SOLUTION / Personal data protection
Do your site, CRM and database actually meet Law 195/2024?
The law has applied since 23 August 2026. Your lawyer sets the rules and writes the documents. We check what your systems actually do and carry out the technical half: retention periods, erasure, exporting one person's data, the consent log, cleaning up the logs.
- We work with the structure, not the contents of your records
- The first step's price is named before access is granted
- We work alongside your lawyer
This is about you if
- ·You hold a customer base — CRM, a site with forms, bookings, a mailing list — and the law now applies to you directly.
- ·Your lawyer has prepared the documents, and what remains is making the system behave the way they describe.
- ·You do not know exactly where personal data sits across your systems — and would rather find out before an inspector does.
- ·You work with EU clients and have already heard the word GDPR from their counsel.
How this differs from what you have already been offered
Several companies in Moldova answer this question, and answer it seriously. The difference comes down to these three things.
01
We do not search — we reconcile
Scanning finds what you have. The input to our work is your own documents: the policy, the register, the contracts. The output is a reconciliation map, «declared ↔ observed», every row referencing a table or a line of code. If the documents do not exist yet, that is the first row of the map, not a reason to turn you away.
02
We work with the structure, not with your records
Read-only access to schema, code and aggregates. The checks are built so that opening the contents of rows is not required. The one standing exception is observing our own test profile in the browser. If a particular case needs anything beyond that, we agree it in advance and record it in the log. Separately: not one row of your data reaches the language model — it sees the schema, the column names and the code, never the values.
03
The first step is small and ends with you
It starts not with a project but with a data map: fixed scope, a stated duration, a price named before we begin. The remediation plan stays with you — fix it with us, with your own vendor, or yourself. We do not build a catalogue where every line item is a separate invoice.
Who does what
| Your lawyer | Us |
|---|---|
| Legal bases for processing | The factual data map, from schema and code |
| Policy, contracts, consent wording | Retention periods and scheduled erasure |
| The legal version of the register | The factual register it is built from |
| Representation before the authority | Exporting and erasing one person's data |
The register is a shared artefact, and that is worth saying plainly: we derive the factual half from the system, your lawyer establishes the bases and signs off the final version. We reconcile the two together.
What one row of the report looks like
Below is a real finding. Not an example and not a mock-up: a row from a run we performed on our own system before offering this work to anyone else.
- Declared in the document
- «Marketing analytics — Plausible, no cookies». Privacy policy, revision dated 02.08.2026.
- Observed in the system
- Google Analytics 4 with _ga* cookies live in production since 27.08.2026. The cookie inventory was updated the same day — the policy was not.
- How it is phrased
- An observation, not an accusation: the document a person actually reads had fallen one analytics layer behind the system. Half a day to fix. The question for counsel goes in its own section.
Run on 30.08.2026, our own system. The gap was closed the same day. We show a finding where we are the ones in the wrong — because that is where the discipline of a report is visible.
What you get at the first step
01
Processing register
Filled in from fact: from the database schema, the forms, the integrations and the outbound hosts — not from a staff questionnaire. This is the document you are obliged to produce if asked.
02
Reconciliation map
A table of «declared in your documents ↔ observed in the system». Every row references a table, a file or a line of code — checkable rather than declarative.
03
Remediation plan
Ranked: what takes a day, what takes a week, what needs a lawyer — with the question for them already written out. The plan stays with you.
How it runs
- 01
Contract before access
The contract with its processing annex is signed before the first connection — no «let us take a look first» exceptions. From that moment we are a processor under article 28: we act only on your instructions, for the agreed purposes, for a limited term, and we delete what we received when the work ends.
- 02
Reading structure, not data
Schema, code and aggregates. The log of every query we ran is delivered with the report — you can see where we looked.
- 03
A report against a named frame
The report follows the ISO 19011 structure: criteria, evidence, findings, limitations. We state a method, not a status: conformity certification does not exist as a mandatory institution, and we do not sell it.
- 04
A finding without a method does not enter the report
Every observation carries the way to reproduce it — the query and the timestamp. Where a check could not be run, it is marked «not measured» rather than dropped: a report silent about what it failed to check lies through its coverage.
- 05
Fixes with demonstrable acceptance
Not «retention has been configured», but «this query returned so many expired rows — it now returns zero, and here is the job that keeps it at zero».
Independence and money
- ·The fee is fixed and named before you grant access. It does not depend on the number of findings — otherwise finding them becomes profitable.
- ·Disclosure of the relationship is a mandatory section of every report: did we build the system, will we be fixing it, who is paying for the work. That section is never empty.
- ·If we built the system, the report on it is not called independent. Not ever — it would be a review of our own work. Where a third-party view is needed, we either decline the remediation on that engagement or bring in our partner law firm as the second pair of eyes.
What is not included
- ·Legal opinions, policies and contracts — that is a lawyer's work. We come alongside yours, or introduce you to the ones we work with.
- ·Representation before the national personal data protection authority.
- ·«Compliance certificates» — no such mandatory institution exists; whoever promises one is selling paper.
- ·Penetration testing, a SOC, or an outsourced DPO. Others sell those, and sell them better than we would.
- ·A promise that there will be no penalty. Nobody can give you that.
What we need from you
- ·Read-only access to the database and the repository — granted for the engagement and revoked when it ends.
- ·Your data documents, if they exist: policy, register, contracts. If they do not — we start with the map, and that is fine.
- ·Your lawyer's contact — or ask us to suggest one.
- ·An hour from whoever knows how your processes are actually arranged.
How we will know it worked
The processing register matches the real database schema. Expired data is deleted by a job with a run log. A person's request — export or erasure — completes as a single operation rather than a hunt across systems. And every one of those statements can be shown, not merely said.
How pricing works
The first step — the data map — has a fixed scope and a fixed price, both named before we begin. The scope of bringing the system into line becomes known from the map and is fixed after it, not before. Figures belong in the conversation: none of our services carry them on the site.
Plainly
We have no case studies in this area yet — the law has applied since 23 August. What we do have: the run we performed on ourselves, and the studio's open methodology. You can read it before we talk rather than after.