Skip to content
Latest news

Compliance report

Updated

Report updated on 29 October 2026. Next review: when the legal entity is registered and before 23 March 2027.

This report shows, point by point, how COMUNICA.MD complies with the laws of the Republic of Moldova on the press, personal data and online services. We publish it for transparency towards readers, sources and partners. It describes the platform's measures and is not a legal opinion.

Legend: ✅ implemented · 🔄 in progress · ⏳ planned, with deadline

Applicable legal framework

  • Law No. 195/2024 on personal data protection — in force since 23 August 2026; replaces Law No. 133/2011. Authority: National Center for Personal Data Protection (CNPDCP).

  • Law on mass media (2026) — published in the Official Monitor on 23 September 2026; enters into force six months after publication and replaces Press Law No. 243/1994.

  • Law No. 284/2004 on electronic commerce — provider information, commercial communications, marketing cookies.

1. Controller identity

  • 🔄 Full controller details (legal name, IDNO, registered address, phone, VAT code) — published on the About, Contact and Privacy pages as soon as the legal registration is completed (Art. 12, Law No. 284/2004).

  • ✅ The platform is developed by SI Lab Platforms (Chișinău), part of the BLACK& group; the relationship is publicly disclosed.

2. Personal data protection (Law No. 195/2024)

  • ✅ Privacy policy with purposes, a legal basis for each processing, recipients, transfers, retention periods and rights.

  • ✅ Data minimisation: no advertising cookies, no profiling; statistics use an anonymous identifier recalculated daily, without storing IP addresses.

  • ✅ Double opt-in newsletter, one-click unsubscribe; unconfirmed sign-ups are deleted automatically after 7 days.

  • ✅ Retention periods enforced automatically every day: contact messages 12 months; IP and browser in the security log 90 days; the log 24 months; anonymous statistics 25 months; anti-abuse counters 2 days.

  • ✅ The article AI assistant automatically removes emails, phone numbers and identification codes from questions before sending them to the AI provider; questions are not stored.

  • ✅ Data subject rights: access, rectification, erasure, restriction, objection, portability; account export and deletion in the interface; reply within one month.

  • ✅ Minimum age of 14 for accounts, the newsletter and notifications.

  • ✅ Data hosted in the European Union (database in Ireland; server functions in Ireland).

  • ✅ Record of processing activities (Art. 30) — internal document, kept up to date.

  • ✅ Incident procedure: notifying the CNPDCP within 72 hours and informing affected people when the risk is high.

  • 🔄 Data processing agreements (DPA) with standard contractual clauses for US providers (Vercel, Resend, OpenAI, ElevenLabs) — signed in the name of the legal entity.

  • 🔄 Designated contact for data requests and incidents — appointed when the entity is registered. A data protection officer is not mandatory at the current processing volume; the decision is reviewed yearly.

3. Cookies and browser storage

  • ✅ Only strictly necessary cookies (language, sign-in); no advertising or third-party cookies.

  • ✅ Full list of cookies and local storage, with purpose and duration, in the Cookie policy.

  • ✅ No consent banner, because no cookie requires one; any new cookie that is not strictly necessary will only be enabled with prior consent.

4. Commercial communications and advertising (Law No. 284/2004)

  • ✅ Emails are sent only with the recipient's prior consent; every newsletter includes one-click unsubscribe.

  • ✅ Sponsored content is visibly labelled as advertising on the article page and in listings; its links are marked `sponsored`.

  • ✅ Press releases are labelled as content of the issuer, with the organisation's name; the newsroom is not their author.

  • 🔄 Mandatory provider information (Art. 12) — together with the controller identity (point 1).

5. Press activity (Law on mass media, 2026)

  • ✅ Editorial policy, Corrections policy and AI policy published.

  • ✅ Articles drafted with AI assistance are checked by an editor before publication; they are no longer published automatically.

  • ✅ Every article lists its sources, with a link to the original document.

  • ✅ AI-generated images are labelled "AI-generated image", noting that they are not photographs of the event; they do not depict identifiable real people.

  • ✅ Automatic Russian and English translations and the automatically generated daily briefing are labelled as such; they are based only on already published articles.

  • ✅ Conflicts of interest are disclosed in articles concerning the group the platform belongs to.

  • 🔄 "Ownership and funding" page (ownership structure and main funding sources) — after the legal entity is registered.

  • ⏳ Registration in the Register of ownership and funding transparency of media service providers (Ministry of Culture) — after the law enters into force, estimated 23 March 2027.

6. Security

  • ✅ Encrypted connections (HTTPS) across the site; content security policy (CSP).

  • ✅ Role-based data access; separate keys for internal services; log of administrative actions.

  • ✅ Abuse limiting on irreversibly hashed IP addresses.

Contact

For questions about this report or your data, use the contact form, subject "Personal data". Personal data complaints can also be sent to the CNPDCP.