses you are enrolled on, lessons completed, progress, test results, completion date	Delivering the educational service, assessment and issuing the certificate	art. 6(1)(b) — performance of a contract	for the life of the account, then 3 years
The issued certificate: name, course title, date, registration number	Issuing the certificate and confirming its authenticity	art. 6(1)(b) — performance of a contract; art. 6(1)(f) — legitimate interest	10 years (certificate register)
E-mail address provided in order to download free materials	Sending the requested material; information about courses only where you tick a separate box	art. 6(1)(a) — consent	until consent is withdrawn
Messages sent through the contact form, by e-mail or to support	Answering questions and handling requests	art. 6(1)(f) — legitimate interest	2 years
Technical data: IP address, device, browser, pages visited, date and time	Operating and securing the platform, preventing unauthorised account sharing, diagnosing errors	art. 6(1)(f) — legitimate interest	up to 12 months in server logs
Data collected through analytics and marketing cookies	Statistics on platform usage and the effectiveness of course promotion	art. 6(1)(a) — consent	as set out in the table in section 4

We do not collect special categories of data (health, ethnic origin, political opinions, religious beliefs, sex life, biometric or genetic data). Please do not send us such data through the forms on the website.

3.1. Certificates

On completion of a course that includes certification, we issue a certificate in your name. For this purpose we process your first and last name as you provided them at enrolment, the course title, the completion date and the certificate registration number. We keep a register of issued certificates so that we can confirm the authenticity of a certificate at your request, or at the request of an employer to whom you have presented it. Basis: art. 6(1)(b) and (f).

3.2. Free downloadable materials

To download the free materials we ask for your e-mail address. We use it to send you the material you requested (basis: performing your request) and, only if you separately tick the relevant box, to send you information about our courses later on. The marketing tick box is not pre-selected and does not condition access to the material.

Cookies are small text files that the website stores in your browser. Some are indispensable for the site to work; others help us understand how the site is used, or show you relevant advertising.

4.1. The rule we apply

Strictly necessary cookies are set without your consent, because without them the site simply does not work. Basis: art. 6(1)(f).
Analytics and marketing cookies listed in section 4.2 are set on the basis of consent — art. 6(1)(a) together with art. 7 of Law no. 195/2024.

Where we stand right now, stated plainly. We are deploying a consent management tool that will let you accept or refuse each category before those cookies are set. Until that is live, control remains with you through the means below, and we do not use the data collected this way to make decisions about you individually.

block or delete cookies in your browser settings — see section 4.3;
install the official Google Analytics opt-out add-on: tools.google.com/dlpage/gaoptout;
turn off Google ad personalisation: myadcenter.google.com;
contact us (details in section 1) — on request we will exclude you from marketing processing and confirm in writing.

We will update this section as soon as the consent tool is live.

4.2. Cookies used on finskillbox.com

Category	Cookie / technology	Set by	Purpose	Duration
Strictly necessary	`PHPSESSID`	finskillbox.com	Maintains your session for the duration of the visit	Session
Strictly necessary	`woocommerce_cart_hash`, `woocommerce_items_in_cart`, `wp_woocommerce_session_*`	finskillbox.com	Remember the products in your cart and the contents of your order until checkout	Session – 2 days
Strictly necessary	`wordpress_logged_in_`, `wp-settings-`	finskillbox.com	Keep you signed in to your account and remember display preferences	Session – 1 year
Strictly necessary	`qtrans_front_language`	finskillbox.com	Remembers the chosen interface language (EN / RO / RU)	1 year
Analytics (consent only)	`_ga`, `_ga_*`	Google (Google Analytics 4, installed via Google Site Kit)	Aggregated statistics: how many visitors we have, which courses are read, where they come from	up to 2 years

Note. The list above reflects the configuration of the website as at the date shown in the header of this document. Suppliers may change cookie names and lifetimes, and we update the table at each revision of this policy. The exact list of cookies currently present in your browser can be seen at any time in your browser settings, in the section for our website.

4.3. Browser controls

At any time you can block or delete cookies in your browser settings (Chrome: Settings → Privacy and security → Cookies; Safari: Preferences → Privacy; Firefox: Settings → Privacy & Security). Blocking strictly necessary cookies may make it impossible to place an order or to log in.

5. Who we share data with

We do not sell or rent your data. We share it only with those categories of recipients without which the service cannot be provided, and only to the extent strictly necessary:

the online payment processor Paynet and the banks involved in the transaction — to authorise card payments and to process refunds;
the web hosting and technical maintenance provider — has technical access to the database in order to keep the website running and to make backups;
the e-mail platform through which we send confirmations, materials and, with consent, newsletters;
Google Ireland Ltd. / Google LLC — Google Analytics, only with your consent;
the lecturers and mentors involved in the course you are enrolled on — they have access to your name and your progress on that course, under confidentiality undertakings;
our accountant / accounting firm — for bookkeeping and tax reporting;
public authorities (the State Tax Service, law-enforcement bodies, the courts), where the law obliges us to provide information, or for the establishment, exercise or defence of a legal claim.

