Privacy policy

1. Who is responsible for your data

The controller of the personal data collected through the website reframegroup.com.ua is REFRAME GROUP LLC (ТОВ «РЕФРЕЙМ ГРУП»), a Ukrainian engineering and development group. Hereinafter “we” or “REFRAME GROUP”.

• Full name: Limited Liability Company “REFRAME GROUP” (Товариство з обмеженою відповідальністю «РЕФРЕЙМ ГРУП»)
• EDRPOU code: 46285969
• Registered address: office 29, 29 Yasnohorivska St., Yasnohirka, Kramatorsk district, Donetsk region, 84391, Ukraine
• Website: reframegroup.com.ua
• Email: rfg46285969@gmail.com
• Phone: +38 050 909 48 58
• Working hours: Mon–Fri, 9:00–18:00

For any question about your data, write to our email — it is read by the person responsible for organizing personal data processing in the company.

2. What data we receive

The site doesn't require registration and has no personal accounts. Data about you appears in three ways, and the third only with your consent.

2.1. What you enter in a form yourself

The site has several forms: the “Contact” panel, the cost calculator on the “Our projects” page, the house estimate request, and requests from the “Housing for people”, “For communities”, “For investors” and “Development” sections. In them we ask for:

• your name — required, so we know how to address you;
• your phone number — required, it is the main way for us to reply;
• your email — optional, if you prefer to correspond in writing;
• a message and details of your request — optional. Depending on the form, this may be the construction region, whether you have a plot, the desired floor area and package, the approximate start date, the name of the community and its need, the scope and source of funding, the company name, the amount and format of an investor's participation. With a request from the cost calculator we receive your estimate: the floor area, the completion level, the approximate cost, the additional services you ticked and the delivery location.

Service information is stored with the request: which section of the site or project card you wrote from, and the date and time of the request. If you have allowed advertising cookies, technical data for measuring advertising is added to it — see section 2.4. This lets a manager respond to the point instead of asking everything again.

When a manager handles the request, your card may get a note on the call result (called, couldn't reach, agreed to continue) and a short working note — for example, what was agreed and when to call back.

2.2. What the server records

Like any website, our server keeps a technical access log: IP address, date and time of the request, page address, browser and device type. We don't use these records for advertising and don't try to identify a specific person from them — they are needed to see failures and fend off automated attacks on the site.

2.3. Visit statistics and advertising — only with your consent

On your first visit the site shows a cookie banner. If you agree, the following are turned on:

• Google Analytics 4 — to understand which pages are useful, where visitors come from and where the site is inconvenient to use. It collects: which pages you viewed and for how long, where you came from (search, social media, advertising), device and browser type, approximate location at the country or city level, and actions on the site — clicks on the phone number or email address, opening a project card, using the cost calculator, completing the housing eligibility check, the fact that a form was sent and its category.
• Meta Pixel (Facebook and Instagram) — to measure whether our advertising on Instagram and Facebook brings people who are genuinely interested in our projects, and to show ads to those who have already visited the site and to people similar to our clients. It tells Meta which pages and projects you viewed (the project name and its “from” price), that you used the cost calculator, clicked the phone number or email address, as well as the fact that a request was sent, its category and, for the calculator, the approximate estimate amount.

Google Analytics does not receive your name, phone, email or the text of your request — only the fact that a request was sent and its category (for example, “Community” or “Investor”). There we see aggregated statistics, not specific people. Meta doesn't receive the text of your request either; what exactly it receives when you send a form is described in section 2.4.

Statistics and advertising can be allowed separately from each other. Before you choose and after you decline, these tools are not loaded at all, and the site works just the same.

2.4. Your request and Meta advertising — only with consent to advertising

If you have allowed advertising cookies and sent a form, we inform Meta about the request in two ways: from your browser (the Meta Pixel) and directly from our server (Meta Conversions API). This way measurement isn't lost because of ad blockers, and Meta counts one request once. Together with the fact of the request, Meta receives:

• your name, phone number and email (if you provided it) — only in encrypted form. Before sending, they are irreversibly converted into a hash using the SHA-256 algorithm, so Meta does not receive them as plain text. At the same time, Meta can match the hash with Facebook and Instagram account data — to understand whether the request came from our advertising and to find people similar to our clients;
• technical data — the IP address and browser type from which the form was sent, the country (Ukraine), Meta cookie identifiers (_fbp, _fbc) and the page address. They help link the request to an ad view;
• the request category (for example, “Housing” or “Community”), and for the calculator — the approximate estimate amount.

The text of your message, your answers in the housing eligibility check and managers' working notes are not sent to Meta.

When a manager marks that you are ready to cooperate, our server sends Meta one more event — a “qualified lead” — with the same encrypted contacts and cookie identifiers, but without any details of the conversation. This helps show our advertising to people for whom our projects are genuinely a good fit. To send this event, we store with the request the event identifier, the Meta cookies (_fbp, _fbc) and a note of your consent to advertising.

