Privacy Policy
1. Who We Are and What This Policy Covers
The controller of personal data is “GENERAL ASIGURĂRI” S.A. — mun. Chișinău, str. Pușkin, no. 47/5; IDNO 1016600035165; CNPF license no. 000887 of 16.12.2016 (the “Company”, “we”).
Contact for data protection matters: office@general.md, phone +373 22 783 800.
Scope. This policy describes the processing of personal data through the general.md website and the personal account: requesting quotes, concluding insurance contracts online (RCA, Green Card, travel medical insurance), online payments, the user account, communications, and cookies. Information on processing carried out through other channels (offices, phone, claims settlement) may be obtained at office@general.md.
Processing is carried out in accordance with Law No. 195/2024 on the Protection of Personal Data (applicable as of 23.08.2026), as well as Law No. 106/2022 on Compulsory Motor Third-Party Liability Insurance. Unless otherwise indicated, references to articles in this policy refer to Law No. 195/2024.
2. What Data We Process, For What Purpose, and On What Legal Basis
| Context | Data | Purpose | Legal Basis |
|---|---|---|---|
| Calculating the RCA / Green Card quote | the vehicle’s registration certificate number, IDNP/IDNO, vehicle data and the bonus-malus class obtained from the RCA Data System, IP address | calculating the insurance premium | Article 6(1)(b) — pre-contractual steps; Article 8(15) of Law No. 106/2022 |
| Issuing the RCA / Green Card policy | the above data + the policy start date, phone number, e-mail | concluding and performing the contract; registering the policy in the RCA Data System | Article 6(1)(b) and (c); Law No. 106/2022 |
| Travel medical insurance | for each insured person: IDNP, first and last name, date of birth, passport series and number; trip parameters (countries, period, purpose); for the policyholder (referred to as “Payer” in the Website’s interface): IDNP, name, phone number, e-mail | concluding and performing the contract | Article 6(1)(b) |
| Online payment | transaction confirmation received from the payment service provider: the payer’s name, the masked card number or IBAN, e-mail, phone number, IP address, amount, status and transaction identifiers | collecting the premium, recording payments and refunds, fraud prevention | Article 6(1)(b) and (c) — accounting record-keeping and anti-money-laundering obligations |
| Request for vehicles registered in other states | first and last name, phone number, e-mail | contacting the applicant; creating the personal account | Article 6(1)(b) |
| Personal account | registration data (name, phone number, e-mail, password in encrypted form) or data received through Google/Apple login (name, e-mail); saved records (Section 3) | providing the account service | Article 6(1)(b) — a contractual relationship distinct from the insurance contracts |
| Commercial communications | e-mail, phone number | sending offers and news by e-mail/SMS | Article 6(1)(a) — consent, given by ticking the relevant checkbox or by creating a personal account (§3.5); may be withdrawn at any time, separately for each channel |
| Internal statistics | aggregated and anonymized data on quotes and sales | analyzing and improving the services | Article 5(1)(b) — compatible purpose; anonymized data no longer constitutes personal data |
| Statistics and marketing via cookies | identifiers from cookies, website browsing data, IP address, browser/device information; for measuring advertising conversions — irreversibly transformed values of the policyholder’s contact data and the date of their first order (details — §5) | analyzing website usage and measuring advertising campaigns | Article 6(1)(a) — consent given via the cookie banner; may be withdrawn at any time (details — Cookie Policy) |
| Technical logs | IP address, device data and actions performed | Website security; evidence of consents and acceptances given | Article 6(1)(f) — legitimate interest in ensuring system security and evidencing acceptances (Article 15 of Law No. 157/2014); Article 6(1)(c) |
Unfinalized quotes. Quotes requested without completing the purchase are anonymized upon expiry of the offer’s validity period. Anonymized data may be retained for statistical purposes.
We do not process special categories of data (Article 9) through the Website: the online forms do not include questions about health status.
Providing the data marked as mandatory is necessary for concluding the contract; without it, the contract cannot be concluded (Article 8(15) of Law No. 106/2022).
3. Personal Account
3.1. Creating an account is optional — products may also be purchased without an account.
3.2. The following may be saved in the account:
- Persons (IDNP, first and last name, date of birth, address, passport number),
- Vehicles (registration number, make, model, registration certificate number),
- Companies (IDNO, name, address), and, in the future,
- Real estate.
