Privacy Policy
1. Introduction
This Privacy Policy (the "Policy") describes how the personal data of users of the EUROBRIDGE UA MD online platform (the "Platform"), available at https://eurobridge-uamd.org, is processed.
The Platform serves the cross-border cooperation grant programme between the Republic of Moldova and Ukraine, the Project EUroBRIDGE_UA_MD: Building Collaborative Pathways for Regional Development and Improved Administrative Capacity for EU Cohesion Policy Adoption in Ukraine and Moldova (the "Programme"), funded by the European Union and jointly managed by the Regional Development Agency of Odesa Region (RDAOR), Ukraine, the Municipal Centre for the Development of Entrepreneurship (CMDA / MCDE), Republic of Moldova (the "Managing Authorities"), and the consultancy company Hygia Consult (Romania).
This Policy supplements the Platform's Terms and Conditions of Use and must be read together with them. Data is processed in compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
2. Applicable legal framework
Processing is carried out in accordance with the applicable data protection legislation, in particular:
- Regulation (EU) 2016/679 of 27 April 2016 (GDPR), insofar as it is applicable;
- the legislation of the Republic of Moldova, namely Law No. 195 of 25 July 2024 on the protection of personal data (in force since 23 August 2026, as amended), which replaced Law No. 133/2011;
- the legislation of Ukraine in the field of personal data protection;
- the rules and obligations applicable to European Union funding.
3. The data controller and the data protection officer
3.1. The data controllers are the Managing Authorities, within the limits of their respective responsibilities under the Programme. Where they jointly determine the purposes and means of processing, they act as joint controllers.
3.2. For any question regarding the processing of data and for the exercise of rights, data subjects may contact the controller at: info@cmda.md.
3.3. Where a data protection officer (DPO) is appointed, the contact details are: info@cmda.md.
4. Definitions
Personal data: any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to their physical, physiological, mental, economic, cultural or social identity.
Processing: any operation performed on personal data, by automated or non-automated means, such as collection, recording, organisation, storage, retention, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, combination, blocking, erasure or destruction.
Data subject: the natural person whose data is processed (for example, the representative of an applicant or of a partner, an evaluator or a member of staff of a programme body).
Controller: the person or entity that determines the purposes and means of processing.
Processor: the person or entity that processes data on behalf of the controller (for example, a hosting service provider).
Recipient: the person or entity to whom the data is disclosed, including evaluators and the persons responsible for receiving the submitted materials.
5. Categories of data processed
Depending on the user's role and the stage of the Programme, the following categories of data may be processed:
- identification and contact data: surname, first name, position, the organisation represented, email address, telephone number;
- account and authentication data: username, login data, activity logs;
- data from the grant application and its annexes: information about the applicant and partners, the description of the project, the budget and supporting documents;
- data relating to contracting, reporting and monitoring: signed grant contracts, financial and narrative reports, monitoring documents;
- technical data: IP address, device and browser type, data collected through cookies strictly necessary for the operation of the Platform.
Please do not include in the uploaded documents special categories of data (for example, health data) unless this is strictly necessary and required under the Programme.
6. Purposes and legal bases of processing
The Managing Authority processes your personal data solely for the implementation of the Project EUroBRIDGE_UA_MD, for the following purposes and on the following legal bases:
6.1. Creating and administering accounts and ensuring the operation of the Platform. Legal basis: the performance of a contract or of pre-contractual measures and the legitimate interest in ensuring the security and proper functioning of the Platform.
6.2. Managing grant applications, evaluation, contracting, reporting and monitoring. Legal basis: the performance of a task carried out in the public interest related to the implementation of the Programme and the performance of the grant contract.
6.3. Compliance with legal, control, audit and reporting obligations, including towards the Managing Authorities, the European Commission and other authorised bodies. Legal basis: the legal obligation and the conditions of European Union funding.
6.4. Communicating with users regarding applications, projects and technical matters. Legal basis: the legitimate interest or the performance of the contract.
6.5. Where processing is based on consent, the data subject may withdraw their consent at any time, without affecting the lawfulness of processing carried out prior to the withdrawal.
6.6. Account registration. When creating an account you tick a separate, unticked-by-default box by which you consent to the processing of your data for the purpose of creating and managing the account and taking part in the Programme. Withdrawing this consent (by writing to info@cmda.md) does not affect processing already carried out, nor processing that has another legal basis (for example, audit obligations for submitted applications).
6.7. Eurobridge Helpdesk (AI assistant). The assistant is optional and is provided by an external provider (emmi-agent). It is loaded only after you give your consent, either in the cookie card or in the box shown before the assistant starts. It receives your IP address and the questions you type and stores display settings in your browser. Please do not type personal data in the chat. You can withdraw consent at any time via "Cookie preferences" in the footer. Legal basis: consent.
6.8. Proof of consent. For every consent or refusal we record the date and time, the version of this Policy, the wording shown, the language, the IP address and the browser user agent and, where applicable, the account. Legal basis: the legal obligation to be able to demonstrate consent (Law No. 195/2024, art. 7(1)).
6.9. Is providing the data mandatory? The data requested at registration (email address, name, organisation, country, password) are necessary to create an account; without them you cannot use the Platform. Applications, reports and their annexes are required by the rules of the Programme. Using the AI assistant is optional; refusing it does not limit access to the Platform.
6.10. The Platform is intended for representatives of organisations and is not addressed to children; persons under 14 may not create an account.
7. Who has access to data. Obligations of recipients
7.1. Access is limited to the persons who need the data to carry out their tasks under the Programme, on the basis of a system of roles and permissions.