With every processor (a supplier that processes data on our behalf) we conclude a contract imposing confidentiality and security obligations at least equal to our own, in accordance with art. 28 of Law no. 195/2024.

6. Transfers outside the Republic of Moldova

Some of our technology suppliers (for example web analytics, advertising or e-mail services) are established, or host their servers, outside the Republic of Moldova, including in the European Union and the United States of America. Such transfers are carried out under Chapter V of Law no. 195/2024, on the basis of adequacy decisions or standard contractual safeguards provided by the supplier. You may request further information about the safeguards applied by contacting us (details in section 1).

7. How long we keep data

Specific periods are stated in the table in section 3. The general rules are:

data relating to an order or contract is kept for the duration of performance and then for the general limitation period (3 years) in case of claims;
accounting and tax records are kept for the periods required by law (as a rule 5 years);
data processed on the basis of consent is kept until consent is withdrawn;
once the period expires, data is deleted or irreversibly anonymised.

8. How we protect data

In accordance with art. 32 of Law no. 195/2024, we apply technical and organisational measures appropriate to the risk, including:

encrypted HTTPS/TLS connection across the entire website;
access to customer data limited to staff who need it for their duties, through individual accounts and strong passwords;
regular backups and prompt updating of the platform and its modules;
confidentiality clauses in our relationships with staff and suppliers;
an internal procedure for responding to security incidents.

In the event of a personal data breach that presents a risk to your rights, we notify the National Center for Personal Data Protection within 72 hours and, where the risk is high, we also inform you (art. 33–34 of Law no. 195/2024).

9. Your rights

As a data subject you have the following rights (art. 13–22 of Law no. 195/2024):

Right to be informed — to know what we do with your data; this document serves exactly that purpose.
Right of access — to obtain confirmation that we process your data, and a copy of it.
Right to rectification — to correct inaccurate data or complete incomplete data.
Right to erasure (“right to be forgotten”) — to request deletion where the data is no longer necessary, you have withdrawn consent, or the processing was unlawful.
Right to restriction of processing — to have processing “frozen”, for example while we verify a complaint you have made.
Right to data portability — to receive the data you provided to us in a structured, commonly used, machine-readable format, or to have it transmitted to another controller.
Right to object — to object to processing based on our legitimate interest; in the case of direct marketing your objection is unconditional and we honour it immediately.
Right to withdraw consent at any time, without affecting the lawfulness of prior processing.
Right not to be subject to automated decision-making producing legal effects concerning you.

10. How to exercise your rights

Send us a request using the contact details in section 1, stating the right you wish to exercise and the details that allow us to identify you (for example the order number, phone number or e-mail address used on the website). Where we have reasonable doubts about the identity of the requester, we may ask for additional information — solely for verification purposes.

We reply within one month at the latest from receipt of the request. In complex cases the period may be extended by a maximum of two months, in which case we inform you of the extension and its reasons within the first month. Exercising your rights is free of charge; we may charge a reasonable fee only for additional copies, or for manifestly unfounded or excessive requests.

11. Right to lodge a complaint

If you believe we have infringed your rights, please contact us first — most situations are resolved quickly and directly. You are nevertheless entitled at any time to lodge a complaint with the supervisory authority or to bring the matter before a court:

Authority	National Center for Personal Data Protection (CNPDCP)
Address	MD-2004, Chișinău, 48 Serghei Lazo str.
Phone	+373 22 820 801
E-mail	centru@datepersonale.md
Website	www.datepersonale.md

12. Children’s data

The website is not directed at children and we do not knowingly collect data from persons under 16 without the consent or authorisation of the holder of parental responsibility. If you become aware that a child has provided us with personal data, contact us (section 1) and we will delete it without delay.

13. Automated decision-making and profiling

We do not take decisions producing legal effects concerning you based solely on automated processing. The analytics and advertising tools we use (only with your consent) may build audience segments for advertising purposes, but these do not affect your rights and can be stopped at any time by withdrawing consent.

14. Changes to this policy

We may update this policy when our services, the technologies we use, or legal requirements change. The version in force is always the one published on this page, and the date from which it applies is shown at the top of the document. If the changes are substantial, we will notify you in advance through a visible notice on the website or by e-mail.

MGS Fintech Prof S.R.L., IDNO 1022600053889, 65 Mitropolit Varlaam str., of. 231, MD-2012, Chișinău. Personal data enquiries: the contact form at finskillbox.com/contacts · phone +373 60 115 151 · in writing, at the address above.

Privacy Policy