Privacy Policy

1. Who we are and scope

U paslaugos, MB, trading as Ufront, is the controller for personal data used to operate this website, manage accounts, answer enquiries, secure the service and run our business. This policy applies to ufront.eu, ufront.es, the Ufront portal and direct business communications with us.

2. Our role in customer services

When a customer uses Ufront to handle its own calls, WhatsApp messages, appointments, properties or knowledge sources, that customer will normally decide why and how the data is used and acts as controller. Ufront normally processes that data on the customer's documented instructions under the applicable service agreement and data processing terms.

3. Personal data we collect

Depending on your interaction, we may process:

• identity, business and contact details;
• account, organisation, role and authentication information;
• enquiries, support communications and meeting details;
• call or message metadata and content when the relevant customer workflow is configured to collect it;
• property, knowledge-base and integration data supplied by a customer;
• billing records, excluding complete payment-card details handled by payment providers;
• device, browser, IP, security, consent and audit information.

4. Purposes and legal bases

We process data only where a legal basis applies. This may include taking steps at your request or performing a contract, complying with legal obligations, pursuing legitimate interests such as service security, support and improvement, or relying on consent where the law requires it. Consent may be withdrawn at any time without affecting earlier lawful processing.

5. Website visit statistics

For our own public website we keep aggregate visit counters that are produced on our servers without any cookie, local storage or device identifier. Each page we serve increments daily counters for the page path, the country, the preferred language and whether the request came from a phone or a computer. In the same way we count every page viewed, the kind of place a visit came from (such as a search engine, a social network or another site, never the address itself) and moves from one of our pages to another. When you move between our pages without the page reloading, the page sends our server only the two page addresses involved, with no cookie and no identifier, and sends nothing if your browser signals Do Not Track or Global Privacy Control. There is no record of an individual visit, and we do not store IP addresses, user-agent strings, session or device identifiers or full referring addresses. An IP address is held in memory only for the instant needed to determine a country from a database on our own server, using the DB-IP IP to Country Lite database by DB-IP (db-ip.com) under the Creative Commons Attribution 4.0 International licence, and is then discarded; it is never written down or sent to a third party. To stop one address from inflating the page-to-page counts, a one-way hash of it, salted with a random value that never leaves the server, is also held in memory for at most one minute and then dropped. Because the result is aggregate and contains no identifier, it is not personal data once counted, and it is kept separately from any customer data. Separate, consent-based Google Analytics measurement is described in the Cookie Policy.

6. Recipients and international transfers

We share data only with authorised personnel, the relevant customer and service providers needed for hosting, communications, AI, support, security or billing. Processing locations depend on the customer's configuration and selected providers. Where data is transferred outside the EEA, we use an applicable transfer mechanism and safeguards, such as an adequacy decision or Standard Contractual Clauses, where required.

7. Retention and security

We keep personal data only for the period needed for the stated purpose, the customer's configured retention period, contractual obligations, security, dispute handling or statutory record-keeping. Deletion from backups may follow a controlled cycle. We use access controls, tenant separation, audit records, transport encryption and protected secret storage appropriate to the service.

8. Your data-protection rights

Subject to applicable law, you may request access, correction, deletion, restriction or portability of your data, object to certain processing and withdraw consent. Contact dpo@ufront.eu and identify the Ufront customer involved where relevant. We may verify your identity and, if the customer is the controller, route the request to that customer.

9. Complaints, children and changes

You may complain to the Lithuanian State Data Protection Inspectorate or the supervisory authority where you live or work. Ufront services are intended for businesses and are not directed to children. We may update this policy when our services or legal duties change; material updates will be identified by a new effective date.