Annex to the TopHost.MD Terms and Conditions

Personal Data Processing Agreement

Annex to the TopHost.MD Terms and Conditions of Service

Version 1.1 · in force from 23 August 2026 · updated 14 October 2026

Concluded under Article 28 of Law No. 195/2024 on the Protection of Personal Data

Published at: https://tophost.md/en/page/dpa

Note on form: This Agreement is an integral part of the TopHost.MD Terms and Conditions and is deemed concluded in electronic written form (Article 28(8) of Law No. 195/2024) by accepting the Terms and Conditions when creating an account or placing an order. At the Client’s request, the Agreement may also be signed as a separate document with identical content. In the event of any discrepancy between language versions, the Romanian version published at https://tophost.md/ro/page/dpa prevails.

The Parties

TopHost.MD is the trademark under which hosting services are provided by the following companies, each of which is a separate legal entity registered in the Republic of Moldova with its registered office at the address indicated:

IT Concept SRL, IDNO/fiscal code 1010600017578, registered office: 196 Ștefan cel Mare și Sfânt Blvd., office 6, Chișinău, Republic of Moldova;

DATACOM SYSTEMS S.R.L., IDNO/fiscal code 1023600021236, registered office: 196 Ștefan cel Mare și Sfânt Blvd., office 6, Chișinău, Republic of Moldova;

SKYHOST SOLUTIONS S.R.L., IDNO/fiscal code 1024600035715, registered office: 196 Ștefan cel Mare și Sfânt Blvd., office 6, Chișinău, Republic of Moldova;

TopHost SRL, IDNO/fiscal code 1016600001544, registered office: 57 Nicolae H. Costin St., apt. 23, Chișinău, Republic of Moldova;

The Provider (the “Processor”) in relation to the Client is whichever of the companies listed above is indicated in the TopHost.MD client account and on the invoices issued to the Client for the respective Services. Only that company is a party to this Agreement vis-à-vis that Client and is liable towards it; the other companies acquire no rights and assume no obligations towards the Client under this Agreement. The listed companies do not form a single legal entity and are not jointly and severally liable. If invoicing for the same Services is taken over by another of the listed companies, the Client is informed through the client account and the invoice, and this Agreement continues, with identical content, between the Client and the new company, without any addendum being required.

Common contact details for data protection matters (valid for all companies): email privacy@tophost.md, tel. +373 22 11-10-80.

and

the Client – the legal entity or natural person identified in the TopHost.MD client account, hereinafter referred to as the “Client” or the “Controller”,

together referred to as the “Parties”, have agreed as follows:

1. Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in Article 4 of Law No. 195/2024 (the “Law”). This Agreement covers exclusively the services provided under the TopHost.MD brand in the course of the Provider’s activity in the Republic of Moldova.

“Services” means the services ordered by the Client under the Terms and Conditions: shared web hosting, email hosting, virtual private servers (VPS), dedicated servers, domain name registration and management, SSL certificates, backup and other related services.

“Client Data” means the personal data that the Client or its users upload, store, transmit or process through the Services, as a controller or as a processor for a third party, including the access logs of the Client’s domains generated by the Services.

“Sub-processor” means any processor engaged by the Provider to process Client Data on the Client’s behalf.

2. Subject matter and roles

1. This Agreement governs the processing of Client Data by the Provider on behalf of the Client in the course of providing the Services. The elements required by Article 28(3) of the Law – the subject matter, duration, nature and purpose of the processing, the type of data and the categories of data subjects – are described in Annex 1.

2. With respect to Client Data, the Client is the controller (or a processor for another controller, in which case the Provider acts as a sub-processor), and the Provider is the processor.

3. This Agreement does not apply to personal data that the Provider processes as an independent controller (account, billing and support data, security logs, domain registration data). Such data is governed by the TopHost.MD Privacy Policy.

4. The Client warrants that it has a lawful basis for processing Client Data, that it has informed data subjects as required by law, and that its instructions do not infringe the Law. The Client is solely responsible for the content it stores and for the configuration of its services (including applications, scripts, access rights and password policies).

