Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD) is:

Controller

Daniel Denis Golaszewski (trading as Framequality)

Address

Avinguda d'Alexandre Rosselló 15, 6 D, 07002 Palma de Mallorca, Illes Balears, Spain

Email

hello@framequality.org

We have not appointed a data protection officer. For all data protection matters, please contact us at the email address above.

2. Visiting this website (hosting and server logs)

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, which acts as our processor. When you visit the website, your browser automatically transmits technical data that is required to deliver the pages and to protect the service:

• IP address
• date and time of the request
• requested page or file and the HTTP status code
• referrer URL (the page you came from)
• browser type, operating system and language settings

Purpose: delivering the website, ensuring its stability and security, and detecting and defending against attacks. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a secure and functional website.

Retention: log data is kept by the hosting provider only for a limited period according to its technical retention settings and is not combined with other data or used to create profiles.

Vercel operates a global network, so requests may be processed in data centers outside the European Economic Area. Vercel states that it is certified under the EU-U.S. Data Privacy Framework; in addition, our data processing agreement with Vercel includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

3. Contact form and email enquiries

If you send us an enquiry via the contact form or by email, we process the data you provide:

• required: name, email address, company, service of interest, your message
• optional: website, approximate budget, preferred contact method, phone number
• the language version of the website you used

Purpose: answering your enquiry and, if you wish, preparing an offer. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and, for general enquiries, Art. 6(1)(f) GDPR (our legitimate interest in answering messages addressed to us). Providing the required fields is necessary to answer you; there is no statutory obligation to provide the data.

Delivery: form submissions are sent to our business mailbox by email. Our email is provided by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as our processor. Google may process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, and the Standard Contractual Clauses apply as an additional safeguard.

Protection against abuse: to prevent spam and automated mass submissions, the form contains an invisible check field, and when you start filling it in, your browser solves a small computing task set by our server (proof of work); the solution is sent with your enquiry and only checked for validity and timing. No cookies are set, nothing is stored in your browser and no third-party service is involved. In addition, a pseudonymized (hashed) form of your IP address is held in the server’s working memory for up to 15 minutes to limit the number of submissions. It is not stored permanently. Messages with an unusual number of links are not accepted. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in protecting the form against abuse).

Retention: we keep enquiries for as long as necessary to handle them. If no business relationship follows, we delete them no later than 12 months after our last contact. If a contract is concluded, statutory retention obligations under commercial and tax law apply to the related correspondence.

4. Cookies and similar technologies

This website stores one strictly necessary cookie, fq_consent, which remembers your privacy choice for 12 months. Its storage is exempt from consent (art. 22.2 LSSI-CE; § 25(2) No. 2 TDDDG); we keep it to be able to demonstrate your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). Optional technologies — currently only Google Analytics, see the next section — are used only with your consent. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page. Fonts are hosted on our own server, so no connection to external font services is made. Details, including all cookie names and storage periods, are on our cookies page.

5. Web analytics with Google Analytics 4

If you consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google processes the data on our behalf as a processor under the Google Ads Data Processing Terms, which apply to Google Analytics.

Purpose: Statistics about how the website is used: which pages are viewed, how visitors arrive (e.g. search engine or link), how long they stay and which device type they use. We use the results only in aggregated form to improve the website.

Data processed: Pages viewed and interactions, referring website, browser, operating system, device type, screen size, language and an approximate location (country/region). According to Google, the IP address of visitors from the EU is used on EU servers solely to derive this location and is then immediately discarded; Google Analytics 4 does not log or store IP addresses. Google signals, granular location and device data and all advertising features are switched off.

Legal basis: your consent, Art. 6(1)(a) GDPR; for storing and reading information on your device, art. 22.2 LSSI-CE and, for users in Germany, § 25(1) TDDDG. Google Analytics is only loaded after you have consented — without consent, no data is sent to Google. You can withdraw your consent at any time with effect for the future via “Cookie settings” at the bottom of every page; the Google Analytics cookies are then deleted. Withdrawal does not affect the lawfulness of processing before it.

Transfers: Google may also process the data in the USA (Google LLC). Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision. The EU Standard Contractual Clauses apply as an additional safeguard.

Storage period: Google Analytics deletes the collected data (event and user data) after 2 months; the cookies expire after 12 months at the latest and are removed when you withdraw your consent.

Settings: Google signals, granular location and device data and the advertising features of Google Analytics are switched off. Google’s privacy policy: https://policies.google.com/privacy

6. Links to other websites

This website contains plain links to other websites (for example to havyt.app). No data is transmitted to these websites until you click a link. Once you are on another website, its own privacy policy applies.

7. Recipients and transfers

Personal data is only shared with the processors named above (hosting and email and, if you consent, Google for web analytics), who process it on our behalf and under data processing agreements. We do not sell personal data and do not share it for advertising. Disclosure to public authorities only takes place where we are legally obliged to do so.

8. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR)
• have inaccurate data corrected (Art. 16 GDPR)
• have your data erased (Art. 17 GDPR)
• restrict processing (Art. 18 GDPR)
• receive your data in a portable format (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR), e.g. via “Cookie settings”

To exercise your rights, write to hello@framequality.org. We may ask you to verify your identity and will reply within one month.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also contact the authority in the EU country where you live or work.

9. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Security

This website is delivered exclusively via encrypted connections (HTTPS) and uses security headers that restrict which resources may be loaded. Access to enquiries is limited to the people who need it to answer you.

11. Changes to this policy

We update this policy when the website or the legal requirements change. The date of the current version is shown at the top of this page.