Privacy Policy

PRIVACY POLICY 

Inther Software Development SRL (“ISD”) – isd-soft.com 

Field	Details
Last updated	21.08.2026
Legal framework	Law No. 195/2024 on Personal Data Protection (in force from 23.08.2026) and, where applicable, Regulation (EU) 2016/679 (GDPR)
Classification	Public

This Privacy Policy explains how Inther Software Development SRL processes personal data when individuals interact with our website, communicate with us, attend events or webinars, subscribe to our communications, take part in recruitment activities or interact with us in connection with our services. 

1. Who we are 

Inther Software Development SRL (“ISD”, “we”, “us” or “our”) is a software development company registered in the Republic of Moldova. This Privacy Policy applies to the isd-soft.com website. For the processing activities described in this Privacy Policy, ISD generally acts as a data controller, meaning that we determine the purposes and means of processing personal data. 

Data controller: Inther Software Development SRL 

Registered address: 33/1 Bulgară St., Chișinău, MD-2001, Republic of Moldova 

Data protection contact point: Tamara Adam, Data Protection Coordinator 

E-mail: dataprivacy@isd-soft.com 

Telephone: +373 22 996 170 

2. Legal framework 

We process personal data in accordance with applicable data protection legislation. In particular, Law No. 195/2024 on Personal Data Protection of the Republic of Moldova has been in force since 23 August 2026. 

3. Personal data we collect 

3.1 Information you provide directly 

Website forms and downloadable content. When you submit a form on our website, for example to subscribe to our newsletter, download a guide, brochure or other gated content, register for an event or webinar, request a demonstration or contact us, we collect the information you enter in the form. Depending on the form, this may include your name, e-mail address, telephone number, company, job title, country, the content of your message, the content or event you requested, your communication preferences and the consents you give or refuse, together with the date and time of the submission. We also collect any other information you choose to provide through a website form. Technical information recorded when a form is submitted is described in Section 3.3. 

Business enquiries and communications. When you contact us or request information, a demonstration, a price quotation or other materials, we may collect your name, professional contact details, company, job title, the content of your request and a record of our correspondence. 

Recruitment. When you apply for a position or otherwise take part in a recruitment process, we may collect your name, contact details, CV, educational and professional history, professional skills and qualifications, portfolio or work samples, interview notes and assessments, references where applicable, availability, salary expectations and other information you provide during the recruitment process. 

Events and communications. When you register for or attend an event or subscribe to our communications, we may collect contact details, organisation, job title, registration and attendance information, communication preferences and feedback. 

Services and business relationships. When you or your organisation interact with ISD as a client, supplier, partner or other business contact, we may collect names, professional contact details, job titles, contractual or transactional information, correspondence and other information necessary to manage the relationship. 

We request only the personal data relevant to the purpose concerned and avoid collecting details such as marital status or citizenship, unless a legal requirement imposes them. Please do not provide special categories of personal data, such as information about health, religion, political opinions, trade-union membership, biometric or genetic data, unless this information is expressly requested, is relevant to a legitimate purpose and its processing is permitted by applicable law. If special-category data that is not necessary is provided to us, we will limit its use and, where appropriate, delete it. 

3.2 Information obtained from other sources 

For recruitment and professional networking purposes, we may obtain professional information about potential candidates from publicly accessible professional sources, professional networking platforms, recruitment platforms, recruitment agencies, referrals, former employers or references, where permitted by law. This information may include name, professional contact details, location, professional history, education, skills, qualifications and other publicly available professional information. 

Where personal data has not been obtained directly from you, we will provide the information required by applicable law within the applicable time limit, subject to legal exceptions. 

3.3 Information collected automatically 

When you use our website, we may collect technical and usage information such as IP address, browser and device type, referring page, pages visited, date and time of access, session duration and approximate location. When a contact form is submitted, the notification message sent internally includes the IP address and the referring page, and the history of pages visited before submission may be associated with the request; geolocation through forms is not active. Non-essential analytics or marketing technologies are used only in accordance with the applicable consent requirements. Further information is available in our Cookie Policy. 

4. Why we process personal data and our legal bases 

We process personal data only on an appropriate legal basis. The legal basis depends on the specific purpose and circumstances of the processing. 

