Legal.

1. Who we are

This policy explains how LEGAL ENTITY NAME (“Refram”, “we”, “us”), a company registered in COUNTRY OF INCORPORATION under company number COMPANY REGISTRATION NUMBER with its registered office at REGISTERED ADDRESS, handles personal data.

For the personal data described in section 3, Refram acts as a controller. Where we process personal data on behalf of a client in the course of delivering our services, the client is the controller and Refram is a processor; that relationship is governed by the Data Processing Agreement rather than by this policy.

Questions about this policy, or about how we handle personal data, can be sent to contact@refram.work or to our data protection contact at DPO OR PRIVACY CONTACT EMAIL. IF A DPO IS APPOINTED UNDER ART. 37 GDPR, NAME AND CONTACT DETAILS HERE — DELETE THIS PLACEHOLDER IF NOT REQUIRED.

IF NOT ESTABLISHED IN THE EU/UK: NAME AND ADDRESS OF THE ART. 27 REPRESENTATIVE.

2. Scope

This policy covers the refram.work website and our direct business communications, including enquiries sent to contact@refram.work.

It does not cover the systems we build or operate for clients under an engagement contract, personal data processed within a client's own environment, or third-party websites we link to.

3. Personal data we collect

Enquiry data

Where you email us, the content of your message and any personal data it contains, together with your name, email address, employer, role and any other details you choose to provide.

Business contact data

Names, roles, business email addresses and telephone numbers of client and prospective client personnel, obtained from you directly or in the course of an engagement.

Contract and billing data

Information necessary to negotiate, perform and account for an engagement, including signatory details and purchase order references.

Technical data

Server-side request logs generated when you visit refram.work, which may include IP address, user agent, requested URL, referrer and timestamp. CONFIRM RETENTION PERIOD AND WHETHER IP ADDRESSES ARE TRUNCATED OR ANONYMISED BY THE HOSTING PROVIDER.

Recruitment data

INCLUDE ONLY IF REFRAM ACCEPTS APPLICATIONS — CV content, work history and correspondence relating to an application.

We do not knowingly collect special category data under Article 9 GDPR, and we ask that you do not include such data in enquiries. We do not knowingly collect personal data from children, and our services are not directed to them.

4. Purposes and legal bases

Responding to enquiries

Legitimate interests (Art. 6(1)(f)) in responding to unsolicited business contact, or steps taken at your request prior to entering a contract (Art. 6(1)(b)).

Negotiating and performing engagements

Performance of a contract (Art. 6(1)(b)), or legitimate interests where the counterparty is a corporate entity rather than the individual.

Operating and securing the website

Legitimate interests (Art. 6(1)(f)) in keeping the site available, diagnosing faults and preventing abuse.

Meeting legal and regulatory obligations

Compliance with a legal obligation (Art. 6(1)(c)), including tax, accounting and record-keeping duties.

Establishing or defending legal claims

Legitimate interests (Art. 6(1)(f)), and Art. 9(2)(f) where special category data is unavoidably involved.

Marketing communications

CONFIRM WHETHER ANY MARKETING IS SENT. IF SO, STATE THE BASIS — CONSENT, OR THE SOFT OPT-IN WHERE AVAILABLE — AND THE OPT-OUT MECHANISM. IF NOT, STATE THAT REFRAM SENDS NO MARKETING EMAIL.

Where we rely on legitimate interests we have carried out a balancing assessment; you may request a summary of it using the contact details above.

5. Where the data comes from

Most personal data is provided directly by you. We may also receive business contact details from a client where they introduce you as a participant in an engagement, and from publicly available professional sources such as a company website or professional network profile. Where we obtain data indirectly, we provide the information required by Article 14 GDPR within one month unless an exemption applies.

6. Disclosure and recipients

We do not sell personal data, and we do not share it for third-party advertising.

We disclose personal data to service providers acting on our instructions, listed in the Sub-processors document; to our professional advisers where necessary; to a purchaser or successor in the event of a corporate transaction; and to public authorities where we are legally required to do so.

We assess every disclosure request from a public authority for validity and scope, and we will notify the affected client unless legally prohibited from doing so.

7. International transfers

CONFIRM WHERE PERSONAL DATA IS STORED AND PROCESSED. THE SITE STATES AN EU DATA RESIDENCY POSITION; THE CURRENT HOSTING REGION MUST BE VERIFIED AND STATED HERE.

Where personal data is transferred outside the UK/EEA, we rely on an adequacy decision where one covers the destination, and otherwise on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where the UK GDPR applies), supported by a transfer impact assessment and any supplementary technical measures the assessment identifies.

A copy of the relevant transfer mechanism can be requested using the contact details above.

8. Retention

Enquiries that do not lead to an engagement

PROPOSED: 24 months from last contact.