This data is used to speed up form completion and to display the associated policies; it is retained for the duration of the account’s existence.
3.3. Login is performed by e-mail and password or via a Google account. When external login is used, we receive the name and e-mail address from the provider; we do not receive the password of the external account. When verifying or changing the phone number, we send a one-time code by SMS through an SMS service provider.
3.4. Account deletion is available from the Settings section and is irreversible. Data saved in the account is deleted; data relating to issued policies and transactions continues to be retained for the period required by law (Section 7). The Company may delete inactive accounts, with prior notice by e-mail at least 30 days in advance.
3.5. Notification preferences. Consent for commercial communications may be given in two ways: by ticking the checkbox during the purchase process (including without an account) or by creating an account — upon registration, the commercial communication channels (e-mail and SMS) are activated, of which you are informed. Each channel may be disabled separately, at any time, from the Settings → Notifications section. Notifications about policies (issuance, expiry) are service communications, not marketing, and are sent on the basis of the contract. Your preferences are stored in the account on the Company’s servers.
4. Data Concerning Third Parties
Through the website and the personal account, users may provide and store the data of other persons (insured persons, family members, other third parties), including insured minors. In such cases, the legal basis for processing is the performance of the insurance contract (Article 6(1)(b)) and the insurer’s statutory obligations (Article 6(1)(c)). The data subjects are informed through the documents sent together with the insurance policy.
Any person whose data is processed in this manner may exercise the rights set out in Articles 15–22, including the right to request the deletion of their data from another user’s account, by contacting office@general.md. The saved record is deleted from the account upon request; data from issued policies is retained to the extent and for the period required by law (Article 17(3)).
5. To Whom We Disclose Data
- the automated state information system RCA Data, administered by the National Bank of Moldova — the transmission of data for calculating the premium and registering RCA/Green Card policies is a statutory obligation (Article 8 of Law No. 106/2022); the system operates on a statutory basis, not under a commercial agreement;
- the National Bureau of Motor Insurers (BNAA) — in cases provided by law in relation to the Green Card;
- the MConnect interoperability platform and state registers — obtaining data provided by law (e.g. the Road Traffic Accident Register, Article 23 of Law No. 106/2022);
- the National Bank of Moldova — in the exercise of its supervisory powers over insurance activity — and the National Commission for Financial Markets — in the exercise of its powers regarding the protection of consumers of financial services;
- the payment service provider — BC “MAIB” S.A. — payment processing; full card details are entered exclusively in its interface;
- hosting service providers and the SMS delivery service provider (phone number verification codes) — under agreements that ensure the confidentiality and security of data (Article 28);
- Google (Google login, analytics and advertising tools), Meta (marketing tools), and Microsoft (the Clarity statistics tool) — under the conditions described in the Cookie Policy and only with the relevant consent, where required. Data on completed orders may also be transmitted to these services directly from our servers (not only from the browser), through our own infrastructure on the general.md domain; such transmission complies with the same consent preferences you have expressed.
No contact data is transmitted to these services in readable form. For the purpose of measuring advertising conversions, and only where consent for marketing has been given, irreversibly transformed values (using the SHA-256 cryptographic function) of the policyholder’s e-mail address, phone number, first name, and last name (referred to as “Payer” in the Website’s interface) — the person who fills in and places the order — are transmitted. These values do not contain the data in readable form and cannot be read directly; however, they remain pseudonymized personal data and benefit from the same protection. They are used solely to match the conversion with the advertising interaction.
Technical identifiers are also transmitted (client identifier, transaction identifier, advertising interaction identifiers, order composition and value, date of the client’s first order), together with the IP address and browser or device information, necessary for the operation of the measurement services.
The data of insured persons, when they differ from the policyholder, is not transmitted to the advertising services in any form, including transformed form.
If you have not given consent for marketing, order data is not transmitted to the advertising services (Google Ads, Meta) even from the server, and the transformed values mentioned above are not generated;
- public authorities — only on a statutory basis.
We do not sell data and do not disclose it to third parties for purposes other than those described.
6. International Data Transfers
Certain providers (Google, Meta, Microsoft, infrastructure providers) may process data outside the Republic of Moldova. Such transfers are carried out under the conditions set out in Articles 44–49: to countries with an adequate level of protection or on the basis of appropriate safeguards (including standard contractual clauses). Information on the applicable safeguards may be requested at office@general.md.
