Version 2.1 · in effect from 23 September 2026
This policy explains what personal data lappsus.com collects, why, on what legal basis, how long it is kept, and what you can do about it. It is written to meet Law no. 195/2024 of the Republic of Moldova on the protection of personal data, in force since 23 August 2026, and Regulation (EU) 2016/679 (GDPR) where that applies. It is written in plain language on purpose. If anything is unclear, write to tudor@lappsus.com and I will clarify it or fix it.
Antreprenor Independent „Tudor Lapp”, the registered form under which I work, trading as Lappsus. Chișinău, Republic of Moldova. In the language of the law I am the controller (operator): I decide why and how the data described below is processed.
For anything to do with your data — a question, a request, a complaint, a correction: tudor@lappsus.com.
I have not appointed a data protection officer. Law no. 195/2024 requires one where an organisation is a public authority, monitors people systematically on a large scale, or processes special categories of data at scale. None of those describes this site, which handles a contact form and visitor statistics. I answer data protection questions myself, at the address above.
This policy covers lappsus.com — the pages you are reading now.
It does not cover services that happen to sit on a subdomain and run separately, such as digipuls.lappsus.com. Each of those is covered separately, not here. Where one of them is run for a school, a ministry or another authority, that body decides what is collected and why, and it is that body's information notice that applies to you.
It does not cover training, consulting or mentoring engagements. If we work together, the data handling for that work is set out in the contract and in the notice given to participants, not here.
It does not cover third-party sites this one links to, including LinkedIn. Once you follow a link, that site's own policy applies.
Four things happen on this site. Nothing else.
| What | Data | Why | Legal basis | Kept for |
|---|---|---|---|---|
| Contact form | The name, email address and message you type in | So I can read your enquiry and reply to it | Steps taken at your request before entering into a contract, and my legitimate interest in answering people who write to me (Law 195/2024 art. 5; GDPR art. 6(1)(b) and 6(1)(f)) | Until the enquiry is closed, and then until the next yearly clear-out. An enquiry is closed when you tell me you are not going ahead, or when twelve months pass with no exchange between us. Once a year, each January, I delete the closed ones. If the enquiry becomes an engagement, the engagement's own retention rules take over from that point. |
| Emailing me directly | Whatever your email contains | Same — to reply and keep a record of what was agreed | Same as above | Same as above |
| Server logs | IP address, browser and device string, page requested, timestamp — recorded automatically by the hosting provider | Keeping the site running and defending it against abuse | My legitimate interest in the security and availability of the site (GDPR art. 6(1)(f)) | As long as the hosting provider retains them; typically a few weeks. I do not read them routinely and do not combine them with anything else. |
| Analytics — Google Analytics 4, loaded through Google Tag Manager | Pages visited, time on page, referring site, approximate location at city level, device type, a randomly generated visitor identifier stored in a cookie | Understanding which pages are read and which are ignored, so I can improve them | Your consent, and nothing else (Law 195/2024 art. 7; GDPR art. 6(1)(a)) | 14 months from your last visit, after which Google deletes the underlying records |
There is no newsletter, no mailing list, no account, no profiling and no automated decision-making. Nothing here decides anything about you. Nothing collected here is sold, rented or shared for anyone else's marketing.
An earlier version of this policy said this site used the Meta Pixel and the LinkedIn Insight Tag. It does not, and it never has. Neither tag is installed. That statement described something planned rather than something happening, which was wrong, and it is corrected here. If advertising measurement is ever switched on, it will appear in the table above, it will be asked for as a separate choice from analytics, and this policy will say so before the first tag fires.
This site is aimed at teachers, school leaders, universities and institutions — adults, acting professionally. It is not directed at children and I do not knowingly collect data about anyone under 14, the age from which Law no. 195/2024 allows a child to consent to an information society service on their own. If you believe a child has sent me personal data through this site, write to me and I will delete it.
Giving me your name, email address and message is entirely voluntary. No law and no contract obliges you to, and nothing on this site is withheld if you do not. The only consequence of leaving the form alone is that I have no way to write back, so use the email address above instead if you prefer it.
Nothing in the "analytics" row above runs until you press Accept. Everything starts refused (Google Consent Mode v2), set before Tag Manager loads, and the analytics tag carries a condition requiring analytics storage to be granted before it will run at all. So if you press Reject, or simply never answer, the tag does not run, no analytics cookie is ever written, and nothing here builds an identifier for you.