Client relationship records

PROPOSED: duration of the engagement plus 6 years, aligned to the limitation period in [[GOVERNING LAW JURISDICTION]].

Financial and tax records

PROPOSED: the statutory retention period applicable in [[COUNTRY OF INCORPORATION]].

Website request logs

CONFIRM WITH HOSTING PROVIDER — PROPOSED: 30 days.

At the end of the applicable period we delete the data or irreversibly anonymise it. Where deletion is not immediately possible — for example in a backup — we isolate the data and delete it on the ordinary backup expiry cycle.

9. Your rights

• Access — to obtain confirmation of whether we process your data and a copy of it.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have data deleted where one of the Article 17 grounds applies.
• Restriction — to limit how we use data while a dispute about it is resolved.
• Portability — to receive data you gave us in a structured, machine-readable format where processing is based on consent or contract and is automated.
• Objection — to object to processing based on legitimate interests, and at any time to direct marketing.
• Withdrawal of consent — where processing is based on consent, without affecting processing carried out before withdrawal.
• Not to be subject to a decision based solely on automated processing producing legal or similarly significant effects. We do not make such decisions about visitors to this site.

To exercise a right, write to contact@refram.work. We respond within one month, extendable by two further months for complex requests, and we will tell you if an extension applies. We may need to verify your identity before acting.

If you are unhappy with our response you may complain to a supervisory authority. NAME THE LEAD SUPERVISORY AUTHORITY FOR REFRAM'S MAIN ESTABLISHMENT — e.g. the ICO in the UK, or the relevant national DPA in the EU. You may also complain to the authority in your country of residence or workplace.

10. Security

We maintain technical and organisational measures appropriate to the risk, as described in the Security Measures annex to the Data Processing Agreement.

THE SITE PREVIOUSLY DISPLAYED A “SOC 2 TYPE II” BADGE. DO NOT REINSTATE ANY CERTIFICATION CLAIM UNLESS AN AUDIT HAS BEEN COMPLETED AND A CURRENT REPORT EXISTS — AN UNSUPPORTED CERTIFICATION CLAIM IS A MISREPRESENTATION AND, IN SOME MARKETS, AN UNFAIR COMMERCIAL PRACTICE.

11. Changes to this policy

We may update this policy from time to time. The version in force is the one published here, and material changes will be notified to clients through their usual contact. The date of the current version is shown at the head of this page.

1. These terms

These terms govern your use of refram.work. By using the site you accept them. If you do not accept them, do not use the site.

These terms do not govern the supply of services. Any engagement between Refram and a client is governed exclusively by a separate written agreement, and in the event of conflict that agreement prevails over these terms.

2. Permitted use

You may access the site for lawful purposes connected with evaluating or engaging our services.

• Do not attempt to gain unauthorised access to the site, its servers or any connected system.
• Do not introduce malicious code, or conduct denial-of-service or load-testing activity.
• Do not scrape, mirror or systematically extract content except as permitted by section 4.
• Do not misrepresent your identity or affiliation.
• Do not use the site in a way that breaches applicable law or infringes another party's rights.

3. Availability

The site is provided on an “as available” basis. We may suspend, withdraw or restrict all or part of it without notice, and we do not undertake that it will be uninterrupted or error-free.

4. Intellectual property

All content on the site — including text, graphics, the Refram name and logo, and the underlying design and code — is owned by Refram or its licensors and is protected by intellectual property law.

You may view content, and print or download extracts, for your own internal evaluation. You must not use any part of it commercially, or reproduce or redistribute it, without our prior written consent. Our status as author must be acknowledged.

Third-party marks shown on the site, including the logos of software products we integrate with, remain the property of their respective owners. Their appearance denotes interoperability and does not imply endorsement, partnership or affiliation. CONFIRM THAT EACH LOGO IS USED WITHIN THAT OWNER'S PUBLISHED BRAND GUIDELINES, AND OBTAIN PERMISSION WHERE THOSE GUIDELINES REQUIRE IT.

5. No reliance and no offer

Content on the site is provided for general information. It is not advice, and it is not an offer capable of acceptance. Nothing on the site forms a contract or a commitment to supply services on any particular terms.

Descriptions of capabilities, architectures and outcomes are illustrative. Figures such as reallocated hours, recovered margin or conversion rates describe modelled or illustrative scenarios and are not a representation, warranty or guarantee of the result any particular client will achieve.

