PRIVACY POLICY

I. General Provisions

Dear users, through this policy, we inform you about what personal data about you is collected by the website www.zbor.md, the purposes of personal data processing, the conditions of personal data processing, including data protection measures, as well as your rights regarding personal data protection.

The website www.zbor.md (hereinafter referred to as the "site"), dedicated to online flight booking and ticketing services, belongs to the company "EXPLOR TUR" S.R.L., IDNO: 1012600013482, legal address: 64 31 August 1989 Street, Chisinau, Republic of Moldova, MD-2012 (hereinafter referred to as the "Operator" or the "Company").

II. Categories of Personal Data We Collect and Process

The Company processes data entered by the user of the website independently and data collected through cookie files. We process the following categories of data:

First name, last name, age, gender, citizenship, mobile phone number, email address;
Identity document data: series, number, and expiration date of the identity document;
Data regarding your travel/trips;
Data collected through cookies (IP address, browser type, referring/exit pages and URLs, number of clicks and manner of interaction with the site, domain names, landing pages/content, pages/content viewed, device ID, and device location);
Profile information (preferences, search history data, booking history data, travel plans, and other information about you).

We would like to draw your attention to the fact that we do not process your bank details. After selecting and confirming the flight booking, the website www.zbor.md redirects you to the webpage of the respective commercial bank to perform payment for the flight booking services, or to make the payment via the commercial bank's mobile application. All your bank details are processed exclusively by commercial banks.

Collection of personal data through cookies

The website www.zbor.md uses cookie files (cookies) — small text files stored on your device when you visit the site. Some cookies are necessary for the functioning of the site and are permanently activated. Others, for example: analytical and marketing cookies — are activated only with your permission.

Additionally, tools similar to cookie files are used on the site (for example, Meta Pixel). Hereinafter in this Policy, the term "cookie file" or "cookie" will be used to designate all cookie files and tools similar to cookie files.

We use the following categories of cookies:

Infrastructure — necessary to navigate the site and use the main features of the site. They do not collect information about you for marketing purposes and are not transmitted to third parties;
Core functionality — necessary to ensure proper functioning of the site and its essential features, such as booking travel services and issuing tickets;
Security — necessary to ensure the required level of security of the site, such as user authentication for secure payment and fraud prevention. If you disable these cookies, the protection level of your account will be reduced;
Marketing — used to carry out marketing activities and improve online advertising performance. These cookies allow us to place personalized and relevant advertising from third-party partners. We may upload your user identifiers obtained from these cookies to the Ads partner platform to help improve the personalization of our advertising;
Performance and statistics — used to help understand how you use the site (for example: chosen language; link you clicked) to improve your user experience and to include third-party analytics servers.

Cookies make using the site more convenient and simple, but you have the option to disable cookies or select only those cookies you consider necessary at any time, at your choice, via the cookie banner on the site, as well as from your device settings.

The use of cookie files for marketing and analytics purposes is possible ONLY WITH YOUR CONSENT.

For detailed information regarding the use of cookies, please consult the Cookie Policy available on our website by accessing the corresponding link.

Some cookies on the site are not installed by us, but by third-party services we use (e.g., Google). These organizations may install their own cookies and process data in accordance with their own privacy policies. Please consult the conditions regarding the transfer of your personal data outside the territory of the Republic of Moldova in the "Transfer of personal data" section of this Policy, as well as in the "Cookie Policy" available on our site.

III. Purposes of Personal Data Processing

We process your personal data for the following purposes:

Providing the services ordered by you;
Communicating with you regarding the ordered services;
Creating, processing, and editing your bookings;
Granting assistance and customer support in using the Zbor.md site and services;
Providing information about available and upcoming services and offers — provided you have given your consent for data processing for marketing purposes;
Improving the performance and quality of the site;
Responding to your requests and comments;
Calculating bonuses (if you participate in our loyalty programs "Bonus Program");
Ensuring protection of information processed through the site and protecting users' bank details;
Informing about eventual illegal or illicit actions.

The legal basis for collecting and using the personal data described above depends on the targeted personal data and the specific context in which we collect them:

Legal basis for processing your personal data for the purpose of providing services: for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6 para. (1) lit. b) of Law No. 195/2024 of the Republic of Moldova);
Legal basis for processing your data for the purpose of ensuring protection of information processed through the site and protecting users' bank details: processing is necessary for compliance with a legal obligation to which the controller is subject (Art. 6 para. (1) lit. b) of Law No. 195/2024 of the Republic of Moldova);
Legal basis for processing your personal data for the purpose of calculating bonuses: (if you participate in our loyalty programs "Bonus Program") — processing is necessary for the purposes of the legitimate interests pursued by the controller (Art. 6 para. (1) lit. f) of Law No. 195/2024 of the Republic of Moldova);
Legal basis for processing your personal data for the purpose of transmitting marketing and advertising information: processing of personal data based on the data subject's consent for the processing of their personal data (Art. 6 para. (1) lit. a) of Law No. 195/2024 of the Republic of Moldova).

