1. Controller
The controller of personal data is Pavlo Okhmak, a sole trader (natural person doing business) registered in the Czech Trade Register, company ID (IČO) 29485941, registered office (place of business) Bezručova 4201, 430 03 Chomutov, Czech Republic, not a VAT payer (“we”, “us”).
For any personal data matters, contact us at info@frame-webs.com or +420 607 977 826. We have not appointed a data protection officer, as we are not required to do so.
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.
2. When we are a controller and when a processor
We are the controller of the data of website visitors, prospects who contact us and customers (contact and billing details, account data).
Data that car service shops and other businesses (our customers) enter into FrameCRM about their own clients (e.g. names, contact details, vehicle data, photos, order history) is processed by us as a processor under the Data Processing Agreement. In that case the controller is the business concerned — please direct requests to exercise your rights primarily to it; if you send them to us, we will forward them.
3. What data we process
- Contact form and communication — name, e-mail, phone, message text and, where applicable, the selected product and plan. Messages from the form are not stored in the website’s database; they are delivered to our account in the Telegram app and we then handle them by e-mail.
- FrameCRM account — company name, company ID (IČO), address, contact person’s name, e-mail, phone, language, account settings, details of users you add to the account, and sign-in records.
- Billing — selected plan, payment history and receipts. Payment cards are processed by Stripe; we only see limited information (e.g. card brand, last 4 digits, expiry date).
- Signup consent record — which versions of the legal documents you accepted, when, from which IP address and browser.
- Technical data — IP address, browser and device type, time and URL of the request, error and security logs.
- Cookies and analytics — see Article 7.
Providing data is voluntary. However, without the data necessary to conclude and perform a contract (contact and billing details), we cannot provide the service or reply to your inquiry.
4. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Replying to inquiries, preparing an offer | Pre-contractual steps (Art. 6(1)(b) GDPR) | 1 year from the last communication if no contract is concluded |
| Performance of a contract — Website project, FrameCRM Subscription, support, service e-mails | Performance of a contract (Art. 6(1)(b)) | For the term of the contract and 3 years after it ends |
| Record of the documents accepted at signup (versions, time, IP address, browser) | Legitimate interest — proving the contract and consents (Art. 6(1)(f)) | For the term of the contract and 3 years after it ends |
| Unfinished signup (registration without the first payment) | Pre-contractual steps (Art. 6(1)(b)) | Deleted automatically after 7 days |
| Accounting and tax | Legal obligation (Art. 6(1)(c)) | For the period required by law (usually 5–10 years) |
| Security, abuse prevention, technical logs | Legitimate interest (Art. 6(1)(f)) | Usually no longer than 90 days |
| Establishing and defending legal claims | Legitimate interest (Art. 6(1)(f)) | For the limitation period or the duration of a dispute |
| Website analytics (Google Analytics) | Consent (Art. 6(1)(a)) | Until consent is withdrawn; data in Google Analytics for no longer than 14 months |
| Marketing cookies | Consent (Art. 6(1)(a)) | Until consent is withdrawn |
We do not send commercial communications without your consent or another legal ground. We do not carry out automated decision-making or profiling with legal effects.
5. Recipients and processors
We share personal data only to the extent necessary with the following service providers:
| Provider | Purpose | Location / safeguards |
|---|---|---|
| Cloudflare | Hosting of the website and application (Workers), CDN, protection against attacks | Global network, US company — EU-US Data Privacy Framework (DPF), standard contractual clauses |
| Supabase | FrameCRM database (PostgreSQL) and file storage | Data centre in the EU (Frankfurt, Germany); US company — standard contractual clauses |
| Stripe | Payment and subscription processing | Stripe Payments Europe (Ireland); transfers to the US — DPF, standard contractual clauses. For some payment data, Stripe acts as an independent controller. |
| Resend | Sending service e-mails (signup confirmation with a sign-in link, payment notices) | USA — standard contractual clauses |
| Telegram | Delivering contact form messages and notices about new signups to us; optional notifications in FrameCRM | Outside the EU — see Article 6 |
| Google Analytics and Tag Manager (only with consent); optionally Maps/Places in FrameCRM for address lookup and ratings | Google Ireland Ltd.; transfers to the US — DPF, standard contractual clauses |
WhatsApp (Meta) is not our processor: the website and FrameCRM only contain click-to-chat links (wa.me) that open the WhatsApp app on your device with a prepared message; what you then send via WhatsApp is governed by WhatsApp’s own terms and privacy policy. We do not send any data to Meta ourselves and do not use Meta pixels or similar tracking.
We may also share data with our accountant or tax advisor, or with public authorities where required by law. We do not sell personal data.
6. Transfers outside the EU
Some providers may process data outside the European Economic Area. Such transfers take place only with safeguards under Chapter V GDPR: on the basis of a Commission adequacy decision (for certified US companies, the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission.
For Telegram, which we use to deliver your contact form message, the transfer is based on Art. 49(1)(b) GDPR, i.e. it is necessary to handle your request before a contract is concluded. If you prefer otherwise, simply write to us directly by e-mail.
We will provide a copy of the safeguards on request.
7. Cookies and analytics
On your first visit we show a banner where you choose which cookies to allow. You can change your choice at any time via the “Cookie settings” link in the website footer.
| Cookie | Purpose | Duration |
|---|---|---|
| frame-lang | Necessary — remembers the selected language | 1 year |
| frame-consent | Necessary — stores your cookie choice | 180 days |
| FrameCRM: authjs.* (sign-in session) | Necessary — keeps you signed in to the application | Up to 30 days |
| FrameCRM: NEXT_LOCALE, crm_branch, crm_demo_from | Necessary — interface language, selected branch, return from the demo | 1 year / while signed in / 1 day |
| _ga, _ga_* | Analytics — Google Analytics 4 (only with consent) | Up to 2 years |
| Google marketing cookies | Ad measurement (only with consent) | According to Google’s settings |
We use necessary cookies on the basis of our legitimate interest and Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications; all other cookies only with your consent. The FrameCRM application (car.frame-webs.com) uses only necessary cookies and no analytics or advertising cookies, so it does not ask for cookie consent.
We use Google Tag Manager and Google Analytics 4 with Consent Mode v2. Until you give consent, no analytics cookies are stored; however, Google may receive limited cookieless signals (e.g. that a page was loaded) from which it does not identify an individual user. We never put names, e-mail addresses, phone numbers or message content into analytics events.
8. Your rights
Under the GDPR you have the right:
- of access to your personal data (Art. 15);
- to rectification of inaccurate data (Art. 16);
- to erasure (“right to be forgotten”, Art. 17);
- to restriction of processing (Art. 18);
- to data portability (Art. 20);
- to object to processing based on legitimate interest (Art. 21);
- to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal;
- to lodge a complaint with the supervisory authority — the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
Send requests to info@frame-webs.com. We will handle them without undue delay and within 1 month at the latest. To protect your data, we may ask you to verify your identity.
9. Security
We use encrypted connections (HTTPS), access control, separation of each customer’s data, backups and regular updates. Only people who strictly need access to data have it.
10. Changes to this policy
We may update this policy. The current version is always available on this page; we inform customers of material changes by e-mail.