Data Processing Terms

Farframe OÜ, the operator of GrowthFolks Network, is the controller of the personal data needed to run the platform: accounts, profiles, jobs, proposals, messages, contracts, documents, agency verification, billing, and technical data.

When clients and agencies share personal data with each other through the platform, for example names and contact details in messages, files, or signed documents, each of them uses that data for their own purposes as an independent controller and is responsible for doing so lawfully. We do not process personal data on a user's behalf as a processor.

We use service providers for hosting, file storage, payments, emails, e-signatures, error monitoring, and place search. They are listed in section 5 of our Privacy Policy. Each provider processes personal data only to provide its service to us, and we remain responsible for how they do it.

Our servers and file storage are in the United States. When personal data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the Standard Contractual Clauses approved by the European Commission.

• All connections to the platform use HTTPS.
• Passwords are stored as bcrypt hashes. Sign-up and password reset codes are stored as hashes and allow a limited number of attempts.
• Sign-in tokens are kept in cookies that page scripts cannot read. Access tokens expire after 15 minutes, and resetting a password signs the account out on all devices.
• Public endpoints limit the number of requests from one IP address.
• Signed documents, chat attachments, and agency verification documents are kept in private storage and are available only through the platform.
• Other uploaded files (proposal attachments, logos, and project images) are stored at hard-to-guess addresses, and anyone who has the link to such a file can open it.
• Error monitoring is set up not to collect user details, cookies, or request contents.
• The admin panel is available only to administrator accounts.
• Backups: [backup-details].

To access, correct, export, restrict, or delete your personal data, or to object to how we use it, email info@growthfolks.io from the email address of your account. We may ask you to confirm your identity.

We reply within one month, free of charge. If a request is complex, we may extend this by up to two more months and will tell you why. Exports are sent as JSON or CSV files. Account deletion is described on the Delete Your Account page.

If we become aware of a personal data breach, we assess its risk, notify the Estonian Data Protection Inspectorate within 72 hours where the law requires it, and inform affected users without undue delay when the breach is likely to put their rights at high risk.

• Only share other people's personal data on the platform when you are allowed to.
• Do not put sensitive data (such as health data or ID documents) or payment card details in jobs, proposals, messages, or files.

Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You can also complain to the data protection authority where you live or work.

Farframe OÜ, registry code 17596971, Ahtri tn 12, 15551 Tallinn, Estonia. Email: info@growthfolks.io.