Data processing

Who processes your data

The controller of personal data is «TRUCK STANDARD» SRL, IDNO 1019600059731, registered at mun. Chișinău, or. Durlești, str. Izvoarelor 49, MD-2003. This company owns the VIPark AERO car park near Chișinău Airport and this website.

The controller is the party that decides why and how your data is processed, and that answers for compliance with the law during that processing. Every decision about what is collected, how long it is kept and who may see it is made by the company named above.

For any question about how your data is handled, write to info@viparkaero.md. We reply to every enquiry, and where an answer needs time we say so separately.

What you enter in a request

Five details are required to place a request: your name, your phone number, the car's registration number, the date and time of arrival, and the date and time of departure. The name lets our staff know who they are greeting when the car arrives. The phone number is the only way to confirm the booking and to reach you if circumstances change, for instance when a flight is delayed. The registration number lets us recognise your car when we take it in and hand it back. The dates determine whether a space is free for that period, and the preliminary price is calculated from them. Without these five details a request cannot be handled.

The remaining fields are yours to fill in or leave alone: e-mail address, car make and a free-text comment. They help us prepare for your arrival, for example you can give your flight number in the comment so that we allow for the landing time, but none of them is a condition of the booking. Fields left empty affect neither the acceptance of the request, nor its price, nor the order in which it is handled.

Each request also records how you reached the website, as one of a set of categories: for example «Google search», «Google Maps», «Google ads», «Facebook» or «direct visit». Where you arrived through an advertising link or from another website, the name of the ad campaign or the address of that website is added to the category. This does not identify you personally; it tells us which channels bring customers. If you allowed analytics, the source is remembered in your browser until the tab is closed, so that a request sent from another page of the website does not lose it; without that permission only the page the request was sent from is taken into account.

We do not ask for, and would rather you did not send us, information that the service does not require: the national identification number, date of birth, home address, details of your household, copies of identity documents, bank card details, or any information about your health. This website takes no payments, so payment details are not collected in any form.

Why, and on what basis

The details given in a request are used solely to check whether a space is free on the chosen dates, to contact you and confirm the booking, to prepare a place for the car, to provide the parking and the transfer to the terminal and back, and to agree any changes with you should they arise.

The legal basis for this processing is the steps taken at your request before a contract is entered into, and the performance of that contract afterwards. Consent is not used as the basis here, and the distinction matters: since no consent was asked for, none can be withdrawn. If you change your mind, the booking is cancelled with a phone call, and after cancellation the details are kept for the limited period set out below.

The source of your visit, described above, is processed on the basis of our legitimate interest in knowing which advertising and which channels actually bring customers.

The box marked «I have read the terms on processing personal data», which you tick in the form, is not consent to processing. It confirms one thing only: that this text was shown to you before the request was sent and that you had the opportunity to read it. A note of which edition of this policy was in force at the moment of sending is stored with every request, so that it can later be established what you actually read.

Protection against spam

The request form is open to everyone and requires no registration, which leaves it exposed to automated submissions. So that such traffic does not disrupt the work or take a place in the queue ahead of real customers, we limit how often the form may be sent: no more than five requests from one phone number and no more than five from one network address within fifteen minutes.

Neither your phone number nor your network address is stored for this check. What is calculated instead is an irreversible fingerprint, a short sequence of characters from which the original value cannot be recovered even with full access to our database. Only fingerprints are compared with one another. All of them are deleted automatically within a day, after which no trace of the check remains.

In addition, when you open the request form, the Cloudflare Turnstile check is loaded. It looks at technical characteristics of the browser and at the network address to tell a person from a program. Most visitors do not notice it; occasionally it asks you to tick a box. The result of the check is a one-time code that we verify with Cloudflare when the request arrives and do not store.

The legal basis for both checks is our legitimate interest in protecting the service from automated abuse. The information processed is kept to a minimum: fingerprints are kept for no more than a day, and the check code is not kept at all.

Who receives the data

We do not sell personal data and do not exchange it. The details from requests (name, phone, car, dates and comment) are not passed to anyone for advertising. Supabase, Vercel, Cloudflare and Telegram process data solely on our instructions, to the extent required to provide their technical service, and may not use it for their own purposes. Google services work only with your permission, as described below.

Supabase provides storage of the database and sign-in for staff to the admin panel. The details from requests are held in that database.

