Privacy policy for webx.md
Version dated 19 October 2026
This page explains what personal data the webx.md website collects, why we collect it, who can see it and what you can do about it. The website is the page of webx, a web studio that builds websites and services: it contains a description of our services, case studies and a brief form, and that is all.
1. Who is responsible for your data
The data controller is:
- "GARM INC" SRL
- Company ID (IDNO): 1017600028014
- Registered office: MD-2043, Chișinău, bd. Traian 2, office 135, Republic of Moldova
- Email for data protection matters: info@garm.email
- Phone: +373 79 97 3000
We process personal data under Law No. 133 of 8 July 2011 of the Republic of Moldova on the protection of personal data. If you visit the site from the European Union, the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) also applies.
2. What data we collect
2.1. The "Fill in the brief" form
You fill this in yourself. The fields are:
| Data | Required | Why we need it |
|---|---|---|
| Name | yes | to address you by name |
| Phone and/or email | at least one | to get back to you |
| Website | no | to see what you have today |
| Project type, budget, project description | no | to understand the task before our first call |
| Consent checkbox, date and time of submission | yes | to prove that consent was given |
The request is stored in the website database and, at the same time, sent by email to the company's general mailbox, info@garm.email.
2.2. Bot protection on the form
Before the form is submitted, it is checked by Cloudflare Turnstile, which confirms that a person rather than a script is sending the request. To do this, Cloudflare receives technical details about your browser and connection: IP address, browser and device type, and technical request parameters. We neither see nor store these details; we only receive the outcome of the check, pass or fail.
2.3. Technical logs
The website is served through the Cloudflare network (DNS, CDN) and protected by our own web application firewall (WAF). Both keep request logs: IP address, time, page requested and browser type. We use these records to fend off attacks and to investigate faults. We do not link them to any particular person.
2.4. What we do not collect
We do not ask for identity document details, payment card data, health information or any other special categories of data. The site is not aimed at children and is not designed to handle their data.
3. Why we process data, and on what legal basis
| Processing | Purpose | Legal basis |
|---|---|---|
| Data from the "Fill in the brief" form | to contact you, discuss the project and answer your question | your consent (the checkbox in the form); for EU visitors, Article 6(1)(a) GDPR |
| Consent record | to prove, if audited, that consent was given | the controller's legal obligation to demonstrate consent |
| Turnstile check, Cloudflare and WAF logs | protection against bots, attacks and abuse; keeping the site running | our legitimate interest in running a secure website; Article 6(1)(f) GDPR |
| Technical cookies | making the site work properly, remembering your language and your cookie choice | necessary for the operation of the site; Article 6(1)(f) GDPR |
We do not use your data for marketing newsletters, we do not sell it and we do not pass it to advertising networks. If you sent us a brief, we will contact you about it and nothing else.
4. Who we share data with
Your data is seen only by the people who need it to reply to you: the "GARM INC" SRL staff who run webx studio projects.
Technical service providers (processors) the site cannot run without:
| Provider | What it does | Where data is processed |
|---|---|---|
| Hetzner Online GmbH (Germany) | hosts the website servers and database | EU (Germany) |
| Cloudflare, Inc. | DNS, CDN, bot protection (Turnstile) | Cloudflare data centres worldwide; for transfers outside the EU, Cloudflare relies on the European Commission's standard contractual clauses |
| Our own mail server | delivers request emails to info@garm.email | EU |
We disclose data to public authorities only in response to a lawful request made in the manner prescribed by law.
There are no other recipients. If this list changes, we will update this section and the version date.
5. Where data is stored
The web server, the database and the mail server are located in the European Union. Cloudflare processes technical data in the data centre of its network closest to you, which may be outside the EU and Moldova; the legal mechanism for such transfers is the European Commission's standard contractual clauses included in Cloudflare's data processing agreement.
6. How long we keep data
| Data | Retention |
|---|---|
| Brief and related correspondence | 12 months after our last contact with you, then deleted or anonymised. If the brief leads to a contract, the data moves into the contract documents and is kept under their rules |
| Consent record | as long as the request itself, plus the period during which a regulatory audit is possible |
| Request emails in mailboxes | the same period as the request; when the request is deleted, the emails are deleted too |
| Cloudflare and WAF logs | up to 30 days, unless a record is needed to investigate an incident |
| Technical cookies | see section 8 |
If you withdraw consent earlier, we delete the request within 30 days of your request.
7. Your rights
Under Law No. 133/2011 and the GDPR you can:
- find out what data we hold about you and get a copy;
- correct inaccurate data;
- have your data erased (the "right to be forgotten") where there is no legal ground to keep it;
- restrict processing while a dispute about the data is being resolved;
- object to processing we carry out on the basis of legitimate interest;
- withdraw consent at any time. Processing before withdrawal remains lawful, but we stop using the data from that point on;
- receive your data in a machine-readable format and pass it to another controller (portability; for EU visitors);
- not be subject to automated decisions. There are none on this site: requests are read and handled by people.
How to exercise them: write to info@garm.email or call +373 79 97 3000. We reply within 30 days; if a request is complex, we will let you know and extend the deadline by no more than a further 60 days. To avoid handing data to the wrong person, we may ask you to confirm that you are the person the data concerns.
8. Cookies
The site uses technical cookies only, the ones it cannot work properly without:
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session | protects the form against forged requests, keeps the page working | until you close the browser |
| Interface language | remembers whether you chose Romanian, Russian or English | up to 12 months |
| Cookie choice | remembers that you have seen the cookie notice and how you answered | up to 12 months |
These cookies do not track you across other websites and do not send data to advertising networks. You can disable them in your browser settings, but the form and the language switch may then stop working correctly.
There are currently no analytics or advertising trackers on the site. If we decide to add visitor statistics, we will first ask for your separate consent through a cookie banner, and this section and the version date will change. No such cookies are set until you have consented.
9. How we protect data
The connection to the site is encrypted (HTTPS/TLS). Access to the request database is limited to staff who need it for their work, through personal accounts. The server sits behind a web application firewall, server access is key-based and actions in the system are logged. If a data breach occurs that affects your rights, we will notify the CNPDCP within the period set by law (for cases under the GDPR, within 72 hours) and notify you if the risk to you is high.
10. Complaints to the supervisory authority
If you believe we are processing your data unlawfully, please write to us first; most issues can be sorted out quickly. You are nevertheless entitled to go straight to the regulator:
National Centre for Personal Data Protection of the Republic of Moldova (CNPDCP)
MD-2004, Chișinău, str. Serghei Lazo 48
Phone: +373 22 820 801
Email: centru@datepersonale.md
Website: datepersonale.md
Visitors from the EU may also contact the data protection authority of the country where they live or work.
11. Changes to this policy
We update this document whenever something changes in how we process data: a new provider, a new form, analytics. The current version is always published on this page, with the version date at the top. For substantial changes (new purposes, new recipients) we will also notify the people whose requests we hold, using the contact details they gave us.
Questions about this document: info@garm.email.