Privacy notice
Version 1.0 · in effect from 22 September 2026
DigiPuls holds records about named people who work in schools: who assessed what, what they judged, and what evidence they attached. This notice says exactly what is stored, who can see it, how long it stays, and what you can do about it. It is written to meet Law no. 195/2024 of the Republic of Moldova, in force since 23 August 2026.
Who is responsible
DigiPuls is operated by Antreprenor Independent „Tudor Lapp” (trading as Lappsus), Chișinău, Republic of Moldova, which runs the platform, the server and the database.
Your school is responsible for what it records in DigiPuls. The school decides who holds an account, who is assigned which indicator, what level is entered and what evidence is attached. For those records the school is the controller and the platform operator acts on its instructions. For the accounts themselves, the audit log and the security of the system, the platform operator is the controller.
For anything to do with your own data, the fastest route is the person who administers DigiPuls at your school. You can also write directly to lapp.tudor@gmail.com, and you never have to go through your school if you would rather not.
What is stored
Everything below is held because the platform cannot do its job without it. There is nothing collected "just in case".
| What | Data | Why | Kept for |
|---|---|---|---|
| Your account | Login handle, name, role, the school or territory you belong to, a hashed password, the date the account was created and the date you confirmed it was yours | So the system knows who you are and what you may reach | While the account is active, then for as long as the audit trail it is referenced from is kept. Accounts are deactivated rather than deleted, because deleting one would damage the record of who confirmed which assessment. |
| Your session | A session identifier in a cookie, and the session record on the server | To keep you signed in between pages | Until it expires or you sign out |
| What you assessed | The level you gave each indicator, any comment you wrote with it, and the fact that it was you who gave it | The instrument works by comparing what the administration and the team each judged, so an entry has to be attributable to be meaningful | For the life of the school's record. A confirmed cycle is immutable by design. |
| Evidence you attached | The description, the source, and the file itself where one was uploaded, with who added it | So a rating can be checked, and so a principal knows whom to ask about it | For the life of the school's record |
| The audit log | Which account did what, and when | This is a national instrument with real consequences. An assessment nobody can trace is not an assessment. | Kept as the record of the process |
| Feedback you send | Your comment, plus the page you were on, the element you clicked, your browser and screen size, and your language and display settings, captured automatically by the feedback overlay | So a report of "this label is wrong" can be traced to the line that produces it | Until the report is resolved and the release it belongs to has shipped |
Evidence files are your school's responsibility to keep clean. A minute, a photo or a survey export may contain personal data about people who never signed in here, including pupils. Do not upload anything you would not be willing to account for. The platform stores what it is given and cannot judge what is inside a document.
Photographs are the specific risk. „photo” is an accepted evidence type, and a school documenting pupils using devices will be tempted to upload one. Please do not, where a pupil can be identified, unless your school has a lawful basis and the consent it needs: Law no. 195/2024 puts the age at which a child can consent for themselves at fourteen, and below it a legal representative must. A photograph of a room, a screen or a piece of work proves the same thing and carries none of that.
What DigiPuls does not do
- No analytics, no advertising, no tracking cookies, no third-party tags. Nothing here watches you across the internet.
- No profiling, and no decision about a person taken automatically. A maturity level is the judgement of the people who entered it.
- Nothing is sold, rented or shared for anyone's marketing.
- Your display settings — colour scheme, contrast, text size, reduced motion — are stored in your own browser and never against your account. A preference about how you read a screen should not become another field of personal data about a named school employee.
Who can see what
Disclosure is tiered on purpose, and the tiers are enforced in code rather than by convention.
- Inside your school: the people who hold accounts there see the school's own working record, including who entered what.
- Your territorial body and the Ministry: see the schools in their remit, at the level of confirmed results rather than individual working notes.
- Meta-mentors and peer validators: see what they have been assigned, in order to validate it.
- The public pages: show a school's assessment only when the school has published it, and then in full: every parameter at the level the school agreed on, the evidence it named for that level, both Order 675 verdicts, and the development plan if one has been published. Publishing is the school's own act and nothing appears here before it. Two things are still withheld: the files attached as evidence are not served to the public, and the name of the person who entered an item is not shown.
The platform is hosted on infrastructure operated for this purpose. No data is sold or handed to anyone outside the arrangement described here, unless a Moldovan court or authority requires it by law.
Where the data is kept
On a server in Germany, inside the European Economic Area, rented from Hostinger. The database runs on the same machine and is not reachable from the internet. Nothing leaves that server: DigiPuls makes no outbound connection to any other service, which is why there is nothing in this notice about transfers to anyone else.
A backup is taken every night and kept for fourteen days. Anything deleted therefore survives in a backup for up to two weeks before it is gone for good.
Four things that are easy to miss
Your sign-in address is recorded. When you log in, the address your browser connected from is written into the audit log beside your name. Nothing else in the log records an address, and the pages you open are not logged at all.
There is no email address in DigiPuls, and it cannot send mail. You sign in with a handle rather than an address, because the people this was built for have no institutional mailbox. There is no telephone number, no home address and no date of birth either.
Removing an evidence file does not remove what it said. The file itself is deleted immediately, but its description and file name stay in the audit log, so that what was withdrawn is still on the record. The platform tells you this at the moment you press remove; it is repeated here so it is not a surprise.
Your name can appear without you holding an account. A development plan can name the person responsible for an action, and a validation record names the reviewer, neither of whom needs a login. If your name is in the system that way and you want to know what is written beside it, write to the address in the first section.
Your rights
Under Law no. 195/2024 you can ask to see the data held about you, to have anything inaccurate corrected, to have it deleted where there is no longer a reason to keep it, to restrict what is done with it while a dispute is resolved, to receive a copy in a machine-readable form, and to object to processing that rests on legitimate interest.
Two limits worth stating plainly, rather than letting you discover them. A confirmed assessment cycle cannot be edited, by anyone, including the person who entered it: that immutability is what makes the record worth anything. And the audit log is the record of the process itself, so entries in it are not removable on request. If something in either is wrong, the answer is a correction recorded alongside it, not a quiet overwrite. Say so and it will be handled that way.
Requests are answered within one month. If one is unusually complex that may extend by up to two further months, and you will be told inside the first month if so. There is no charge.
If you are not satisfied
Raise it with your school, or write to the address in the first section. You can also complain to the supervisory authority at any point, and you do not have to try here first.
Centrul Național pentru Protecția Datelor cu Caracter Personalstr. Serghei Lazo 48, Chișinău, MD-2004, Republic of Moldova
+373 22 820 801 · centru@datepersonale.md
datepersonale.md
Security, and what happens if it fails
The platform is served only over HTTPS. Passwords are stored hashed, never in a readable form. An account provisioned with a one-time password cannot reach anything until it has been changed, and an unclaimed credential reaches nothing but a screen asking who is holding it. Access is checked on every request rather than only at sign-in, so revoking someone takes effect immediately. Uploaded evidence is kept outside the web root and served only to people entitled to it.
No system is perfect. If personal data is breached and the breach is likely to risk people's rights or freedoms, the National Centre for Personal Data Protection will be notified within 72 hours of the breach becoming known, and the people affected will be told directly without undue delay where the risk to them is high.
Changes to this notice
When this notice changes in a way that affects you — a new purpose, a new recipient, a new category of data — the version number at the top goes up and the date changes. Material changes are announced in the platform before they take effect, not after.
This notice is written to be accurate and readable, and it describes what the platform actually does. If anything here is unclear, or you think it is wrong, write and say so.