Privacy Policy
Edition of 16 October 2026 · effective upon publication · the Romanian version prevails in case of discrepancies.
1. Data controller
The controller of personal data is OPERON COMPANY GROUP S.R.L. (IDNO 1026023162096), bd. Decebal 6, MD-2002 Chișinău, Republic of Moldova; the platform operates under the trade name OPERON Realty. Data protection contact: realty@operononline.com, tel. +373 78 800 021.
The data protection function is performed by OPERON COMPANY GROUP S.R.L.; contact: realty@operononline.com.
2. Purposes and legal bases
We process data only for: publishing and searching properties; registering requests and scheduling viewings; concluding and performing contracts; chat and notifications; reporting and legal compliance.
Legal bases: performance of a contract; legitimate interest (public catalogue, search, service notices); explicit consent (marketing messages, sign-in via third-party services, Matomo statistics).
Marketing consent is free, separate, may be withdrawn at any time and is not a condition of using the service.
Access to the basic functions of the Platform is free. The Platform is financed by paid services for third parties (advertising, listing promotion); advertising is marked “Advertisement”. We do not pass users’ personal data to advertisers, and personalised advertising is shown only with your consent.
3. Categories of data
We process: name, e-mail, phone, preferred language; Google account e-mail and name if you sign in with Google; messages in requests and chats; property and owner data; contract documents and amounts; platform usage events.
We do not collect special categories of data, use advertising identifiers or collect precise location beyond the search and viewing features you enable.
4. Sign-in with Google
Signing in with Google (Google LLC) is optional. Its script loads only after you tick the consent box; on loading, the service receives your IP address and browser technical data under its own policy.
From Google we receive only the verified e-mail and name. We never receive your Google password.
If an account with a password already existed for the e-mail of your Google account, the password remains valid and earlier sessions are closed at your first sign-in with Google. You can sign in with either the password or Google.
You may withdraw consent at any time in Settings or via support; after withdrawal the account can be deleted.
Publishing to TikTok (optional)
An agency or company can connect a TikTok account in its cabinet. Connection uses TikTok's official sign-in (Login Kit); OPERON only requests access to the account's display name and avatar and the right to upload drafts.
From TikTok we receive the account identifier, display name and access tokens. Tokens are stored encrypted and used only to send listing drafts; we publish nothing to your account without your action. Only the listing title, area and the photos you select are sent to TikTok.
You can disconnect at any time in the cabinet ("Disconnect") or in TikTok settings; tokens are deleted on disconnect. TikTok's own processing is governed by TikTok's policy.
6. Retention periods
Requests and offers: 3 years from last activity; contracts and financial records: 5 years; audit log of personal-data operations: 5 years; technical logs: 3 years; candidate photos: 3 months; inactive user accounts: 12 months; sessions: 30 days.
When the period ends data is deleted or anonymised, except records that must be kept under tax law.
7. Your rights
You have the right to access, rectify, erase, restrict processing, data portability, object, withdraw consent and lodge a complaint with the data protection authority.
Requests are handled within one month of receipt; for complex requests the period may be extended by two months, and we will tell you (Art. 12 of Law No. 195/2024). The reply is free of charge. Exercise your rights in your account under Settings or via support.
8. Security and incidents
We use encrypted transport, irreversibly stored passwords, role-based access control, an audit log and signed expiring links for media files.
In case of a personal data breach we assess severity and notify the data protection authority within 72 hours of becoming aware, and affected persons without undue delay where the breach is likely to result in a high risk to their rights (Art. 33 and 34 of Law No. 195/2024).
9. Recipients and cross-border transfer
Data may be processed by payment, SMS and e-mail providers, and by Google LLC (only for sign-in, if you choose it), solely under a contract or your consent and to the extent necessary. Infrastructure providers must not use data for their own purposes.
Account data is stored on infrastructure located in the Republic of Moldova. Transfers abroad (including to Google when you sign in) occur only when necessary and protected in accordance with Law No. 195/2024.
10. Minimum age
The service is intended for persons aged 18 or over. We do not knowingly collect data of minors; if an account is found to belong to a minor it will be deleted.
11. Governing law and disputes
This policy is governed by the laws of the Republic of Moldova. If you believe your rights were violated, contact the controller first. If the answer is unsatisfactory you may complain to the national data protection authority or the competent court of the Republic of Moldova.
12. Changes and language
We may amend this policy; the new version is published on this page with its date. Material changes are communicated in your account. The policy is available in Romanian, Russian and English; in case of discrepancies the Romanian version prevails.