Vercel runs the website itself and handles the requests coming from your browser.

Cloudflare serves the website's domain name and runs the Turnstile check described in the section on spam protection.

Telegram is used to alert staff to a new request and to changes in its status. No personal data reaches the message: only the request number, its status and a link to the password-protected panel are sent. The name, phone, car make and registration number and the comment are not sent to Telegram and remain in the database.

Google Tag Manager loads Google services only after you have allowed them in the cookie window. Google Analytics works if you allowed analytics. Google Ads works if you allowed advertising: it shows that a request followed a click on an advertisement and helps improve how ads are shown. The details from your request (name, phone, car and comment) are not sent to Google.

The servers of these companies are located outside the Republic of Moldova. The database and the processing of the website's requests are hosted in Germany (Frankfurt). The website's pages, the Cloudflare check and Google services run on these companies' server networks in various countries, including the United States of America. In choosing suppliers we proceed on the basis that they provide a level of protection comparable to the requirements of Moldovan law and that they process data under the terms agreed with us.

How long we keep the data

The retention period depends on whether the stay took place, and it is counted automatically.

If a request remained new or was cancelled, then three months after the arrival date stated in it the name, phone number, e-mail address, car make and registration number and comment are erased irrecoverably. Three months is enough to settle any questions about a booking that did not happen, and it is noticeably shorter than the period that keeping data just in case would require.

If the stay did take place, the same details are erased twelve months after the departure date. A year covers the seasonal nature of the service and allows a complaint raised a considerable time after the trip to be examined.

After erasure the record survives, but all that remains in it are dates, amounts and the booking status, from which no particular person can be identified. These are needed for occupancy records and for accounting. The clearing runs automatically every night, requires no separate request, and erased details cannot be restored once it has run.

Cookies

Cookies are small records that a website stores in your browser. We divide them into three groups and treat each differently.

Necessary files keep the website working: they hold the session of a staff member signed in to the admin panel and remember the choice you made in the cookie window, so that you are not asked the same thing on every visit. These files are always active, because without them the website cannot function.

Analytics files (Google Analytics) let us understand which pages visitors open and where they arrive from. They are not loaded until you allow them.

Advertising files (Google Ads) show that you reached the website through an advertisement and sent a request, and help improve how ads are shown. They are loaded only with your permission. If you allowed analytics only, the advertising features stay switched off.

Before you make a choice, the website contacts no analytics or advertising service. Without a choice, third-party services load in two cases only: the Cloudflare check, when you open the request form, because without it the form is not protected from spam; and the embedded Google map, only once you click it.

The choice you made can be changed or withdrawn entirely at any time through the «Cookies» link at the foot of every page. Refusing is as simple as agreeing: both take a single click, and refusal restricts access to no part of the website.

Your rights

The law gives you a number of rights over your data, and we make it possible to exercise each of them.

You are entitled to confirmation of whether your data is being processed and to a copy of it, together with information about the purposes, the retention periods and the recipients. You are entitled to have inaccurate information corrected and incomplete information completed. You are entitled to erasure where the basis for processing has fallen away. You are entitled to restriction of processing while your objection is considered or the accuracy of the information is checked. You are entitled to receive your data in a form suitable for transfer. You are entitled to object to processing founded on our legitimate interest. Consent to analytics and advertising may be withdrawn at any time and without explanation.

To make a request, write to info@viparkaero.md. We answer within the period set by law. So as not to hand your information to someone else, we may ask you to confirm that the request is genuinely yours: as a rule the phone number and the dates of the stay are enough, and we do not require further documents.

Certain information we are obliged to keep by law, for example for accounting and tax purposes. In that case we do not erase it on request, but we tell you what remains, on what basis, and until when.

If you believe your rights have been infringed and our answer has not satisfied you, you are entitled to complain to the National Centre for Personal Data Protection of the Republic of Moldova.

Changes

This policy was last updated on 25 September 2026.

We revise this text whenever the data collected, the purposes of processing, the retention periods or the list of recipients change. For significant changes both the date and the text on this page are updated together; wording corrections that do not alter the substance are not noted separately.

The edition of the policy in force when your request was sent is kept together with it. This means that later changes to the text do not reach requests already submitted: the terms that were shown to you are the terms that apply to them.