5. Security of the Client’s applications. The Client bears full responsibility for the web applications it installs and runs through the Services: CMS systems, plugins, themes, extensions and any other software of its own, which must be licensed and kept up to date at versions without known vulnerabilities. If the Provider detects and notifies the Client of a vulnerability, an infection or an exposed version, the Client must remedy it (update, clean-up, deactivation) within 48 hours of the notification; otherwise, the Provider may suspend the account or the affected component to protect other clients and the infrastructure. Compromises, infections and breaches of the security of Client Data resulting from outdated, unlicensed, vulnerable or insecurely configured applications, weak passwords, or the conduct of the Client or its users are attributable solely to the Client, do not constitute a breach of the Provider’s obligations and do not entitle the Client to request the audit provided for in Article 8 where the cause is evidently on the Client’s side.

3. Obligations of the Provider (Article 28(3) of the Law)

The Provider undertakes:

1. Documented instructions (point (a)). To process Client Data only on the Client’s documented instructions, including with regard to transfers to third countries, unless the legislation of the Republic of Moldova requires the processing; in that case the Provider informs the Client before processing, unless the law prohibits such information on important grounds of public interest. The following constitute documented instructions: the Terms and Conditions, this Agreement, the order and configuration of the Services, the settings made by the Client in the control panels (cPanel, WHMCS, VPS panel) and requests submitted through the ticket system. The Provider immediately informs the Client if, in its opinion, an instruction infringes the Law.

2. Confidentiality (point (b)). To ensure that persons authorised to process Client Data have committed themselves in writing to confidentiality and have access to Client Data only to the extent necessary for providing the Services, technical support, security and maintenance.

3. Security (point (c), Article 32). To implement the technical and organisational measures described in Annex 2, ensuring a level of security appropriate to the risk. The Provider may update the measures provided that the overall level of protection is not reduced.

4. Sub-processors (point (d)). To comply with the conditions set out in Article 5 of this Agreement.

5. Assistance with data subject rights (point (e)). Taking into account the nature of the processing, to assist the Client by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Client’s obligation to respond to requests from data subjects (Articles 15–22 of the Law). Since the Client has full control over Client Data through the control panels, assistance generally consists of maintaining the access, export, modification and deletion functions. If the Provider directly receives a data subject request concerning Client Data, it forwards it to the Client without responding on the merits, unless the law requires otherwise.

6. Assistance with security, incidents and DPIA (point (f), Articles 32–36). To assist the Client in complying with its obligations regarding security, breach notification, impact assessment and prior consultation of the authority, taking into account the nature of the processing and the information available to the Provider. Assistance includes providing, at the Client’s request submitted by ticket from the client account, the access logs of the Client’s domains for the period during which they are retained (180 days, Annex 2, section B), exclusively for the Client’s own domains.

7. Deletion or return (point (g)). Upon termination of the Services, at the Client’s choice, to delete or return all Client Data and delete existing copies, unless the law requires storage. The obligation to return is deemed fulfilled by making the export and backup functions of the control panel available to the Client throughout the term of the Services, through which the Client can copy all Client Data on its own; the Provider does not prepare or transmit data by other means. The Client is solely responsible for exporting its data before the Services expire. The method and time limits are set out in Article 7.

8. Demonstrating compliance (point (h)). To make available to the Client all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the Law and to allow for and contribute to audits in accordance with Article 8.

4. Personal data breach

1. The Provider notifies the Client without undue delay and in any event within 48 hours of becoming aware of a security breach affecting Client Data (Article 33(2) of the Law), at the email address of the contact person in the client account.

2. The notification includes, to the extent the information is available: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and the contact details of the person responsible. The information may be provided in phases.

3. The Client, as controller, is responsible for notifying the supervisory authority (within 72 hours, Article 33(1)) and the data subjects (Article 34). The Provider does not notify the authority on the Client’s behalf, unless the breach also affects data for which the Provider is the controller.

4. The following do not constitute a security breach within the meaning of this Article: repelled attack attempts (scans, failed authentication attempts, DDoS attacks mitigated without access to data) and incidents caused exclusively by vulnerabilities in the Client’s applications or passwords, which the Provider nevertheless communicates to the Client when it detects them.

5. Sub-processors

1. The Client grants the Provider a general written authorisation (Article 28(2) of the Law) to engage the sub-processors listed in Annex 3, which is published and updated on the Agreement page at https://tophost.md/en/page/dpa.

2. The Provider informs the Client at least 30 days before adding or replacing a sub-processor, by email and/or by notice in the client account. The Client may object in writing, giving reasons, within 30 days. If the Parties do not reach a solution, the Client may terminate the affected Services without penalty, with a pro-rata refund of amounts paid in advance.

