Privacy Policy
LuWay – Vehicle Owner Search & Auto Marketplace
✅ ВАШИТЕ ДАННИ, ВАШИЯТ ИЗБОР — НАКРАТКО
Всичко, което давате на Luway, го давате доброволно. Никой не е длъжен да предоставя лични данни, за да използва Luway, освен технически необходимото за акаунт (имейл или вход с Google / Apple).
- Доброволни данни. Име, снимка, телефони, град, автомобили, регистрационни номера, документи, публикации, коментари, подаръци и местоположение се добавят само от вас и само ако искате. Можете да не ги попълвате и пак да използвате приложението.
- Вие решавате кое е публично. Телефоните, градът, подаръците и данните в профила имат настройка за видимост (Настройки → Редактиране на профила). Регистрационният номер се показва само след като сами добавите колата.
- Местоположението се използва само с ваше разрешение (SOS, шофьори наблизо, цени на горивата) и може да бъде изключено по всяко време от настройките на телефона.
- Известията могат да бъдат изключени по всяко време — в приложението или в настройките на телефона.
- Променяйте или изтривайте всичко, по всяко време: публикации, коментари, автомобили, снимки, телефони и данни в профила.
- Изтрийте акаунта си по всяко време, безплатно и без да посочвате причина: Профил → Настройки → Изтриване на акаунта. Профилът, автомобилите, обявите, публикациите и личните данни изчезват веднага; защитено копие се пази 30 дни само за законови задължения и предотвратяване на измами, след което се изтрива окончателно. Изпратените съобщения може да останат видими за получателите.
- Оттеглете съгласието си за всяка незадължителна обработка по всяко време; това не засяга вече извършената обработка.
- Не продаваме личните ви данни и не ги споделяме с рекламодатели.
- Вашите права: достъп, коригиране, изтриване, ограничаване, преносимост и възражение (GDPR). Пишете на info.studio085@gmail.com — отговаряме до 30 дни.
- Съдържание, което нарушава правилата на общността, може да бъде докладвано от всеки; съдържание, докладвано от няколко души, се премахва автоматично, а авторът получава известие с причината.
📜 Copyright
Certificate of Registration of Copyright and Related Rights Series PC Nr. 8403 dated 20.01.2026 Issued by the State Agency on Intellectual Property of the Republic of Moldova
© All Rights Reserved Authors: Alexandrov Pavel and Macovschi Tudor-Alexei
Effective Date: December 1, 2025 Last Updated: August 24, 2026 (Compliance with Law 195/2024) Version: 2.0
⚠️ IMPORTANT: By creating an account or using LuWay, you expressly confirm that you have read, understood, and fully accepted this Privacy Policy and Terms and Conditions.
If you do not agree, please do not use the application.
📋 2026 UPDATE: This Policy has been updated for compliance with Law No. 195/2024 on personal data protection of the Republic of Moldova (in force August 23, 2026), which transposes GDPR (EU) 2016/679 and replaces Law 133/2011.
1. Data Controller
Your data is processed by:
Alexandrov Pavel – natural person, citizen of the Republic of Moldova Address: Chisinau, Republic of Moldova Email: privacy@studio085.com Phone: +373 6840 1239
Within the meaning of Law 195/2024 / GDPR (EU Regulation 2016/679), Alexandrov Pavel is the Data Controller.
2. What Data Do We Collect?
2.1 Data Provided Directly by You
• First and last name (optional) • Email address (optional – when signing in via email) • Phone number – OPTIONAL (used only for verification and account recovery) • Profile photo (optional) • Data from published listings (brand, model, year, price, photos, description) • License plate numbers searched or entered • Messages sent to other users • Payment data for subscriptions (processed exclusively via Apple App Store, Google Play, and Stripe)
2.2 Automatically Collected Data
• IP address • Device type and model, OS version • Device ID (IDFA / Advertising ID – only with your consent for personalized ads) • Precise and approximate location data (only with explicit permission) • Technical data (crash logs, usage time, errors)
2.3 Location Data (detailed)
We collect location only if you grant explicit permission in the app:
Precise location (GPS) – for distance calculation, navigation, displaying local listings Approximate location – for regional filters and local pricing Background location – ONLY during active navigation and with separate consent
❌ We NEVER use background location for tracking or advertising
2.4 Stripe Payments (if you choose direct in-app payment)
When purchasing Premium/Dealer subscriptions via card:
• Card data (number, expiration date, CVV) NEVER reaches us • Transmitted directly to Stripe Inc. (USA) – PCI DSS Level 1 certified payment processor • We only receive a secure token and the last 4 digits of the card • Stripe stores card data encrypted and automatically deletes after expiration
✅ Bank card data is NOT stored on our servers and CANNOT be accessed by anyone on the LuWay team.
3. Where and How Do We Store Your Data?
All data is stored exclusively in Google Firebase (Google Cloud) – certified data centers:
• ISO 27001, 27017, 27018 • SOC 1/2/3, PCI DSS Level 1 • 100% GDPR compliance • AES-256 encryption at rest + TLS 1.3 in transit
🔒 Your data is NOT and will NEVER be sold, rented, or transmitted to third parties for purposes other than those strictly necessary for LuWay's operation.
4. What Do We Use the Data For? (Purposes and Legal Bases)
Pursuant to Law 195/2024 / GDPR Art. 6, we process data only on an identified legal basis:
| Purpose | Legal basis (Art. 6) |
|---|---|
| Searching and contacting owners by license plate number | Consent + legitimate interest |
| Publishing and managing auto listings | Performance of contract |
| Distance calculation, Google Maps navigation | Explicit consent (location) |
| Processing payments and subscriptions | Performance of contract |
| Notifications about messages, offers, account updates | Performance of contract + consent |
| Fraud and abuse prevention | Legal obligation + legitimate interest |
| App improvement, analytics | Legitimate interest (anonymised) |
| Direct marketing, promotions | Explicit consent (withdrawable) |
| Cooperation with authorities upon legal request | Legal obligation |
You may withdraw consent at any time: Settings → Privacy → Manage Consents or at privacy@studio085.com.