Without consent to advertising cookies, Meta receives none of the above — neither from your browser nor from our server.

3. What we don't collect

To avoid misunderstandings, let's list it directly. The site has no:

• tracking cookies without your consent — before you choose in the banner and after you decline, the site doesn't set them;
• counters or advertising pixels other than the two described in section 2.3;
• scoring or automated decisions that have legal or other significant consequences for you;
• registration, personal accounts or passwords;
• payments — we don't accept payments on the site and don't ask for card details.

We never ask through the site for a passport scan, a taxpayer ID (RNOKPP), bank card details, an IDP certificate, a veteran ID or medical documents. If documents are ever needed for a contract, this happens separately and with your written consent. Please don't send copies of documents in the “message” field.

The only thing that may resemble profiling is showing our ads on Instagram and Facebook to those who have already visited the site and to people similar to our clients (section 2.4). This happens only with your consent to advertising cookies.

4. The housing eligibility check — separately

The “Housing for people” section has a step-by-step housing eligibility check. It asks sensitive questions: whether you have IDP status, whether you are a veteran or military personnel, whether your home has been destroyed, what own funds you have.

Your answers to these questions stay in your browser and are not sent to our server, to Google Analytics or to Meta. We don't see them, don't store them and can't recover them.

When the check is complete, the site fills the “Check result” field with a short summary — the names of the housing options and an approximate budget. You see this text on the screen and can change it or delete it completely. It reaches us together with your name and phone number only when you press the button.

If you have agreed to statistics, Google Analytics learns only that the check was completed — without a single answer. If you close the page without sending the form, we won't learn your answers, and without consent to statistics we won't even learn that you took the check. Meta learns nothing about the check itself. If you do send the form with the result and have allowed advertising, Meta will receive only the fact of the request with the “Housing” category and the encrypted contacts (section 2.4) — without the text of the result.

The check itself is a guide, not a decision to provide housing. REFRAME GROUP is not a government body and does not make decisions on state housing programs.

5. Why we need this data and on what basis

• To respond to your request — call you back, price the project, prepare an offer, answer your questions. Basis: your consent, which you give by sending the form (Article 11 of the Law of Ukraine “On Personal Data Protection”), as well as steps taken at your request before entering into a contract.
• To keep a record of requests — so as not to lose a request, not to call twice and to see the history of communication. Basis: our legitimate interest in the orderly operation of the company.
• To keep the site running — to see failures and protect against attacks and spam. Basis: our legitimate interest in the security and availability of the site.
• To analyze visits and measure advertising — to understand what works on the site and what doesn't, and to show our advertising to people who may find it interesting, including sending Meta information about requests with encrypted contacts (section 2.4). Basis: your consent, which you give in the cookie banner. You can withdraw it at any time.
• To perform a contract, if we conclude one, and to meet accounting and tax requirements. Basis: the contract and legal requirements.

We don't send marketing emails. If we ever decide to, we will first ask for your separate consent, and you will be able to opt out with a single email.

6. Who we share data with

We don't sell, rent out or exchange your data. Access to it is available to:

• REFRAME GROUP employees who need it to handle your request.
• Telegram. As soon as you send a form, its content — name, phone, email if you provided it, and the text of the message — arrives as a message in the work chat of the responsible managers in the Telegram messenger. This service is provided by Telegram FZ-LLC (United Arab Emirates). Our work bot is password-protected and works only for pre-approved accounts.
• Hetzner Online GmbH (Germany) — the company in whose data center our server physically sits. It provides the hardware and the connection and does not use the data for its own purposes.
• Google — Google Ireland Limited (Ireland) and Google LLC (USA). Our work email runs on Gmail, so correspondence with us is stored in Google services. If you have agreed to statistics, visit data is also processed by Google Analytics.
• Meta — Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA), only if you have agreed to advertising cookies. Meta receives pixel data, as well as information about requests with encrypted contacts sent by our server (section 2.4), and may also use it for its own purposes, including improving ad delivery — in accordance with its privacy policy (facebook.com/privacy/policy).
• Government authorities — only when and to the extent that the law expressly requires it.

If your project requires sharing data with a partner bank, a designer, a contractor or a local government body, we will first ask for separate consent and tell you exactly who it is and why.

Fonts, images and other site files are loaded from our own server, so third-party services don't learn about your visit from them.

7. Where the data is stored

The site server and the request database are located in Germany (Falkenstein) — a European Union country where the General Data Protection Regulation (GDPR) applies. Copies of request notifications are stored in Telegram, whose company is based in the United Arab Emirates. Work correspondence is stored in Google services. If you have agreed to statistics or advertising cookies, visit data is also processed by Google and Meta, including on servers in the USA.

This means some data is processed outside Ukraine. By sending a form or agreeing in the cookie banner, you consent to such transfer. We deliberately keep it to a minimum: the messenger receives only what a manager needs to call you back, Google receives only the facts of visits and requests, and Meta, if you have allowed advertising, also receives your contacts in encrypted form (section 2.4).

