1.Who we are
BuyFrame & Co Ltd ("BuyFrame", "we", "us") is a company headquartered in London. We run buy-frame.com and the BuyFrame platform, including PriceFRAME and our other products ("the Services"). This policy explains what personal data we collect, why, and the choices you have.
For the personal data described here, we are the "controller" under the UK GDPR and the Data Protection Act 2018. If you use the Services on behalf of an organisation and put personal data of its customers or colleagues into the workspace, we handle that data on the organisation's instructions as its "processor".
Questions about this policy or your data: sales@buy-frame.com.
2.What we collect
Sign-up. When you create an account:
- your name, work email address and password. We never store your password itself, only a salted hash of it;
- your account (company) name, what you will use BuyFrame for, and the product you want to start with;
- optionally, your phone number and country code.
Contact Sales. If you use the contact form: your name, work email, company, optional phone number, and anything you write in your message.
Your workspace. Quotes, prices, documents, approvals and other content you or your team add to the Services, and the actions agents and people take on it.
Technical and security records. Sign-up and log-in events (including failed log-ins) with the date, your email address and your IP address, so we can keep accounts secure and investigate misuse. Our servers also keep standard logs of requests.
Website analytics. Only if you accept analytics cookies: pages viewed, approximate location, device and browser, via Google Analytics. See Cookies.
We do not knowingly collect special-category data (such as health or biometric data), and ask that you do not enter any into the Services.
3.How we use it, and why
| What we do | Data involved | Our lawful basis |
|---|---|---|
| Review and set up your account | Sign-up details | Contract (taking steps at your request before an agreement) and our legitimate interest in vetting who gets access |
| Provide and support the Services | Account details, workspace content | Contract |
| Reply to enquiries and arrange demos | Contact Sales details, your message | Legitimate interests (running our business); steps at your request before a contract |
| Send service emails, such as your account approval | Name, email | Contract and legitimate interests |
| Keep the Services secure, prevent fraud and misuse | Log-in and security records, IP address | Legitimate interests (protecting you and us) |
| Understand how the website is used | Analytics data | Consent. You can withdraw it at any time |
| Meet legal obligations and handle legal claims | Any of the above | Legal obligation; legitimate interests |
We do not sell your personal data. If we ever send marketing emails, we will do so only where the law allows (your consent, or the business-to-business soft opt-in), and every email will let you opt out.
4.How sign-ups are reviewed
New accounts are reviewed by our team before they can log in. When you sign up, we email your name, email address, account name, purpose, chosen product, phone number (if given), the time of sign-up and your IP address to a small group of BuyFrame staff, who approve or decline the request. If you are approved, we email you to say so. We do not send you a separate verification email.
6.International transfers
Some providers, such as Google, Microsoft and LinkedIn, may process data outside the UK, including in the United States. Where they do, we rely on a UK adequacy regulation (such as the UK–US data bridge), or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so your data keeps a similar level of protection.
7.How long we keep it
We keep personal data only as long as we need it for the purposes above. In practice: account and workspace data while your account exists; security and activity records for as long as needed to keep the Services secure and to meet our audit and legal obligations; and enquiry and sign-up records for a reasonable period afterwards in case of follow-up or a legal claim. When we no longer need data, we delete or anonymise it. You can ask us to delete it sooner (see Your rights).
8.Security
Our information security management system is certified to ISO 27001 by British Assessment Bureau (UKAS accredited). Passwords are stored only as salted hashes, traffic to the Services is encrypted with HTTPS, and access to systems and data is restricted to the people who need it. No online service is completely secure, so please use a strong, unique password and tell us straight away if you think your account has been compromised.
9.Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong or incomplete;
- delete your data, in certain circumstances;
- restrict how we use your data, or object to us using it on the basis of our legitimate interests;
- give you your data in a portable format, where we use it under a contract or with your consent;
- stop using it where we rely on your consent, which you can withdraw at any time.
Email sales@buy-frame.com and we will reply within one month.
11.Children
The Services are for businesses and are not aimed at anyone under 18. We do not knowingly collect data from children.
12.Changes to this policy
We may update this policy as our Services or the law change. The date at the top shows when it was last revised, and for significant changes we will tell you by email or on the site. See also our Terms of Service.
13.Contact us
BuyFrame & Co Ltd, London, United Kingdom. Email sales@buy-frame.com.