Business enquiries and communications. When you contact us or request information, a quotation, a demonstration or other business communication, we process the information necessary to respond to your request. Depending on the circumstances, the legal basis is steps taken at your request before entering into a contract or our legitimate interest in responding to and managing business communications. 

Recruitment for a position you apply for. We process your information to assess your application, communicate with you, arrange interviews and take other steps related to a possible employment relationship. The main legal basis is steps taken at your request before entering into an individual employment contract. We may also process information where necessary to comply with applicable legal obligations. 

Identifying and contacting potential candidates. We may identify and contact professionals who have not applied directly to ISD, where we reasonably consider that a professional opportunity may be relevant to them. We rely on our legitimate interest in identifying qualified candidates and managing the recruitment process, after considering the interests, rights and reasonable expectations of the person concerned. When we first contact a candidate we have identified, we refer them to this Privacy Policy: Recruitment Data Privacy | ISD | Software Development 

Talent pool and future opportunities. Where we ask for your agreement to keep your candidate information for future opportunities after a recruitment process has ended, we may rely on your consent. If a different legal basis applies to a particular identification or recruitment activity, we will provide you with the relevant information. 

Events and gated content. We process registration data to organise the event and communicate logistical information, on the basis of steps taken at your request or our legitimate interest in organising the activity. Registration data is not used for recruitment, newsletters or other communications unless you have been informed and there is a legal basis (for example, your separate consent). 

Photos and videos. For portraits, interviews and testimonials in which you are the main subject, we generally rely on explicit consent; for general images documenting an event, we inform you in advance that they will be taken and how they will be used. 

Provision of services and contract management. We process the personal data necessary to provide services, manage relationships with clients and suppliers, administer contracts, invoice and communicate about our activity. The legal basis may be the performance of a contract, steps prior to entering into a contract, compliance with a legal obligation or, where appropriate, our legitimate interest in the ordinary administration of the business. 

Legal and regulatory compliance. We may process personal data where necessary to comply with legal and regulatory requirements in employment, accounting, taxation or other areas, or to establish, exercise or defend legal claims. 

Website operation and security. We process the information necessary to operate and secure our website, systems and networks, prevent fraud and abuse, and protect our users and intellectual property. Where applicable, this processing is based on our legitimate interests. 

Non-essential analytics and tracking. Where analytics or other non-essential tracking technologies require consent, we use them only after obtaining the necessary consent. 

Newsletters and direct electronic marketing. Where the law requires it, we send newsletters and promotional electronic communications on the basis of consent. You may unsubscribe or withdraw your consent at any time. 

Where we rely on legitimate interests, we assess whether the processing is necessary and proportionate and whether our interests are overridden by your interests, rights or freedoms. Where processing is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of the processing carried out before withdrawal. 

5. Processing specific to recruitment activities 

ISD may process candidate information received directly from candidates or lawfully obtained from professional networks, recruitment platforms, recruitment agencies, referrals and other professional sources. We use this information to identify potential candidates, assess their suitability for available positions, communicate about opportunities, arrange interviews, document recruitment decisions and, where appropriate, consider candidates for future opportunities. 

Where we intend to contact a reference named by a candidate, we contact that reference only after the candidate has been informed that this will happen, and told what information will be requested. 

Where a position is linked to a client project, the candidate’s information may be shared with that client, to the extent that there is a legal basis for the disclosure and the transfer is necessary for the recruitment or hiring process. Candidates will be informed, as appropriate, before or at the time of such disclosure. 

This Privacy Policy is accessible through a link on our careers page and in job advertisements, so that candidates can read it before submitting an application. 

Applications are managed in an ISD system installed on our own servers in the Republic of Moldova, without an external candidate-management provider. 

Detailed information for candidates, in Romanian and English, is available in the Information Notice on the processing of personal data in the recruitment process (Recruitment Data Privacy): isd-soft.com/recruitmentdataprivacy/. 

6. How long we keep personal data 

We keep personal data only for as long as necessary for the purpose for which it was collected and to meet applicable legal, regulatory, contractual, accounting, dispute-resolution and security requirements. We review the personal data we hold periodically. 

Recruitment for a current vacancy. We keep recruitment information for the duration of the recruitment process and for up to 24 months after it ends, where necessary to document the process, to handle possible legal claims or to comply with legal obligations. 