5. Who Do We Share Data With? (Recipients and International Transfers)
5.1 Recipients
| Provider | Purpose | Country | Transfer mechanism |
|---|---|---|---|
| Google Firebase | Storage, authentication, analytics | USA / EU | SCCs + ISO 27001 |
| Stripe Inc. | Card payment processing | USA | SCCs + PCI DSS Level 1 |
| Apple App Store | iOS subscriptions | USA | SCCs + Apple regulations |
| Google Play | Android subscriptions | USA | SCCs + Google regulations |
| Google Maps API | Navigation, distance calculation | USA | SCCs |
5.2 International Transfers (Law 195/2024 / GDPR Chapter V)
All transfers outside the Republic of Moldova are made under Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914/EU), ensuring an equivalent level of protection.
5.3 Authorities
We disclose data to authorities exclusively upon valid written legal request (court order, criminal investigation warrant). No voluntary access without legal basis.
6. Partner Offers (service, insurance, dealers)
All offers and ads in the app appear only based on prior agreement with the partner. Partners have NO direct access to your personal data unless you initiate contact.
7. Your Rights (Law 195/2024 / GDPR Art. 13–22)
You have the right AT ANY TIME and FREE OF CHARGE to exercise:
| Right | What it means | Response time |
|---|---|---|
| Access (Art. 15) | Copy of all data processed about you | 30 days |
| Rectification (Art. 16) | Correction of incorrect or incomplete data | 30 days |
| Erasure (Art. 17) | "Right to be forgotten" — deletion when no longer necessary | 30 days |
| Restriction (Art. 18) | Temporary suspension of processing | 30 days |
| Portability (Art. 20) | Data in machine-readable JSON/CSV format | 30 days |
| Objection (Art. 21) | Against processing based on legitimate interest or marketing | Immediately (marketing) |
| Automated decisions (Art. 22) | We do not subject you to solely automated decisions with legal effects | Permanent |
| Withdraw consent (Art. 7) | Without penalty, without retroactive effect | Immediately |
How to exercise your rights:
- 📧 Email: privacy@studio085.com
- 📱 In-app: Settings → Account → Privacy Rights
- 📞 Phone: +373 6840 1239 (Mon–Fri 9:00–18:00)
Supervisory authority: 🏛️ CNPDCP (National Center for Personal Data Protection)
- www.datepersonale.md · centru@datepersonale.md · (022) 820 801
It is not mandatory to contact us before lodging a complaint with CNPDCP, but direct resolution is usually faster.
8. How Long Do We Keep Data?
• Active account → as long as you use the app • After account deletion → data permanently deleted within 30 days • Technical logs → maximum 12 months • Stripe payment data → kept only by Stripe according to law
9. Protection of Minors (Law 195/2024)
The application is intended for persons of minimum 16 years of age.
- Under 16: may not create an account or use the services; we do not knowingly collect data from minors under 16.
- 14–15 years: pursuant to Law 195/2024, if access is necessary, written consent of the parent or legal guardian is required, verifiable upon request.
- If we discover an underage account created without parental consent: account deleted immediately, all associated data removed within 30 days.
⚠️ We do not display behavioural advertising to minors and do not use their data for marketing purposes.
10. Security Breach Notification (Art. 33–34, Law 195/2024)
In the event of a security incident (unauthorised access, loss, unauthorised disclosure):
- ⏱️ 72 hours — we notify CNPDCP from discovery of the breach, if it poses a risk to your rights
- 📧 Without delay — we notify you personally if the breach poses a high risk to your rights and freedoms
- The notification will contain: nature of the breach, categories of data affected, approximate number of persons affected, likely consequences, measures taken
11. Data on Luway Credits (L-Coins) and Boosts
If you purchase Luway Credits (L) or activate Listing Boosts, we additionally collect:
- Transaction history with the virtual currency (purchases, expenses, balance)
- Boost activity (boost type, boosted listing, date, cost)
- Auto-republish history (schedule: days, time, period)
Legal basis: Performance of contract (IAP purchase) + legitimate interest (fraud prevention) Retention: While account is active + 30 days after deletion
12. Policy Changes
Any significant change will be announced at least 30 days in advance via:
- 🔔 Push notification in the app
- 📧 Email to the address associated with your account
- 📌 Visible banner upon opening the app
Continued use after changes take effect constitutes acceptance.
13. Contact & Data Protection Officer
Controller: Alexandrov Pavel – natural person, citizen of the Republic of Moldova General email: info.studio085@gmail.com Website: https://luway.app
Contact for data rights (Law 195/2024): 📧 privacy@studio085.com · 📞 +373 6840 1239 ⏰ Response within max. 30 days (usually 48 hours, business days)
⚠️ DPO Note: Pursuant to Law 195/2024, appointment of an independent Data Protection Officer (DPO) is required for operators processing location data and conducting systematic monitoring. LuWay processes location data and license plate numbers, activities that may require a DPO. We commit to appointing an independent DPO by 31 December 2026 or earlier if CNPDCP requires. Until then, all requests are handled by Alexandrov Pavel at the address above.
🏛️ CNPDCP — www.datepersonale.md · centru@datepersonale.md · (022) 820 801
By continuing to use LuWay you confirm that you have read and fully accepted this Privacy Policy.
© 2025 Studio 085 – Alexandrov Pavel. All rights reserved.