DRAFT FOR THE LAWYER, 20 September 2026

Notice on cookies and browser storage

Version [1.0] of [DATE]

1. What this Notice covers

1.1. This Notice is given by "DII-TEH-GROUP" S.R.L., IDNO 1017600052819, with its seat at mun. Chișinău, str. Socoleni 2/6, hereinafter the Seller, which acts as the controller of personal data. Requests about personal data are sent to dev@e-gaz.md, or in writing to the Seller's seat marked "Data protection". The Seller gives the National Centre for Personal Data Protection the contact details of the data protection officer, if appointing one is compulsory under art. 37 of Law No. 195 of 25.07.2024 on the protection of personal data.

1.2. Information kept in a person's terminal equipment is set out below, and arises when that person opens: a) the public website https://epay.e-gaz.md; b) the Cabinet https://epay.e-gaz.md/cabinet; c) the Seller's internal panel, used by its own staff only.

1.3. The App uses no cookies and no browser storage. On the User's telephone it keeps the following.

1.4. Everything in clause 1.3 is strictly necessary to provide the service the User expressly asked for, or keeps a choice the User made himself, and art. 72 para. (6) of the Law on electronic communications No. 241-XVI of 15.11.2007 exempts such items from consent. None of them is read by a third party, none serves audience measurement and none serves advertising. The processing of data in the App is described in the Privacy policy (document 02).

1.5. A Visitor, for the purposes of this Notice, is a person who opens a page of the public website. The Cabinet is used by Company staff, and the internal panel only by the Seller's own staff.

1.6. This Notice does not replace the Privacy policy, which states what data the Seller processes, for what purposes, to whom it passes them and for how long it keeps them.

2. What cookies and browser storage are

2.1. A cookie is a small text file that a website puts into the browser and that the browser sends back with requests to that website. Browser storage, sessionStorage and localStorage, keeps data without sending them automatically, and the law treats it in the same way, because it too is information kept in a person's terminal equipment.

2.2. What sits in sessionStorage disappears when the browser tab is closed, and a persistent cookie and localStorage remain until they expire or until the person deletes them.

3. The Cabinet and the Seller's internal panel

3.1. The Cabinet and the internal panel set no cookie at all, because the Seller's server sends these two web applications no Set-Cookie header.

3.2. Both use browser storage as set out below.

3.3. Everything in the table in clause 3.2 is strictly necessary to provide an information society service expressly asked for by the staff member, and art. 72 para. (6) of Law No. 241/2007 exempts such items from consent. The token is the condition of the session, and without the selected Company the Cabinet cannot establish whose Company data it is showing.

3.4. The interface language is one of the preferences the staff member sets himself: the keys epay.company.locale and epay.admin.locale hold only the language code, "ro", "ru" or "en", and carry no data about the person.

3.5. Because every item in the table in clause 3.2 is exempt from consent under clause 3.3, neither application shows a banner and neither asks for consent.

3.6. Every item in the table in clause 3.2 is created by the Seller's own applications, and the Cabinet and the internal panel load no script, font or image from another website. No third party keeps information in these two applications.

3.7. If the Seller adds a third party's element or a measurement tool to the Cabinet or to the internal panel, it first amends this Notice, and an element that is not strictly necessary loads only after consent.

3.8. A staff member who signs out or closes the tab loses the session keys, and one who clears the storage during work ends the session and signs in again. Members of the Seller's staff who hold a right over money or the right to change settings — the Administrator, the accountant and any role with such a right — sign in to the Seller's internal panel only with a code from an authenticator app, as a second factor; other staff do not need one.

4. The public website

4.1. This chapter applies from the day the public website starts, and at the date of this version it is not running.

4.2. The public website uses the following items.

4.3. The Seller has chosen neither the bot check supplier, nor the audience measurement tool, nor the map supplier. If the website starts without the measurement tool and without the map, their rows are removed from the table and the banner of clause 6.1 is not shown.

4.4. On the public website the Seller uses no advertising cookies, no remarketing identifiers and no social network buttons. It builds no profiles of Visitors and passes no data about visits to advertising networks.