7. How Long We Retain Data
| Data | Retention Period |
|---|---|
| Data relating to RCA / Green Card policies | at least 6 years — Order of the State Archive Service No. 57 of 27.07.2016 approving the List of Standard Documents and their retention periods for public administration bodies, institutions, organizations and enterprises of the Republic of Moldova, and the Instructions on the application of the List, item 257. |
| Data relating to travel insurance policies | for the duration of the policy’s validity and thereafter, for the limitation periods and statutory record-keeping obligations |
| Payment transaction confirmations | in accordance with accounting legislation and anti-money-laundering legislation |
| Account data and saved records | until the account is deleted by the user or by the Company (Section 3.4) |
| Data for commercial communications | until consent is withdrawn |
| Transformed values of contact data, temporarily stored in the browser for measuring conversions | until the tab is closed or until consent for marketing is withdrawn (details — Cookie Policy) |
| Data entered in the order form, temporarily stored in the browser so it is not lost when returning from the bank’s page | until the browser tab is closed |
| Unfinalized quotes of unauthenticated visitors | 30 minutes from the expiry of the offer, after which they are irreversibly anonymized |
| Technical logs | maximum 12 months |
| Evidence of consents and acceptances (date, time, document version) | for the duration of the contract and the limitation periods |
8. Automated Decision-Making
The RCA/Green Card insurance premium is calculated automatically, based on data from the RCA Data System (including the bonus-malus class) and the coefficients set by law. This calculation is necessary for concluding the contract (Article 22(2)(a)). You have the right to obtain human intervention, to express your point of view, and to contest the result, by contacting office@general.md.
9. Your Rights
Under Articles 15–22, you have the right:
- to access your data;
- to rectification;
- to erasure (“the right to be forgotten”);
- to restriction of processing;
- to data portability;
- to object;
- not to be subject to a decision based solely on automated processing which produces legal effects.
Consent (for example, for marketing — given by ticking the checkbox or by creating an account, §3.5) may be withdrawn at any time (Article 7(3)), without affecting the lawfulness of processing carried out prior to withdrawal, separately for each channel (e-mail, SMS):
- account holders — from the Settings → Notifications section;
- persons without an account who ticked the checkbox during the purchase process — via the unsubscribe link in each commercial e-mail, and for SMS — by submitting a request to office@general.md or by phone at +373 22 783 800, indicating the e-mail address or phone number to be removed.
Unsubscribe requests are carried out without delay, within no more than 5 business days.
Withdrawing consent for marketing cookies via the “Cookie Settings” button immediately stops the transmission of data to the advertising services and deletes the transformed values temporarily stored in the browser.
Requests are submitted to office@general.md or in writing to the Company’s registered office. We respond within no more than one month of receiving the request; the period may be extended by two months in complex cases, with notice to you (Article 12(3)).
You have the right to lodge a complaint with the National Center for Personal Data Protection (NCPDP): 48 Serghei Lazo St., mun. Chișinău; datepersonale.md.
The exercise of these rights cannot affect the Company’s statutory obligations: for example, data from issued policies cannot be deleted before the expiry of the statutory retention periods (Article 17(3)).
10. Data Security
We apply appropriate technical and organizational measures: encrypted connections (HTTPS), encryption of sensitive data, access control and logging, backups, staff training, and confidentiality obligations. In the event of a personal data breach that creates a risk to individuals’ rights, we notify the NCPDP within no more than 72 hours (Article 33), and, in the case of a high risk, the data subjects as well (Article 34).
11. Cookies
The Website uses cookies and similar technologies. Statistics and marketing cookies are used only with your consent, given via the cookie banner; your preferences may be changed at any time using the “Cookie Settings” button in the Website’s footer. Details are provided in the Cookie Policy.
12. Amendments to the Policy
We may update this policy. The new version is published on the Website, indicating the date and version number; significant changes are communicated to users with an account by e-mail. Previous versions may be requested at office@general.md.
13. Contact and Complaints
- Data Controller: “GENERAL ASIGURĂRI” S.A., mun. Chișinău, str. Pușkin, no. 47/5
- E-mail for data protection matters: office@general.md
- Phone: +373 22 783 800
- Supervisory authority: National Center for Personal Data Protection — 48 Serghei Lazo St., mun. Chișinău; datepersonale.md
Related documents: Terms and Conditions, Cookie Policy.