7.2. Data may be accessed by or disclosed to: the authorised staff of the Platform Operator and of the Managing Authorities; the appointed evaluators; as well as the persons responsible for receiving, verifying and administering the submitted materials.
7.3. The persons responsible for receiving the materials, the evaluators and any other persons who, by virtue of their role, access the applications, reports and supporting documents are obliged to comply with this Policy and the applicable legislation. They process the data solely for the purpose of their tasks, are bound by the obligation of confidentiality, and may not use, disclose or transmit the data for other purposes. The obligation continues even after the capacity on the basis of which access was obtained has ended.
7.4. Data may also be processed by processors acting solely on the controller's instructions, under agreements that impose adequate safeguards. They are currently:
- SCALELAW SOLUTIONS SRL (the Platform Operator under the Terms and Conditions of Use): technical and operational administration of the Platform on behalf of the Managing Authorities;
- Hostinger: hosting of the Platform and its database (server located in Germany, European Union);
- Brevo: sending of transactional emails (account confirmation, password reset, notifications);
- emmi-agent: the AI Helpdesk assistant, only if you have consented to it (see 6.7);
- Google (Google Fonts): delivery of the fonts used by the Platform; Google receives the visitor's IP address when the fonts are loaded.
7.5. Data may be disclosed to the competent public authorities, control and audit bodies, and courts, where the law requires this or where it is necessary for the establishment, exercise or defence of a right.
8. Cross-border data transfers
8.1. By its nature, the Programme involves an exchange of data between the Republic of Moldova, Ukraine and, where applicable, the member states of the European Union. The data may be subject to cross-border transfers between these jurisdictions.
8.2. In the case of transfers, all the parties involved (the Platform Operator, the Managing Authorities, the evaluators, the persons responsible for receiving the materials and the processors) comply with the requirements of the competent national data protection authority and with the adequate safeguards provided for by the legislation applicable to each party.
8.3. Transfers are carried out only under the conditions permitted by law, on the basis of an adequacy decision, of adequate safeguards (for example, standard contractual clauses) or of other legal bases. Upon request, data subjects may obtain information about the safeguards applied.
8.4. Platform data are hosted in the European Union (Germany). When the fonts are loaded from Google's servers, the IP address may be transferred to Google LLC in the United States.
9. Retention period
9.1. Data is retained only for the period necessary to fulfil the purposes for which it was collected, including for the duration of the Programme and for the archiving, control and audit periods required by the rules on European Union funding and by national legislation.
9.2. Upon expiry of the retention periods, the data is erased, destroyed or anonymised under secure conditions.
9.3. Consent records (6.8) are kept for as long as the account exists and afterwards for as long as necessary to demonstrate the consent. The cookie / AI-assistant choice stored in your browser expires after 12 months, after which you are asked again.
10. Data security
10.1. The controller and the hosting and maintenance providers implement appropriate technical and organisational measures to protect the data against unauthorised access, loss, alteration or disclosure, including role-based access control, secure data transmission and activity logging.
10.2. Users contribute to security by keeping their authentication credentials confidential and by notifying without delay any suspicion of unauthorised use of the account.
11. Rights of data subjects
Under the conditions and within the limits provided for by the applicable legislation, data subjects have the following rights:
- the right of access to their own data: to request and receive a response regarding the processing of the data and, if so, access to the data and information about how it is processed;
- the right to rectification of inaccurate or incomplete data, without undue delay; the rectification is communicated to each recipient, except where this is impossible or involves disproportionate effort;
- the right to erasure of data (the "right to be forgotten"), under the conditions of the law, where you withdraw your consent and there is no other legal basis for processing;
- the right to restriction of processing; once restricted, the data may be processed only with your consent;
- the right to object to processing, where it serves a public interest or a legitimate interest of the controller; in the case of direct marketing, you may object at any time;
- the right to data portability, where applicable: to receive the data in a structured, commonly used and machine-readable format, and to transmit it directly to another controller, where technically feasible;
- the right to withdraw consent, where processing is based on consent;
- the right to lodge a complaint with the competent supervisory authority.
11.1. To exercise these rights, the data subject may send a request to the contact details indicated in Article 3. The controller responds within the time limits provided for by the applicable legislation.
12. Supervisory authorities
12.1. Data subjects have the right to lodge a complaint with the competent national supervisory authority, in particular:
- in the Republic of Moldova: the National Centre for Personal Data Protection (CNPDCP), datepersonale.md;
- in Ukraine: the competent national authority (Ukrainian Parliament Commissioner for Human Rights).
13. Cookies and similar technologies
13.1. Without asking for consent, the Platform sets only cookies that are strictly necessary for it to work: sessionid (sign-in session), csrftoken (protection against forged requests, up to 1 year) and django_language (interface language). Your choice in the cookie card is stored in your browser (localStorage, key eb_consent) for 12 months.
13.2. The Platform does not use analytics, advertising or tracking cookies. The only optional element is the Eurobridge Helpdesk AI assistant (emmi-agent), which is loaded only after you accept it and which stores display settings in your browser. You can change your choice at any time via "Cookie preferences" in the footer of every page.
14. Amendment of the Policy
14.1. This Policy may be updated periodically, in particular to reflect changes to the Platform, to the Programme or to the applicable legislation. Version 2026-10 brings the Policy into line with Law No. 195/2024 of the Republic of Moldova.
14.2. The updated version is published on the Platform, indicating the date of entry into force.
15. Contact
For any question regarding this Policy or the processing of personal data, you may contact us at: info@cmda.md. Further information about the Programme is available at https://eurobridge-uamd.org/info/.
This website was produced with the support of the European Union. Its contents are the sole responsibility of the author(s) and do not necessarily reflect the views of the European Union. Neither the European Union nor the granting authority can be held responsible for them.