Privacy notice

This notice explains how we process the personal data of people who visit framems.com, write to us or send us a job application. It is provided under articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and under the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018: “Codice privacy”).

In short: we do not sell data, we do no profiling or advertising, and we use no analytics tools. What you send us through the site’s forms reaches us by email and is not kept on the site.

Data controller

FRAME MULTIMEDIA SOLUTIONS SRLS
Via Paolo Stoppa, 88, 00125 Roma (RM) — VAT no. IT17911191009
Email: info@framems.com · PEC (certified email): framems@pec.it

For any question about this notice or about your data, you can write to us at these addresses. For our activities, the appointment of a Data Protection Officer (DPO) is not mandatory (art. 37 GDPR): the point of contact for any privacy matter is the data controller, at the contact details above.

Data, purposes and retention

Each row is a different processing activity: which data, what it is used for, on what legal basis and how long we keep it.

Processing and data	Purpose	Legal basis	How long
Browsing the site Technical data that the server records at every visit: IP address, date and time, page requested, type of browser and device.	Running the site, protecting it from abuse and cyber attacks, fixing faults.	Our legitimate interest in running the site and keeping it secure (art. 6.1.f GDPR).	Technical records (logs) are kept by the hosting provider only for as long as strictly necessary, normally no more than 30 days, unless they are needed to investigate criminal offences or abuse.
Contact form First and last name, organisation, email, phone number (if you give it), topic and message, date and time of sending.	Answering your request and, if it concerns one of our services, preparing a quote or arranging a meeting.	Pre-contractual steps taken at your request (art. 6.1.b GDPR); for general enquiries, our legitimate interest in replying to you (art. 6.1.f).	24 months from our last exchange. If a contract follows, for its whole duration and then for up to 10 years, as civil and tax law require.
Email, phone, PEC and WhatsApp The data you choose to give us: name, contact details and the content of your messages; by phone and on WhatsApp, also your number.	Replying to your request and following it up.	As for the contact form.	As for the contact form.
Job applications (Work with us) Role, first and last name, email, link to your CV or portfolio, message, date and time of sending; the data in your CV and portfolio and any data that comes up in interviews.	Assessing your profile for open or future positions and contacting you for an interview.	Pre-contractual steps taken at your request (art. 6.1.b GDPR). Unsolicited applications do not require consent (art. 111-bis of the Codice privacy).	24 months from receipt, then we delete it. If we start working together, the data we need is used to manage that relationship.
Form protection A fingerprint (hash) of your IP address, from which the address cannot be read in plain text, and the times of submission.	Limiting submissions to 5 an hour from the same address and blocking automated ones.	Our legitimate interest in keeping the forms secure (art. 6.1.f GDPR).	1 hour.
YouTube videos, only if you press “play” IP address and technical data about your device, collected directly by Google.	Showing you the video you chose and remembering that choice for the other videos on the site.	Your consent (art. 6.1.a GDPR and art. 122 of the Codice privacy), which you can withdraw at any time.	We neither receive nor keep this data. Your choice stays in your browser until you withdraw it; Google keeps the data according to its own privacy policy.

When the period ends, the data is deleted. We keep it longer only if the law requires it or if it is needed to defend our rights in court, and only for as long as necessary.

The data comes from you. If someone writes to us on behalf of your organisation and gives us your contact details, we use them only to handle that request, under the same rules.

The site’s forms

The contact form and the Work with us form save nothing on the site: the server immediately forwards the message by email to our company mailbox and keeps no copy.

The box you tick before sending confirms that you have read this notice. It is not consent: none is needed to answer a request or to assess an application.

Against spam we use a hidden field and check how long the form took to fill in, without recording anything. To limit submissions to 5 an hour, the server keeps for one hour, in a temporary file, only a fingerprint (hash) of your IP address and the times of submission: the address itself is not stored in plain text.

If you apply, do not include in your message, CV or portfolio any “special category” data (health, ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation, genetic or biometric data) or data on criminal convictions, unless it is strictly necessary. If you send it to us when it is not needed, we will not use it and will delete it.

The link to your CV or portfolio leads to an external service (for example LinkedIn or an online storage service): that page follows the rules of the service you chose.