Talent pool and future opportunities. Where retention is based on your consent, we may keep your candidate information for up to 36 months from our last relevant contact with you, unless you renew your consent or request earlier deletion. 

Rejected candidates, references and sourcing. Rejected applications are kept for up to 24 months after the process ends; professional references, 12 months from collection; data obtained through sourcing, where the person does not respond, for at most 12 months. When the period expires, the data is deleted or anonymised. 

Successfully hired candidates. Relevant recruitment information may become part of the personnel file and will subsequently be kept in accordance with the applicable employment, accounting and archiving requirements. 

Newsletter and marketing contacts. We keep your contact details until you unsubscribe or withdraw your consent. We may keep the minimum information necessary to record and respect your unsubscribe choice. 

Events. Attendee lists are kept for 12 months after the event, unless there is another legal basis. 

Contact-form enquiries. We keep enquiries for as long as necessary to respond and to manage any resulting commercial relationship, and afterwards only for as long as necessary for record-keeping and the defence of rights, for a period that we review periodically. 

Gated content downloads and event registrations. We keep the information submitted to download a guide, brochure or other gated content, or to register for an event or webinar, for as long as necessary to provide the requested content or to organise the event and communicate about it, and afterwards only for as long as necessary for record-keeping and the defence of rights, for a period that we review periodically. Where you have also subscribed to our newsletter, your contact details are kept as described for newsletter and marketing contacts. 

Information about our activity and services. We keep relevant information for the duration of the contractual or business relationship and afterwards for the periods required by applicable law or reasonably necessary for record-keeping and legal claims. 

Website analytics. For Google Analytics 4, event data is kept for 2 months and user data for 14 months. Analytics information is kept according to the configured retention period, described in our Cookie Policy and in the settings of the analytics service used. 

7. Sharing and disclosure of personal data 

We do not sell or rent personal data. Depending on the processing activity, we may disclose personal data to hosting and cloud infrastructure providers; IT support and security providers; recruitment and human-resources management platforms; recruitment agencies and other recruitment service providers; e-mail, communication, CRM and collaboration providers; analytics providers, where permitted; professional advisers such as lawyers, auditors and accountants; and other service providers needed to support our business. 

We may also disclose personal data to ISD’s clients, where disclosing the information of a candidate or professional is necessary for a relevant recruitment or hiring process on a project and there is a legal basis for it. Personal data may also be disclosed to public authorities, courts, regulators or law-enforcement bodies, where disclosure is required or permitted by law. 

A limited amount of data may also be shared with ISD’s co-founder, Inther Group B.V. (the Netherlands, EU), to the extent necessary for a recruitment process or a business relationship. 

The services used on the isd-soft.com website and the providers involved are: 

Service	Purpose	Basis
Zoho CRM	Managing enquiries and the relationship with prospects	Pre-contractual steps / legitimate interest
Mailgun	Delivery of e-mails generated by the website	Legitimate interest
Kinsta	Hosting of the website and its database (including form entries)	Legitimate interest (operation of the website)
HubSpot	Sending newsletters and guides	Consent
Calendly	Scheduling meetings	Pre-contractual steps
Google Analytics 4, PostHog, Hotjar / Contentsquare, Leadinfo	Website usage statistics	Consent (Statistics/Marketing category)
WP Statistics	Local website usage statistics, stored in our own database, with the IP address anonymised and hashed; no transmission to third parties	Legitimate interest / consent, depending on configuration (to be confirmed)
Google reCAPTCHA	Protecting forms against spam	Legitimate interest (security)
Complianz	Managing cookie consent	Legal obligation / legitimate interest

 

Where a service provider processes personal data on our behalf, we use contractual arrangements that require the provider to process the data on documented instructions, keep it confidential, implement appropriate technical and organisational measures and comply with the other processor obligations imposed by applicable law. 

8. Situations in which ISD acts as a processor 

In providing software development, support or related services, ISD may access or process personal data that exists in a client’s production, development, testing or other environment. Where the client determines the purposes and means of the processing, the client acts as controller and ISD acts as processor. In such situations, ISD processes the personal data on the client’s documented instructions and in accordance with the applicable data processing agreement. The client is generally responsible, as controller, for providing the necessary privacy information to data subjects. 

