1. Parties and scope
The customer determining the essential purposes and means acts as controller (or as processor for its own controller) and Frame Web Builder acts as processor only to provide Frame. This DPA applies while Frame processes customer personal data.
2. Scope and roles
The customer acts as controller (or processor for its own customer) and Frame acts as processor only for customer data processed to provide the contracted service.
3. Subject matter and duration
Processing covers hosting, organizing, retrieving, displaying, transmitting, securing, backing up and exporting customer content for the subscription term plus documented deletion, backup and legal-retention windows.
4. Data and data subjects
Customer-selected identifiers, contact data, content, images, metadata and form data may relate to customer staff, visitors, end customers or other people lawfully included by the customer.
5. Documented instructions
Frame processes customer data only on lawful documented instructions needed to provide the service, unless applicable law requires otherwise.
6. Confidentiality
Access to customer data is limited to authorized personnel and service providers subject to appropriate confidentiality obligations.
7. Security measures
Frame applies the technical and organizational controls represented by its authorization, tenant isolation, RLS, encryption, audit, storage and incident-response systems.
8. Subprocessors
Frame may use the providers listed in the public subprocessor register. The register is the authoritative public disclosure; transfer safeguards still require operator/legal verification for the actual production configuration.
9. Controller assistance
Frame provides available tooling and reasonable assistance for data-subject requests, security incidents, deletion/export workflows and compliance evidence, taking account of the nature of processing.
10. Return and deletion
On termination or a valid deletion request, customer data is deleted or returned according to the product lifecycle, available product features, applicable legal obligations and limited provider backup cycles documented for production.
11. Audit and evidence
Frame exposes compliance/audit evidence and may provide additional reasonable information needed to demonstrate these processor obligations, subject to security and confidentiality controls.
12. International transfers
No transfer mechanism is asserted solely from application code. The production operator must document actual locations and the applicable adequacy decision, SCCs or other lawful mechanism before relying on cross-border processing.
13. Subprocessors and current register
The current public register is available at Subprocessors. Actual production regions and transfer mechanisms must be verified before launch.
14. Incorporation and evidence
Acceptance of the current Terms incorporates this DPA, identified by version 2026-09-16.1 and hash 69757e5037442232a58aa921bbd31da84c24a8aa677cdb6868500bbc95446151, when the customer uses Frame to process personal data on its behalf. Any material change requires a new version/hash and is subject to the contractual publication lifecycle.