3. The Provider imposes on each sub-processor, by written contract, data protection obligations at least equivalent to those in this Agreement (Article 28(4)) and remains fully liable to the Client for the performance of the sub-processor’s obligations.

4. The following are not sub-processors: domain name registries and registrars (STISC (P.I. “Information Technology and Cyber Security Service” – the national .md registry) for .md, ROTLD for .ro, ICANN-accredited registrars for gTLDs), SSL certificate providers and payment processors, which act as independent controllers under their own legal or contractual obligations, as well as third parties to whom the Client itself transmits data through the Services.

6. International transfers

1. Web hosting, email, VPS and dedicated server services are provided exclusively within the territory of the Republic of Moldova, on the Provider’s own servers located in its own data centre in Chișinău (75 Alba Iulia St., building 12), to which only the Provider’s authorised staff have access. Client Data is not stored outside the Republic of Moldova.

2. The Provider does not transfer Client Data outside the Republic of Moldova. By way of exception, transfers may take place only: (a) on the Client’s express instruction (e.g. migration of the account to/from a server abroad); (b) in the course of registering international domain names and issuing SSL certificates, to the competent registries, registrars and certification authorities, which act as independent controllers, the transfer being necessary for the performance of the contract (Article 49 of the Law).

7. Duration, deletion and return of data

1. This Agreement applies for the entire duration of the Services and ends upon deletion of Client Data. The Agreement has no fixed term: it applies to all Services active in the client account on the date of conclusion, as well as to any Services ordered, added, modified or renewed subsequently in the same account, without any addendum being required.

2. Return of data. Throughout the term of the Services, until their expiry date, the Client may at any time generate and copy (export) all Client Data through the backup/export functions of the control panel (cPanel), or delete it itself. This is the sole method of returning data; the Provider has no obligation to prepare, extract or transmit Client Data by other means. The Client is solely responsible for copying (backing up) its own data before the Services expire.

3. Suspension and deletion after expiry. If the Services are not renewed by the Client, the account is suspended within 5 days of the expiry date (access is blocked, data remains intact) and remains suspended on the server for 14 days, during which reactivation by payment fully restores the service. After this period, the account is deleted from the server.

4. Restoration backup. After the account is deleted from the server, a backup copy from which the account can be fully restored is kept for no more than 3 months from the expiry date of the Services, subject to the same security and confidentiality measures. Within this period, the Client may request restoration of the account from backup (subject to payment for the service under the Terms and Conditions). If the Client does not request restoration within this period, the data is permanently deleted, without the possibility of recovery.

5. Early deletion. The Client may delete Client Data at any time before the Services expire, by its own means: (a) by removing files, databases and email accounts directly from the control panel; or (b) by cancelling the service from the client account using the cancellation option (immediate or at the end of the paid term). Upon immediate cancellation, the account is automatically deleted from the server; upon cancellation at expiry, the time limits in points 3–4 above apply. The cancellation request recorded in the client account constitutes a documented deletion instruction within the meaning of Article 28(3)(a) of the Law. The related backups are removed at the next automatic rotation; in the case of immediate cancellation, retention of a restoration copy is not guaranteed.

6. VPS. Data on the virtual disk is deleted when the resources are released, following the same suspension time limits; VPS backups (if the service includes backup or the Client has ordered it) are kept for no more than 1 month from the expiry date of the Services, during which the Client may request restoration; after this period, deletion is final, without the possibility of recovery.

7. Dedicated servers. No backups are provided for dedicated servers. If the Client does not request resumption of the Services, the data on the server is permanently removed within no more than 14 days from the expiry date of the Services, without the possibility of recovery. The Client is solely responsible for backups of the data on the dedicated server.

8. Legal exception and logs. After these time limits, the Provider may retain only data that it is required by law to store (e.g. accounting data), while maintaining confidentiality. The access logs of the Client’s domains and the security logs relating to the account are retained for 180 days from generation, regardless of the date of termination of the Services, after which they are deleted automatically.

8. Information and audit

1. The Provider makes available to the Client, on request: this Agreement, the description of security measures (Annex 2), the list of sub-processors, the backup and retention policy and, where available, audit reports or certifications of the data centre.