4.5. For each of the last 3 (three) rows of the table in clause 4.2, the page names the supplier before it loads, lists the data that supplier receives and the state in which it processes them. The name of the supplier, the state and the ground of the transfer are written into the next version of this Notice, and a transfer outside the Republic of Moldova is made only in one of the cases set out in art. 44 para. (2), art. 45 para. (3) and art. 46 of Law No. 195/2024 (Monitorul Oficial No. 367-369 of 23 August 2024, art. 574, in force from 23 August 2026). A copy of the safeguard is requested at the address in clause 1.1.

5. Legal basis

5.1. Art. 72 para. (5) of Law No. 241/2007 allows information to be stored in a person's terminal equipment, or already stored information to be accessed there, only with that person's consent, given after the person has received clear and complete information about the purposes of the processing.

5.2. The same article, in para. (6), exempts from consent any storage or access whose sole purpose is to carry out the transmission of a communication over an electronic communications network. Also exempt is what is strictly necessary to provide an information society service expressly asked for by the subscriber or the end user: the items of clause 1.3, those of the table in clause 3.2, and the first 2 (two) rows of the table in clause 4.2.

5.3. Consent is given on the conditions of Law No. 195/2024: it is free, specific and informed, it is expressed by a clear act of the person, and withdrawing it is as easy as giving it.

5.4. No item that needs consent loads before the Visitor accepts it. A refusal does not limit access to the website and does not make it harder to use, apart from the check of chapter 7, which a Visitor may go around by sending the application by the route of clause 7.7.

6. How a Visitor gives, refuses and changes the choice

6.1. On a first visit the public website shows a banner that states the purposes and allows a separate choice for each purpose that needs consent, that is for audience measurement and for the embedded map. The buttons "Accept all" and "Refuse all" are of the same size, the same appearance and the same prominence, and no purpose is selected in advance.

6.2. A close control sits on the banner, and closing it without a choice is recorded as a refusal of every purpose. Until a choice is made, only the language preference and the cookie that remembers the choice load.

6.3. The choice, a refusal included, is kept for [6] (six) months in the Visitor's equipment and not in an account, and after that time the banner is shown again.

6.4. A link "Cookie settings" sits in the footer of every page, through which the Visitor changes or withdraws the choice at any time, as easily as it was given.

6.5. A withdrawal takes effect for the future and does not touch processing carried out before it. The Seller deletes the cookies and the keys it created itself, and items created by a supplier expire at the times given in the table in clause 4.2.

6.6. That same link also withdraws the consent given on the form under chapter 7, and the bot check loads again only where the Visitor accepts it anew.

7. The bot check on the Company application form

7.1. The public website carries a form through which a legal entity asks to conclude the contract. The form is protected against automated sending by a bot check supplied by "[BOT CHECK SUPPLIER]".

7.2. The check loads on the page of that form only. It does not load on the other pages of the website and is not used in the Cabinet, in the internal panel or in the App.

7.3. Through the check the supplier may set its own cookies and storage. It receives the Visitor's network address and data about that person's browser and device, which it processes to tell a person from an automated program, including for its own purpose of protecting its service against abuse.

7.4. That supplier may process these data outside the Republic of Moldova, in [SUPPLIER'S COUNTRY]. For the states of the European Economic Area no special authorisation is needed, under art. 44 para. (2) of Law No. 195/2024, and the transfer is based on [GROUND OF THE TRANSFER], on the conditions of art. 46 of the same law. A copy of the safeguard is requested at the address in clause 1.1.

7.5. Loading happens when the Visitor opens the form and accepts the check there. Before it loads, the page names the supplier, lists the data that supplier receives and names the state in which it processes them.

7.6. The Seller uses the check to protect the form against automated sending. The basis of the processing is the Visitor's consent, given under clause 7.5, both for keeping information in that person's equipment and for the processing that follows.

7.7. A Visitor who does not accept the check sends the application to dev@e-gaz.md or by telephone at [TELEPHONE FOR COMPANIES]. The Seller examines it in the same way, within [5] (five) working days.

7.8. The check decides automatically whether the form may be sent. A negative result stops the sending, has no other effect on the person and leaves the route of clause 7.7 open, and the Seller takes no decision on concluding the contract on the strength of it.

8. Personal data

8.1. The tokens, the role and the reason for reading data in the table in clause 3.2 relate to a signed-in person and are therefore personal data. For the keys epay.company.token, epay.company.role, epay.company.company and epay.company.companyName the basis is the contract with the Company and the legitimate interest in security, and for the keys epay.admin.token, epay.admin.role and epay.admin.support.reason it is the employment relationship between the Seller and its staff member together with that same interest in security, under clauses 13.1 and 13.2 of the Privacy policy. The language code identifies nobody.