We do not use this data for other purposes, such as newsletters or promotions, without first asking for your specific consent.

Required and optional data

You are not obliged to give us personal data. Without the data the forms mark as required, however, we cannot reply to you or assess an application; the rest is optional.

Browsing data is recorded automatically when you open the site: it is needed to run the site and protect it.

Starting YouTube videos is your choice: if you do not press “play”, the site works just the same.

Security and automated decisions

We process data electronically, only through authorised and trained people, and with technical and organisational measures appropriate to the risk (art. 32 GDPR): an encrypted connection (HTTPS) across the whole site, access protected by personal credentials and limited to those who need it, and suppliers chosen from among those that offer adequate guarantees.

We make no decisions based solely on automated processing, including profiling (art. 22 GDPR): requests and applications are read by a person.

Who receives the data

The data is seen by the people at Frame who are authorised to handle your request or your application. It may also be received by:

• the suppliers who process it on our behalf, bound by contract as data processors (art. 28 GDPR): Hostinger International Ltd (Cyprus), which hosts the site on servers in Germany, keeps its technical logs and sends the messages from the forms; Aruba S.p.A. (Italy), which provides our email mailboxes and our PEC; Google Ireland Limited, whose Gmail service we use to read and manage our company email; the providers of the IT and cloud services we use to organise our internal work, when they are needed to handle your request or your application;
• professionals and consultants who assist us, for example on tax or legal matters, only when needed and under a duty of confidentiality;
• public authorities, when the law requires it;
• the services you choose to use, which process the data as independent controllers under their own privacy policies: WhatsApp Ireland Limited (Meta group), if you write to us on WhatsApp; Google Ireland Limited, if you start a YouTube video.

We do not sell or pass on data to anyone, and we do not disseminate it. The up-to-date list of suppliers is available on request.

Transfers outside the European Union

The site is hosted on servers in the European Union (Germany). To deliver pages faster, the hosting provider may serve them through a content delivery network (CDN) that also has nodes outside the Union; for our company email we also use Gmail, which may process data in the United States.

Any transfer outside the European Economic Area takes place only with the safeguards provided by the GDPR (arts. 44–49): an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework (decision of 10 July 2023), in which Google LLC participates, or the standard contractual clauses approved by the Commission.

If you write to us on WhatsApp or start a YouTube video, Meta and Google may transfer your data to the United States as independent controllers, on the basis of the EU-U.S. Data Privacy Framework or of the other safeguards set out in their privacy policies.

Your rights

At any time, for the data concerning you, you have these rights:

• access: to know whether we process it and to receive a copy (art. 15 GDPR);
• rectification of inaccurate or incomplete data (art. 16);
• erasure (art. 17);
• restriction of processing (art. 18);
• portability: to receive the data you gave us in a commonly used format, or to have it passed to another controller (art. 20);
• objection to processing based on our legitimate interest, on grounds relating to your situation (art. 21);
• withdrawal of consent, where processing is based on consent, without affecting what was done before (art. 7). For YouTube videos there is a button in the cookie policy.

To exercise them, write to info@framems.com or to our PEC address framems@pec.it. It is free of charge. We reply within one month; for complex requests the deadline can be extended to three months, in which case we let you know (art. 12 GDPR). If we have doubts about your identity, we may ask you to confirm it.

If you believe the processing breaks the law, you can lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority), or with the supervisory authority of the EU country where you live or work, or go to court (arts. 77–79 GDPR).

Cookies and browser preferences

The site sets no cookies and uses no profiling tools. It saves only a few technical preferences in your browser and loads YouTube videos only if you press “play”. The details, and the buttons to withdraw consent or delete your preferences, are in the cookie policy.

Children

The site is not aimed at children under 14 and we do not knowingly collect their data. In Italy this is the minimum age for giving consent to online services on your own (art. 2-quinquies of the Codice privacy): if you are under 14, ask a parent before starting YouTube videos.

If you think a minor has sent us personal data, write to us and we will delete it.

Changes to this notice

We may update this notice, for example if the site’s services or the law change. The date of the last update is at the top of the page.