2. Escalation order. The audit is conducted in stages, with progression to the next stage permitted only if the previous stage has objectively, and with written reasons, proved insufficient: (1) provision of documentation and completion of a security questionnaire; (2) a remote session (video conference) with the Provider’s staff, with demonstrations that do not expose other clients’ data; (3) on-site inspection, as an exceptional measure.

3. Conditions of any audit: no more than once in any 12-month period (additionally only after a security breach that affected the Client and is not attributable to the Client’s applications, configurations or conduct – Article 2.5 – or at the reasoned request of the supervisory authority); prior written notice of 30 days, with prior written agreement on the scope, duration (maximum one working day), date and list of participants; conducted during working hours, without disrupting the operation of the services.

4. The auditor. The audit may be carried out by the Client or by an independent auditor mandated by it, who: is not a competitor of the Provider and does not provide services to a competitor of the Provider; signs in advance a confidentiality undertaking directly with the Provider; identifies itself and acts only within the limits of the Client’s written mandate.

5. Limits of the audit. The audit does not include and may not require: (a) logical or physical access to systems, servers or environments shared with other clients, or to other clients’ data – for these, documentation only is provided; (b) access, in any form and under any conditions, to the Provider’s administration panels and interfaces (WHM, WHMCS, hypervisor, management consoles) – such access is absolutely excluded, for any client and any auditor, and cannot be the subject of any derogation; (c) copying of data or installation of tools in the Provider’s systems; (d) running scans or penetration tests – these are permitted only under a separate written agreement, exclusively on the Client’s own services (its website or VPS) and in no case on the Provider’s infrastructure, panels or shared systems; (e) disclosure of information that would jeopardise the security of the Provider or of third parties (passwords, keys, firewall configurations, detailed network architecture). Evidence is presented exclusively by the Provider’s staff, in the form of policies, extracts, screenshots or anonymised demonstrations, from the Provider’s equipment.

6. Physical access to the data centre. For services provided on the Provider’s own infrastructure (shared hosting, email, VPS, dedicated servers), on-site inspection is not offered – stage (3) is carried out exclusively through documentation, photo/video evidence presented by the Provider and, where applicable, certifications or independent audit reports, since physical access by a client to the shared server area would itself constitute a security risk for other clients. Physical access may be relevant and granted only in the context of a possible colocation service for the Client’s own equipment, exclusively to that equipment, permanently accompanied by the Provider’s staff, without photographing/filming of common areas.

7. Costs. The Client bears its own costs and those of its auditor. The Provider’s staff time exceeding 4 cumulative hours per audit (preparation, questionnaires, sessions) is invoiced at the hourly rate of MDL 350/hour, communicated in advance.

8. Results. The audit report is confidential, is provided in full to the Provider as well, and may not be disclosed to third parties without the Provider’s written consent. Any non-conformities found are remedied by the Provider within a reasonable agreed period; the remedy concludes the audit.

9. The Provider informs the Client if the supervisory authority carries out an inspection concerning Client Data, to the extent permitted by law.

9. Requests from authorities

If the Provider receives from a public authority (criminal investigation body, court, CNPDCP, etc.) a binding request for access to Client Data or for its preservation, it verifies the lawfulness of the request, provides only the data strictly requested and informs the Client, unless the law prohibits such information. The Provider documents all requests of this kind.

10. Liability

1. Each Party is liable for damage caused by failure to comply with its obligations under the Law and this Agreement. The Provider is liable only for damage resulting from processing carried out in breach of the obligations specific to processors or of the Client’s lawful instructions.

2. The Provider’s total liability under this Agreement is subject to the limitations in the TopHost.MD Terms and Conditions, to the extent permitted by law; the limitations do not apply to damage caused intentionally or through gross negligence.

3. The Client indemnifies the Provider for any sanction or claim resulting from the Client’s instructions, from the absence of a lawful basis for processing, or from the content stored by the Client.

11. Final provisions

1. This Agreement prevails over the Terms and Conditions with regard to the processing of Client Data. In all other respects, the Terms and Conditions remain applicable.

2. The Provider may update this Agreement to reflect changes in legislation or in the Services, with 30 days’ notice to the Client; changes may not reduce the level of protection. The current version, with its effective date, is published at https://tophost.md/en/page/dpa.

3. The Agreement is governed by the laws of the Republic of Moldova. Disputes are settled amicably and, failing that, by the competent courts in Chișinău.