IV. Storage Duration of Personal Data

We retain your personal data for the duration necessary to provide the services offered through the site, as well as for the period provided by the applicable legislation of the Republic of Moldova for the corresponding categories of personal data processing. Upon expiry of the mentioned periods, personal data is deleted or anonymized, except in cases provided by the archival legislation of the Republic of Moldova.

Personal data processed based on your consent is processed until the withdrawal of your consent.

V. Transfer of Your Data

Your personal data may be transferred to third parties for the purpose of service provision. Personal data is stored on company servers in the Federal Republic of Germany, in accordance with German national legislation and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR Regulation).

For the purpose of providing services through the site, your personal data may be transmitted to:

Airlines;
Payment service providers;
Flight booking systems / consolidators;
The website hosting provider;
Email and notification service provider (Google);
Authentication providers via social networks or electronic means (Google, Facebook (Meta));
Insurance companies (in case the user requested insurance services);
Analytics and marketing services (in case the user gave consent for data processing for marketing purposes).

In cases of cross-border data transfers, the protection of your personal data is ensured through:

Standard Contractual Clauses, approved by the European Commission or the National Center for Personal Data Protection of the Republic of Moldova;
Adequacy decisions (for example, for EU countries, data transfer is permitted without additional conditions);
Data processing agreements with service providers.

Google LLC, Meta Platforms, Inc. and Microsoft Corporation, through whose tools personal data are processed, are listed in the Data Privacy Framework List and, insofar as transfers of personal data are carried out under the conditions provided for by the EU-U.S. Data Privacy Framework, such transfers benefit from the protection mechanism recognized by Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data provided by the EU-U.S. Data Privacy Framework (notified under document number C(2023) 4745).

In this regard, transfers of personal data to organizations in the United States of America that are included in the Data Privacy Framework List may be carried out on the basis of Commission Implementing Decision (EU) 2023/1795 without the need to rely on other transfer mechanisms provided for in Chapter V of Regulation (EU) 2016/679 (GDPR), provided that the applicable conditions are met. The Commission Decision provides that the United States ensures an adequate level of protection for personal data transferred to organizations in the United States included in the Data Privacy Framework List.

Google LLC, Meta Platforms, Inc. and Microsoft Corporation have an “Active” status in the Data Privacy Framework List. Depending on the scope and coverage of each organization’s certification, such certification may cover the processing of both HR and non-HR personal data. Information regarding the status and certification of the organizations is available in the Data Privacy Framework List: https://www.dataprivacyframework.gov/list

VI. Your Rights Regarding Personal Data Protection

In accordance with the provisions of Law No. 195/2024, you as a data subject have the following rights:

Right	Description
Right of access	You can find out what personal data we hold about you and request a copy of it.
Right to rectification	If your personal data is inaccurate or incomplete, you can request its correction or completion.
Right to erasure (right to be forgotten)	You can request the deletion of your personal data in case legal grounds for keeping it no longer exist.
Right to restriction of processing	You can request temporary restriction of processing of your personal data in certain situations provided by applicable law.
Right to data portability	You can receive your personal data in an electronic format and, under the conditions provided by law, transmit it to another controller.
Right to object	You can object to the processing of your personal data for marketing purposes, and if processing is based on this ground, we will cease processing for marketing purposes.
Right to withdraw consent	In case we process your personal data based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.
Right to lodge a complaint	If you consider that your personal data protection rights have been violated, you have the right to lodge a complaint with the National Center for Personal Data Protection (CNPDCP).

VII. Personal Data Protection Measures

In order to ensure the protection of your data, we apply a set of security measures, including the following:

Connection to the site is protected by encryption (HTTPS);
Access to databases is limited to authorized personnel;
Regular data backups are performed;
Dependency vulnerability scanning;
Code security audits.

VIII. Contact Details

To exercise your rights, as well as to contact us, please write to us at the email address indicated below or by postal mail to our physical address:

Company: Explor Tur S.R.L.
Legal Address: mun. Chișinău, str. 31 August 1989, 64 MD-2012
E-mail: legal@explor.md