Privacy Policy

1. Data controller

The controller is SRL Elyon Energy, IDNO 1025604008741, registered at 6 Pantelimon Halippa St., office 500, Chișinău, Republic of Moldova. Contact: contact@elyon.md. The Data Protection Officer (DPO) can be reached at dpo@elyon.md.

2. Legal framework

We process data in accordance with Law No. 195/2024 on personal data protection, Regulation (EU) 2016/679 (GDPR) where applicable, and energy-sector legislation: Law No. 164/2025 on electricity, the Regulation on electricity supply (ANRE Decision No. 169/2019) and the Regulation on the supplier-switching procedure (ANRE Decision No. 126/2020).

3. What data we process

• Identification data — individuals: first name, surname, date of birth, IDNP, copies of identity documents; legal entities: name, IDNO, registration date, state-register extract, authorized representative and copies of their documents.
• Unique customer identifier.
• Contact data and contact preferences: phone numbers, email addresses, postal addresses.
• Ownership or possession documents for the property/land where the consumption place is located.
• Consumption-place (NLC) data: address, contracted power, voltage level, property type, distribution operator, meter and transformer details.
• Contract data: contract number and type, term, tariffs, fees and discounts, invoicing and notification preferences; current/previous supplier.
• Billing and payment data: account balance, invoice and payment history, payment code, transaction status and reference, registered cards (as references/tokens held by the processor) and direct-debit settings. We do not store full card data (see section 6).
• Consumption data (history by year/month/day/hour) and consumption forecasts.
• Credit score.
• Interaction data: visits, email, phone (including call recordings and transcripts), social media, personal account and chat; complaints, survey responses, segmentation tags.
• Prosumer data (legal entities): installed generation capacity and installation type.
• Technical and automatically collected data: IP address, device and browser type, cookies, website logs and interactions (see the Cookies Policy).

4. Purposes and legal bases

Each purpose is correlated with its legal basis:

• Energy supply, account and personal-account management, invoicing — performance of the supply contract;
• Consumer identification/authentication and rights over consumption places, supplier switching, reporting and statistics for authorities (ANRE, the Ministry of Energy), accounting and tax records — compliance with legal obligations specific to the energy and tax sectors;
• Payment processing — performance of the contract and legal obligation;
• Security, fraud prevention, service improvement, consumption monitoring — the controller's legitimate interest;
• Direct marketing and non-essential cookies — your explicit consent, withdrawable at any time.

5. Whom we disclose data to

We do not sell your data. We may disclose it, to the extent necessary, to: the payment processor and bank (MAIB) and the national instant-payment system (MIA); IT, hosting and cloud infrastructure providers supporting our platform, under confidentiality and security obligations; analytics and marketing tool providers (with consent); the distribution and, where applicable, transmission operator; public authorities (ANRE, the Ministry of Energy) when required by law.

6. Processing of payment data

When you pay online through the account, via the QR code or the payment code on the invoice, we process: your name, the contract and/or consumption-place number, the invoice number and amount, the payment code, and the transaction status and reference. Elyon Energy does not collect or store card data (number, expiry, CVV). Card details are entered solely on the processor's secure page. Card payments are processed by MAIB with 3-D Secure; MIA instant payments are made through the national instant-payment system. We retain only the payment code, status and a transaction reference/token.

7. Storage and data transfers

Data is stored exclusively in electronic form on secure servers. Where data is stored or transferred outside the Republic of Moldova, this takes place only within the European Economic Area or in countries ensuring an adequate level of protection, or on the basis of appropriate safeguards (including standard contractual clauses), as required by law.

8. Retention period

We keep data for as long as necessary for the stated purposes and for the period required by legal obligations (accounting, tax and energy-sector regulatory obligations), after which it is deleted or anonymized.

9. Data security

Access is only through authorized and monitored accounts (customer, operator, administrator) with differentiated rights; operator and administrator accounts are protected by multi-factor authentication (MFA). We apply encryption in transit and at rest, access control and automated logging of access and changes (record of processing activities under Article 30 of Law No. 195/2024).

10. Your rights

As a data subject, you have the following rights:

• Right of access — to obtain confirmation that we process your data and a copy of it;
• Right to rectification — correction of inaccurate data or completion of incomplete data;
• Right to erasure (“right to be forgotten”) — insofar as we have no legal retention obligation;
• Right to restriction of processing — in the cases provided by law;
• Right to object — including to direct marketing, at any time;
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format;
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing;
• Right not to be subject to a decision based solely on automated processing that produces legal effects concerning you;
• Right to lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova, or to bring the matter before a court.

11. How to exercise your rights

Requests may be sent to contact@elyon.md or dpo@elyon.md, or in writing to the company's registered address. To protect your data, we may request additional identification details. We reply within 30 calendar days of receiving the request; in complex cases the deadline may be extended by up to 60 days, with prior notice to you of the reasons for the extension. Exercising your rights is free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse to act, giving reasons.

12. Cookies

The website and account use cookies, described in the Cookies Policy.

13. Changes and contact

We may update this policy; the version in force is the one published on elyon.md, with the date above. Contact: SRL Elyon Energy, 6 Pantelimon Halippa St., office 500, Chișinău; contact@elyon.md; dpo@elyon.md; +373 69 904 945.