1. Parties and conclusion
Controller: the Customer who has taken out a FrameCRM Subscription (the “Controller”).
Processor: Pavlo Okhmak, a sole trader (natural person doing business) registered in the Czech Trade Register, company ID (IČO) 29485941, registered office (place of business) Bezručova 4201, 430 03 Chomutov, Czech Republic, not a VAT payer (the “Processor”).
This Data Processing Agreement (the “DPA”) forms part of the Terms of Service. The Controller accepts it by confirming consent when registering for FrameCRM; no signature is required. The DPA fulfils the requirement for a contract under Art. 28(3) of Regulation (EU) 2016/679 (GDPR).
The Czech version of this DPA is binding; this English text is a translation and, in the event of any discrepancy, the Czech version prevails. In matters of personal data protection, the DPA takes precedence over the Terms of Service.
2. Subject matter, duration, nature and purpose
- Subject matter: processing of personal data that the Controller or its users enter into FrameCRM.
- Duration: for the term of the Subscription and thereafter until the data is deleted in accordance with Article 10.
- Nature of processing: collection (including inquiries and bookings from the Controller’s website or online booking form, if used), storage, organisation, display, search, modification, export, preparing reminders and messages that the Controller’s users send to clients themselves (e.g. via a WhatsApp link), notifications to the Controller’s users (via Telegram, if enabled by the Controller), issuing documents such as invoices, backup and deletion.
- Purpose: providing the FrameCRM service — records of the Controller’s clients, vehicles, orders, calendar, reminders, reviews, invoices, stock, payroll and statistics.
3. Categories of data subjects and personal data
Data subjects: the Controller’s clients and prospects, their contact persons, employees and other users of the Controller.
Categories of data:
- identification and contact data (name, phone, e-mail, address);
- vehicle data (make, model, registration plate, VIN, odometer reading);
- order history, appointments, prices and payment records, notes;
- invoicing data (billing name, address, company ID / VAT ID);
- photos (mainly of vehicles), which may also contain other personal data;
- client communication and reviews;
- data on the Controller’s users (name, e-mail, phone, role, sign-in records, activity log) and, if the Controller uses payroll, their pay rules, earnings and payouts.
Processing of special categories of data (Art. 9 GDPR) or data relating to criminal convictions is not envisaged; the Controller does not enter such data into FrameCRM.
4. Obligations of the Controller
The Controller is responsible for having a legal basis for the processing, for properly informing data subjects, for the accuracy of the data entered and for ensuring that its instructions to the Processor comply with the law. The Controller protects its users’ access credentials.
5. Obligations of the Processor
The Processor:
- processes personal data only on documented instructions from the Controller — the Terms of Service, this DPA and the Controller’s settings and actions in the application are deemed such instructions — including with regard to transfers to third countries; it will inform the Controller immediately if it considers an instruction unlawful;
- ensures that persons authorised to process the data have committed themselves to confidentiality;
- takes technical and organisational measures pursuant to Art. 32 GDPR (Article 7);
- complies with the conditions for engaging sub-processors (Article 6);
- assists the Controller in responding to data subject requests — in particular through application features for finding, correcting, exporting and deleting data;
- assists the Controller in meeting its obligations under Art. 32 to 36 GDPR, taking into account the nature of processing and the information available;
- deletes or returns the data after the end of the service (Article 10);
- makes available to the Controller the information necessary to demonstrate compliance and allows audits (Article 11);
- does not use the Controller’s data for its own purposes.
6. Sub-processors
The Controller gives general authorisation for the engagement of sub-processors. As of the effective date of this DPA, they are:
| Sub-processor | Activity | Location / safeguards |
|---|---|---|
| Cloudflare, Inc. | Running the application (Workers), CDN, protection against attacks | Global network — DPF, standard contractual clauses |
| Supabase, Inc. | Database (PostgreSQL) and file storage | Data stored in the EU (Frankfurt, Germany) — standard contractual clauses |
| Resend | Sending service e-mails to the Controller’s users (e.g. signup confirmation, payment notices) | USA — standard contractual clauses |
| Telegram | Notifications for the Controller’s users (only if enabled by the Controller) | Outside the EU — use is optional |
| Maps/Places for address lookup and ratings (optional) | Google Ireland Ltd. — DPF, standard contractual clauses |
Subscription payments are processed by Stripe; however, Stripe does not process personal data of the Controller’s clients.
Messages to clients via WhatsApp are sent by the Controller’s users from their own WhatsApp app (click-to-chat link); WhatsApp (Meta) is therefore not a sub-processor of the Processor, and the Controller’s use of WhatsApp is governed by its own relationship with Meta. When a user decodes a VIN, only the VIN (without any other data) is sent to the free public NHTSA vPIC database (U.S. Department of Transportation) to look up the make and model; studio addresses may be looked up in OpenStreetMap (Nominatim).
The Processor will inform the Controller by e-mail at least 14 days in advance of any intended addition or replacement of a sub-processor. The Controller may object on reasonable grounds relating to data protection; if the parties cannot find a solution, the Controller may cancel the Subscription with effect from the date of the change. The Processor imposes the same data protection obligations on its sub-processors and remains liable for their performance.
Transfers to third countries take place only with safeguards under Chapter V GDPR (adequacy decisions, standard contractual clauses).
7. Technical and organisational measures
- encryption in transit (HTTPS/TLS) and encryption of stored data by the database provider;
- sign-in with passwords or one-time sign-in links (valid for a limited time), secure sessions, user roles and permissions within the account;
- logical separation of each customer’s data;
- Processor access to production data only to the extent necessary (support, troubleshooting), protected by strong authentication;
- regular backups at the database provider with the ability to restore;
- continuous updates of software and dependencies, secrets managed outside the source code;
- logs of operations and security events;
- data minimisation — no personal data of clients is sent to analytics;
- a security incident response procedure.
8. Personal data breaches
The Processor will notify the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it. The notification contains the information under Art. 33(3) GDPR available to the Processor and will be supplemented as further information becomes available. The Processor will take reasonable measures to mitigate the consequences.
9. Data subject requests
If the Processor receives a request from a data subject concerning the Controller’s data, it will forward it to the Controller without undue delay and will not respond to it itself unless authorised by the Controller.
10. Deletion and return of data
During the Subscription, the Controller can export and delete data at any time. After the Subscription ends, the Processor retains the data for 90 days, during which the Controller may request it in a machine-readable format. The Processor then permanently deletes the data; copies in backups expire through the backup rotation within a further 30 days at the latest. This does not apply where retention is required by law.
11. Information and audits
On request, the Processor will provide the Controller with the information necessary to demonstrate compliance with Art. 28 GDPR, usually in the form of written answers and documentation. The Controller, or an auditor mandated by it and bound by confidentiality, may carry out an audit or on-site inspection with at least 30 days’ prior notice, no more than once a year (unless investigating a personal data breach or at the request of a supervisory authority), at the Controller’s expense.
12. Liability and final provisions
The parties’ liability is governed by Art. 82 GDPR and otherwise by the Terms of Service. This DPA remains in force for as long as the Processor processes the Controller’s data. It is governed by the laws of the Czech Republic.
Data protection contact: info@frame-webs.com.