4. The Agreement is deemed concluded in electronic written form by acceptance of the Terms and Conditions (Article 28(8) of the Law). The Provider keeps a record of acceptance (date, version, account identifier). If signed as a separate document, the date of signature is the date of conclusion, and the content is identical to the published version.

5. Underlying contract. The contractual relationship between the Parties under which the Services are provided consists of the TopHost.MD Terms and Conditions accepted in the client account (contract in electronic written form), together with the orders placed in the account. This Agreement is not conditional on the existence of a separately signed paper contract; if such a contract exists, the Agreement supplements it.

Annex 1 – Description of the processing (Article 28(3) of the Law)

Subject matter of the processing. Provision of web hosting, email, VPS/dedicated server, backup and related Services, which involve storing, transmitting and making Client Data available on the Provider’s infrastructure.

Duration of the processing. For the term of the Services, plus the deletion period under Article 7.

Nature of the processing. Storage, hosting, transmission (web and email traffic), backup and restoration, copying for migration at the Client’s request, deletion. Generation and retention of the access logs of the Client’s domains (visitors’ IP addresses, resources accessed, date/time) for 180 days, made available to the Client in the control panel and on request. The Provider does not analyse, index or use the content of Client Data for its own purposes; human access takes place only for technical support at the Client’s request, for security (e.g. automated malware scanning) or on the basis of the law.

Purpose of the processing. Exclusively the performance of the Services ordered by the Client, in accordance with its instructions.

Type of personal data. Determined by the Client. Typically: identification and contact data (name, email, telephone, address), account data of website users (usernames, encrypted passwords), the content of electronic correspondence, online transaction data, visitors’ IP addresses (including in access logs), and any other data stored by the Client. The Client is responsible if it stores special categories of data (Article 9) or data relating to criminal convictions (Article 10) and must apply additional measures (e.g. application-level encryption).

Categories of data subjects. Determined by the Client. Typically: the Client’s customers, users, subscribers and website visitors, the Client’s employees and partners, and email correspondents.

Location of the processing. Exclusively the Republic of Moldova – TopHost.MD’s own data centre, 75 Alba Iulia St., building 12, Chișinău.

Provider’s contact person. Igor Russu, administrator / data protection officer (IT Concept SRL, DATACOM SYSTEMS S.R.L., SKYHOST SOLUTIONS S.R.L.); Maxim Cartin, administrator (TopHost SRL). Common contact: privacy@tophost.md, +373 22 11-10-80.

Annex 2 – Technical and organisational security measures (Article 32)

The Provider maintains the following measures, adapted to the nature of hosting services. Measures applicable to the content of the Client’s applications and accounts (passwords, CMS updates, access rights of its own users) remain the Client’s responsibility.

A. Physical security and infrastructure

• Own servers, located in the Provider’s own data centre in Chișinău, with controlled physical access, redundant power supply (UPS/generator), climate control and an active fire protection system (automatic detection and suppression).

• The building housing the data centre has permanent physical security (24/7) and is equipped with a video surveillance system.

• Physical access to equipment exclusively for the Provider’s authorised staff, on the basis of a named list; no third party has access to the servers.

B. Logical access control and logging

• Administrative access to servers exclusively via SSH with keys and/or multi-factor authentication, from authorised IP addresses; named accounts, no shared accounts; principle of least privilege.

• Multi-factor authentication available (and recommended) for the Client’s panels (WHMCS, cPanel); strong password policies; automatic blocking of repeated attempts (cPHulk, fail2ban).

• Account isolation on shared servers: CloudLinux CageFS and LVE (per-account limits, virtualised file system), so that one account cannot access another account’s data; for VPS – isolation at hypervisor level (Proxmox KVM).

• Logging of administrative access and relevant operations; review of access rights when staff leave.

• Access logs of the Client’s domains (web, including SSL): the current log is available to the Client in cPanel (Metrics → Raw Access); a compressed copy of each day is automatically archived on the server, in an area accessible exclusively to the Provider’s administrators, and is retained for 180 days, after which it is deleted automatically. Logs are provided to the Client on request (Article 3.6). Server authentication, email and security logs are also retained for 180 days.

C. Protection of data in transit and at rest

• Free SSL/TLS certificates (AutoSSL / Let’s Encrypt) for all hosted domains; TLS for webmail, IMAP/POP/SMTP, FTP (FTPS/SFTP) and control panels.

• User passwords stored only in hashed form; backups stored on media with restricted access.