One thing does happen before you answer, and it is fairer to say so than to leave it out. Every page loads Google Tag Manager, the container that would run the analytics tag if you allowed it, and loading it means Google's servers see your IP address and which page you are on. That happens on every visit, whatever you go on to choose. What it does not do is set a cookie, build an identifier, or run the analytics tag. So the difference between accepting and refusing is not whether Google sees this visit at all: it is whether anything is kept that could recognise you on the next one.
| Name | Set by | Category | Purpose | Lifetime |
|---|---|---|---|---|
lappsus-consent(browser local storage, not a cookie) |
This site | Strictly necessary | Remembers whether you accepted or rejected, so you are not asked on every page. It holds your answer, the moment you gave it, and which version of this policy it was given against. Nothing else, and nothing that identifies you. | Until you clear it or change your choice |
PHPSESSID |
This site | Strictly necessary | Set only when you send the contact form, never on an ordinary visit. It is how the form limits how often one browser can submit, which is what keeps it from being used to send automated mail. | Until you close your browser |
_ga |
Google Analytics | Analytics — consent required | Distinguishes one visitor from another, using a random identifier | 2 years |
_ga_PKCB26YFXS |
Google Analytics | Analytics — consent required | Keeps the state of the current visit for this specific property | 2 years |
The first strictly necessary entry is the one that records your answer. Storing it is what lets the site honour a refusal, so it is set whichever way you answer. The second is set only if you actually use the contact form.
Withdrawing consent must be as easy as giving it, so it is one click:
Either button takes effect immediately, here, with no further step. Withdrawing consent stops any further analytics collection. It does not undo what was collected while consent was in place, which was lawful at the time; to have that deleted as well, use section 6.
Under Law no. 195/2024 and, where it applies, the GDPR, you can ask me to:
Write to tudor@lappsus.com. I will answer within one month. If a request is unusually complex I may take up to two further months, and I will tell you inside the first month if that happens, and why. There is no charge.
I may need to check that you are who you say you are before I hand over data about you. That check exists to protect you, and I will ask for no more than it takes.
Tell me first, if you are willing — it is usually the fastest fix. But you do not have to, and you can complain to the supervisory authority at any point:
Centrul Național pentru Protecția Datelor cu Caracter Personal
str. Serghei Lazo 48, Chișinău, MD-2004, Republic of Moldova
+373 22 820 801 · centru@datepersonale.md
datepersonale.md
If you are in the European Union or the European Economic Area, you may also complain to the data protection authority where you live or work.
Only the people who have to, and only to do the job I engaged them for. Each of them acts as a processor: they handle the data on my instructions and may not use it for their own purposes.
Beyond that: nobody. I share data with no one else unless a Moldovan court or authority requires it by law, and I would tell you if that happened unless I were forbidden from doing so.
The site is hosted in the European Union. Google processes analytics and email data on infrastructure that includes servers in the United States, so some data does leave both Moldova and the EU.
Those transfers rest on the safeguards Google publishes for its own customers — the European Commission's Standard Contractual Clauses and, for transfers to the United States, the EU–US Data Privacy Framework, to which Google LLC is certified. Law no. 195/2024 requires a transfer to another state to rest on comparable safeguards, and these are the ones relied on here.
You can ask me for the detail of any of this at the address in section 1.
The law asks me to tell you whether the countries these transfers reach have been recognised as offering adequate protection. As far as I can establish, the National Centre for Personal Data Protection has issued no such decision about the United States, and has not yet published a list of recognised countries at all. So these transfers rest on the safeguards named above rather than on any adequacy decision.
The site is served only over HTTPS. The contact form is rate-limited and carries a hidden field that automated submitters fill in and humans do not, which is how most spam is rejected before it reaches me. The mailbox that receives enquiries is protected by two-factor authentication. Access to everything described here is mine alone.
No system is perfect. If personal data is breached and the breach is likely to risk your rights or freedoms, I will notify the National Centre for Personal Data Protection within 72 hours of becoming aware of it, and I will tell you directly without undue delay where the risk to you is high — both as Law no. 195/2024 requires.
When this policy changes in a way that affects you — a new purpose, a new recipient, a new category of data — the version number at the top goes up, the date changes, and the change is listed below. If the change needs your consent, you will be asked before it takes effect rather than after.
PHPSESSID cookie when you submit it, which the cookie table did
not list. The record of your cookie choice no longer contains one word: it
carries the answer, the time and the policy version, and the table now says
so. And the retention period for an enquiry is now stated as the rule that
decides it rather than a flat 24 months, because 24 months was a promise
nothing enforced.