8.2. The data received by the suppliers named in the table in clause 4.2 and in chapter 7 are processed on the basis of consent, which is withdrawn at any time under clauses 6.4 and 6.6.

8.3. Server logs, which keep the network address, the page requested and the time of the request, are not storage in a person's equipment: they stay on the Seller's servers for at most 90 (ninety) days, on the basis of the legitimate interest in security, under clause 13.4 of the Privacy policy.

8.4. Any person whose data are processed under this Notice, the Visitor and the person who sends the Company application form included, has the right: a) to learn whether the Seller processes his data and to receive a copy of them (art. 15); b) to ask for the rectification of inaccurate data (art. 16); c) to ask for the erasure of the data (art. 17); d) to ask for the restriction of the processing (art. 18); e) to receive the data he provided, in a machine-readable format (art. 20); f) to object to processing based on the legitimate interest, on grounds relating to his situation (art. 21); g) to withdraw consent at any time, without this touching the processing carried out before the withdrawal (art. 7); h) to lodge a complaint with the National Centre for Personal Data Protection and to apply to a court.

8.5. A request is sent to the address in clause 1.1. The Seller answers without delay and at the latest within one month from receiving it, under art. 12 para. (3) of Law No. 195/2024, and exercising these rights is free of charge.

8.6. A complaint is lodged with the National Centre for Personal Data Protection, [CENTRE'S ADDRESS], [CENTRE'S E-MAIL], [CENTRE'S WEBSITE]. The right to apply to a court is not affected.

9. Deleting cookies and browser storage

9.1. A person who wants to see, delete or block cookies and storage for one website does so in the browser settings, under "Privacy and security" in Chrome, Edge and Firefox, and under "Privacy" in Safari. The names change from one browser version to the next.

9.2. A browser opened in a private window deletes cookies and storage when that window is closed.

9.3. A person who blocks the strictly necessary items can no longer sign in to the Cabinet or to the internal panel.

9.4. Deleting data from the browser does not touch the data on the Seller's servers, which are deleted within the times given in the Privacy policy.

10. Changes to this Notice

10.1. The Seller amends this Notice when it adds or removes an item from the tables, or when it changes a supplier. The version in force is published at https://epay.e-gaz.md/cookies and in the footer of the Cabinet and of the internal panel.

10.2. Every version has a number and a date. The Seller keeps the earlier versions and provides them on request.

10.3. If a change adds an item that needs consent, the Seller asks for consent again, and the earlier choice does not cover the new item.

10.4. A change to chapter 11 does not touch a contract already concluded with a User or with a Company.

11. Information about the website

11.1. The website https://epay.e-gaz.md is administered by "DII-TEH-GROUP" S.R.L., IDNO 1017600052819, VAT code 0508117, with its seat at mun. Chișinău, str. Socoleni 2/6, office at [OFFICE ADDRESS], telephone [SUPPORT TELEPHONE], e-mail dev@e-gaz.md, represented by its Administrator Konstantin Buzadji.

11.2. The website presents the Network, its Sites and its services, is informative in character and concludes no contract.

11.3. The contract with a User is concluded in the App, by accepting the Terms of use (document 01), and the contract with a Company is concluded in writing, by signing the contract for the sale of petroleum products and services through ePay Company cards (document 04). Where information on the website and those documents do not agree, the document accepted in the App or signed by the parties applies, without this touching the rights a consumer draws from the information published on the website; where the information on the website is more favourable to the consumer, that information applies.

11.4. Rights in the texts, the images and the structure of the website, in the name ePay and in the marks eGaz, eWash, eDrive and eMarket belong to the Seller or are used by it under a lawfully acquired right. Using them without the Seller's written agreement is forbidden, apart from the cases the law allows.

11.5. The Terms are at https://epay.e-gaz.md/conditii, and the Privacy policy at https://epay.e-gaz.md/confidentialitate.

11.6. Complaints about the services of the Network are made under the Terms. The consumer protection authority is the State Inspectorate for the Supervision of Non-Food Products and Consumer Protection, https://consumator.gov.md.