D. Protection against attacks and malware

• Network and server-level firewall; DDoS attack detection (FastNetMon) with alerting and network-level anti-DDoS protection through Voxility (filtering/scrubbing of traffic in the event of an attack, before it reaches the Provider’s servers), a service contracted through the Provider’s local connectivity provider.

• Imunify360 on shared hosting servers: web application firewall (WAF) with ModSecurity rules, permanent proactive protection (real-time blocking of malicious code execution), full anti-malware scan performed weekly, plus automatic scanning of new/modified files, blocking of malicious bots and brute-force protection.

• Transparency for the Client: in cPanel, the Client has real-time access to the security reports of its account (infected files detected, clean-up actions, security issues) and can directly monitor and remedy the state of its own account.

• Anti-spam/anti-virus filtering for email (SpamAssassin, server-level antivirus); SPF/DKIM/DMARC available for the Client’s domains.

• Security updates applied regularly to the operating system, kernel (KernelCare/CloudLinux), control panels and stack components (LiteSpeed, PHP, MariaDB).

E. Availability, resilience and backup

• Automatic backups of shared hosting accounts, generated by JetBackup in incremental cycles of 24–72 hours (depending on the server and archiving mode) and stored on two backup servers separate from the production servers; copies are retained and available for restoration for at least 30 days; restoration is available directly to the Client, self-service, from cPanel.

• For VPS (if the service includes backup or the Client has ordered it): automatic backups – 3 copies renewed by rotation, retained for 7 days – stored on a dedicated backup storage server (Proxmox Backup Server, PBS), separate from the production nodes; restoration is performed at the Client’s request, by ticket. In the absence of a backup service, the Client is responsible for its own backups.

• Shared hosting servers and VPS nodes use exclusively disks in RAID 10 configuration, to ensure both performance and fault tolerance: data remains available and intact if a disk fails, and the disk can be replaced without service interruption.

• Permanent monitoring of servers and the network (Zabbix, Grafana, automatic alerts), periodically tested restoration procedures; additional hardware redundancy (dual power supplies, hot-swap components).

F. Organisational measures

• Confidentiality undertakings signed by all staff with access to data; periodic data protection training; internal instructions for support and administrators.

• Security incident management procedure with notification deadlines; incident register.

• Backup and retention policy; secure deletion of data upon termination of services and upon decommissioning of storage media.

• Staff access to the content of the Client’s accounts only at the Client’s request (ticket) or in the event of a security incident, with a record kept.

• Annual review of security measures (Article 32(1)(d)).

Annex 3 – List of sub-processors

The current version is published on the Agreement page at https://tophost.md/en/page/dpa. Date of last update: 14 October 2026. The infrastructure (servers, data centre) is owned and operated entirely by the companies operating under the TopHost.MD trademark, in the Republic of Moldova; no third party outside them has access to the equipment or the data.

Authorised sub-processors: the other companies operating under the TopHost.MD trademark, listed in the section “The Parties”, together with their staff – to the extent that the administration of the shared infrastructure and the technical support for the Client’s Services are provided by a company other than the Provider indicated on the invoice (infrastructure administration, technical support); data processed: all Client Data, to the extent necessary; location: Republic of Moldova. These companies are subject to the same confidentiality and security obligations as the Provider (Article 5.3).

Independent controllers (not sub-processors) with which the Provider shares data in the performance of the contract: STISC (the national .md registry, nic.md), ROTLD (the .ro registry), Enom (gTLD registrar), NETIM (registrar for European extensions), SSL certification authorities (Let’s Encrypt; Sectigo, RapidSSL, GeoTrust through the reseller GoGetSSL), payment processors Bpay, RunPay and MAIB – these process the Client’s data (as a person), not Client Data (the hosted content), and are described in the Privacy Policy. Internet connectivity providers (local electronic communications operators in the Republic of Moldova) provide exclusively the transport of traffic (“mere conduit”), without access to the content of Client Data, act under their own electronic communications legislation and are not sub-processors.

Signing as a separate document

This Agreement is concluded in electronic written form by accepting the Terms and Conditions in the client account and does not require separate signature. Clients who need a signed copy (for example for their own audit or for their customers) may request, by ticket from the client account, the signable version of the Agreement, with identical content; it is signed by electronic signature (MSign/MPass) or by hand and countersigned by the Provider within no more than 3 working days.