9. International data transfers 

Personal data may be processed or accessed outside the Republic of Moldova and, where the GDPR applies, outside the European Economic Area. Where a transfer is subject to restrictions under applicable data protection law, we use a permitted transfer mechanism, such as an applicable adequacy decision, approved standard contractual clauses, binding corporate rules or another legally recognised safeguard. 

In practice, data may be transferred to European Union countries (for example the Netherlands, where many of our clients and ISD’s co-founder, Inther Group B.V., are located) and to providers whose servers or support teams are located in other countries. For each such transfer we verify the applicable safeguards before using the service. 

You may contact us to request information about the safeguards applicable to a transfer of your personal data, subject to any legal restrictions on disclosure. 

10. Your rights 

Subject to the conditions and exceptions provided by applicable law, you have the right to be informed transparently about the processing of data; to access your personal data; to request the correction of inaccurate or incomplete data; to request deletion of data where the legal conditions are met; to request restriction of processing; and to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, where the right to data portability applies. 

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object at any time to processing for direct marketing purposes. Where processing is based on consent, you may withdraw your consent at any time. 

You also have the right to lodge a complaint with the National Centre for Personal Data Protection (CNPDCP) or, where applicable, with another competent supervisory authority. 

To exercise your rights, you may contact us using the details in Section 1 or Section 15. We may request information reasonably necessary to verify your identity. We will respond within the time limit required by applicable law. Under Law No. 195/2024, this period is generally no more than one month from receipt of the request, subject to legal extensions where applicable. 

11. Security of personal data 

We implement technical and organisational measures appropriate to the risks presented by the processing. Depending on the circumstances, these may include access controls, authentication measures, confidentiality obligations, system and data security, backup and recovery measures, staff awareness, supplier management and incident-response procedures. 

If a personal data breach occurs, we assess its impact and notify the CNPDCP, as well as the data subjects, where applicable law requires it. 

12. Automated decision-making 

We do not currently use personal data to make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect data subjects. If we ever use an automated tool to select or rank candidates, you will be informed of this and will be able to request human review of the outcome, in accordance with the GDPR and, where applicable, the EU Artificial Intelligence Act (AI Act). If such processing is introduced, we will provide the information and safeguards required by applicable law. 

ISD currently does not use artificial-intelligence tools to process CVs or to assess candidates. AI tools used internally (for example for software development) do not receive candidate data. 

13. Cookies and similar technologies 

Our website may use cookies and similar technologies. Cookies strictly necessary for the operation and security of the website may be used without consent, where the law allows. Analytics, advertising or other non-essential technologies are used only in accordance with the applicable consent requirements. 

The website uses a consent mechanism (Complianz) with three categories: Functional (always active), Statistics (optional) and Marketing (optional). You may accept or refuse the non-essential categories and change your preferences at any time. The mechanism offers the options Accept, Deny and Cookie settings, and your choice is remembered through the consent mechanism’s own cookies. If you select “Deny”, non-essential tracking (statistics and marketing) is not activated. Our Cookie Policy provides further information about the technologies used, their purposes, providers and applicable retention periods. 

14. Links to other websites 

Our website may contain links to websites operated by third parties. ISD is not responsible for the privacy practices of third-party websites. Personal data that you provide directly on those websites is processed in accordance with their own privacy policies. We encourage you to read the relevant privacy information before providing personal data. 

15. Contact and complaints 

If you have questions, requests or complaints about this Privacy Policy or our processing of your personal data, please contact us: 

Contact: Tamara Adam, Data Protection Coordinator 

Postal address: 33/1 Bulgară St., Chișinău, MD-2001, Republic of Moldova 

E-mail: dataprivacy@isd-soft.com 

Telephone: +373 22 996 170 

If you are not satisfied with our response, you may lodge a complaint with the National Centre for Personal Data Protection of the Republic of Moldova (CNPDCP), 48 Serghei Lazo St., Chișinău, MD-2004, e-mail: centru@datepersonale.md, telephone: (022) 820 801. 

16. Changes to this Privacy Policy 

We may update this Privacy Policy from time to time to reflect changes in our processing activities, technologies, services or applicable law. The current version and the date of the last update will be published on our website. Where the law requires it, we will provide additional notice of significant changes.