8. How long we keep the data

• Requests — while we are working on your request, and for up to three years after the last communication. After that we delete them unless there is a valid contract or a legal requirement to keep them longer.
• Deleted requests first go to the “trash” so that an accidental deletion can be undone, and are erased permanently during routine cleanup.
• Database backups — 30 days, then overwritten.
• Server technical logs — about 14 days.
• Statistics in Google Analytics — data on individual visits is kept for no longer than 14 months, after which Google deletes it automatically; only anonymized summary reports remain.
• Data sent to Meta — retention periods are set by Meta under its own rules.
• Technical data for measuring advertising (event identifier, Meta cookies, consent note) — together with the request, for as long as it is stored.
• Cookies in your browser — retention periods are listed in the table in section 11; you can delete them at any time.
• Email correspondence — for as long as it matters for the work.

If you ask us to delete your data earlier, we will do so.

9. How we protect the data

• The site works only over a secure HTTPS connection: everything you enter in a form is transmitted encrypted.
• The server is protected by a firewall; administrator access is by cryptographic key only, with no passwords.
• Access to the work bot with requests is password-protected and open only to approved administrators.
• Passwords, keys and tokens are stored separately from the site code, in a protected file on the server.
• A database backup is created automatically every day.

No protection is one hundred percent guaranteed. If a data breach occurs that could harm you, we will notify those affected.

10. Your rights

Article 8 of the Law of Ukraine “On Personal Data Protection” gives you the right to:

• know exactly what data of yours we hold, where it came from and what it is used for;
• receive a copy of it;
• correct inaccurate or outdated data;
• demand deletion of the data;
• withdraw consent at any time;
• object to processing;
• file a complaint with the supervisory authority.

How to exercise them. Write to rfg46285969@gmail.com or call +38 050 909 48 58. To avoid disclosing data to a stranger, we will ask you to name the phone number the request was sent from and may call it back for confirmation. We reply within 30 calendar days.

Deletion works like this: we erase the request from the database — it disappears from backups within 30 days, as the backups are refreshed.

Withdrawing consent to cookies takes one click: the “Cookie settings” link is at the bottom of every page of the site. After withdrawal, statistics and the pixel are turned off and their cookies are deleted from your browser; our server will not inform Meta about your future requests. If you have already sent a request and don't want Meta to receive a “qualified lead” event about it, write to us and we will remove the consent note. Withdrawal does not affect processing that took place before it.

In Google Analytics we see only aggregated statistics, so we can't find the data of a specific person there. You can also review and delete data already received by Google or Meta in the settings of your accounts in those services.

If you are not satisfied with our reply, you can file a complaint with the Ukrainian Parliament Commissioner for Human Rights — the authority that oversees compliance with personal data protection law (ombudsman.gov.ua).

11. Cookies and analytics

Cookies are small files that a site stores in your browser. We divide them into three groups:

• Necessary — so the site remembers your choice in the banner. They don't require consent. We don't set a separate cookie for this: the choice is stored in browser storage (localStorage).
• Statistics — Google Analytics 4. Only with your consent.
• Advertising — the Meta Pixel and the transfer of request information to Meta from our server (section 2.4). Only with your consent.

Full list:

Before you choose in the banner and after you decline, no statistics or advertising cookie is set. You can change your decision at any time via the “Cookie settings” link at the bottom of the page. You can also delete or block cookies in your browser settings — the site will work without them.

Your browser may also cache the site's images and styles — that's its normal job, and we have no access to this data.

12. Children

The site is intended for adults. We don't knowingly collect data from people under 18. If you are a parent or guardian and believe a child has left us their data, write to us and we will delete it.

13. Links to other sites

The site has links to our pages on Instagram, TikTok and Threads — at the bottom of the pages, in the menu and in the “Contact” panel. The links themselves transmit nothing: we don't embed widgets from these social networks in our pages. The Meta Pixel works separately from them and only with your consent (section 2.3). Once you go to Instagram, TikTok or Threads, their own privacy rules apply, and we are not responsible for them.

14. Changes to the policy

We may update this policy — for example, when a new form or a new service appears. The current version is always available on the site and on request by email, and the effective date is stated on the first page. If the changes are significant, we will announce them on the site's home page.

The previous version 1.0 was in effect from 23 September 2026. Version 1.1 added visit statistics and the advertising pixel, which work only with your consent, the cookie consent banner and the list of cookies; the site fonts are now loaded from our server instead of Google Fonts. Version 1.1 was in effect from 29 September 2026. Version 1.2 added the transfer of request information with encrypted contacts to Meta — from the browser and from our server, only with consent to advertising (section 2.4) — new pixel events (project view, cost calculator, clicks on phone and email), the cost calculator among the forms and the Threads link, and clarified the name of the data controller in line with the state register.