LEGAL REVIEW: THE HOME PAGE CONTAINS SPECIFIC QUANTIFIED CLAIMS — FOR EXAMPLE “180 HOURS/WEEK REALLOCATED”, “15% REV-SHARE SECURED AUTOMATICALLY”, “NEAR 100%” CONVERSION AND “UP TO 40%” OF A MANAGER'S WEEK. THESE SHOULD EITHER BE SUBSTANTIATED WITH EVIDENCE THAT COULD BE PRODUCED TO A REGULATOR, OR RE-FRAMED AS ILLUSTRATIVE. AN UNSUBSTANTIATED QUANTIFIED CLAIM IS A MISLEADING COMMERCIAL PRACTICE IN MOST EU/UK CONSUMER AND ADVERTISING REGIMES, AND A DISCLAIMER IN THESE TERMS WILL NOT ON ITS OWN CURE IT.

6. Liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited.

Subject to that, we exclude all implied conditions, warranties and representations relating to the site to the fullest extent permitted, and we are not liable for loss of profit, revenue, business, goodwill, anticipated savings, or any indirect or consequential loss arising from use of, or inability to use, the site.

Our total liability in connection with the site is limited to LIABILITY CAP — PROPOSED: A NOMINAL SUM SUCH AS £100 / €100, GIVEN THE SITE IS PROVIDED FREE OF CHARGE.

REVIEW ENFORCEABILITY IN EACH TARGET MARKET. IF THE SITE IS ACCESSED BY CONSUMERS, STATUTORY CONSUMER RIGHTS ARE UNAFFECTED AND THIS CLAUSE MUST SAY SO.

7. Links

Links to third-party sites are provided for convenience. We do not control them, do not endorse them, and accept no responsibility for their content or for any loss arising from your use of them.

8. Changes

We may revise these terms at any time by amending this page. Check this page when you use the site; the version in force is the one published here.

9. Governing law and jurisdiction

These terms and any dispute arising from them are governed by the law of GOVERNING LAW, and the courts of JURISDICTION have exclusive jurisdiction.

IF CONSUMERS MAY ACCESS THE SITE FROM THE EU, MANDATORY CONSUMER JURISDICTION RULES MAY OVERRIDE AN EXCLUSIVE JURISDICTION CLAUSE. CONFIRM THE POSITION.

1. Application

This Data Processing Agreement (“DPA”) forms part of the engagement contract between Refram and the client (“Customer”). It applies where Refram processes personal data on the Customer's behalf in delivering the services.

The Customer is the controller and Refram is the processor. Where Refram engages another party to carry out processing activities on the Customer's behalf, that party is a sub-processor.

Terms defined in the GDPR — controller, processor, personal data, processing, personal data breach, supervisory authority, data subject — carry those meanings here.

2. Subject matter and details of processing

Subject matter

Provision of orchestration, integration and Model Context Protocol engineering services as described in the engagement contract.

Duration

The term of the engagement contract, plus any period during which Refram is required to retain data under clause 10.

Nature and purpose

Ingesting, normalising, storing, analysing and writing back operational data across Customer systems in order to produce and execute prioritised next actions.

Categories of data subject

TO BE COMPLETED PER ENGAGEMENT — TYPICALLY THE CUSTOMER'S EMPLOYEES AND CONTRACTORS, AND WHERE CRM OR ERP DATA IS IN SCOPE, THE CUSTOMER'S OWN CUSTOMERS AND SUPPLIER CONTACTS.

Types of personal data

TO BE COMPLETED PER ENGAGEMENT — TYPICALLY NAMES, BUSINESS CONTACT DETAILS, ROLE AND TEAM, SYSTEM IDENTIFIERS, TASK AND WORKFLOW ASSIGNMENTS, ACTIVITY AND APPROVAL RECORDS, AND THE CONTENT OF WORK COMMUNICATIONS WHERE INGESTED.

Special category data

STATE WHETHER ANY ART. 9 DATA IS IN SCOPE. IF IT IS, ADDITIONAL SAFEGUARDS AND AN ART. 35 DPIA WILL BE REQUIRED.

3. Refram's obligations

• Process personal data only on the Customer's documented instructions, including as to international transfers, unless required otherwise by law — in which case Refram will notify the Customer before processing unless the law prohibits that notification.
• Immediately inform the Customer if, in Refram's opinion, an instruction infringes the GDPR or other applicable data protection law.
• Ensure that personnel authorised to process personal data are bound by an appropriate duty of confidentiality and have received data protection training.
• Implement and maintain the technical and organisational measures set out in the Security Measures annex, taking account of the state of the art, cost, and the nature, scope, context and purposes of processing.
• Assist the Customer, by appropriate technical and organisational measures and insofar as possible, in fulfilling its obligation to respond to data subject rights requests.
• Assist the Customer in complying with Articles 32 to 36, including security, breach notification, data protection impact assessments and prior consultation.
• Make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits under clause 8.

4. Customer's obligations

• Ensure there is a valid legal basis for the processing instructed, and that required transparency information has been given to data subjects.
• Ensure instructions to Refram comply with applicable data protection law.
• Not provide Refram with special category data, criminal offence data, or personal data of children, except as expressly agreed in writing and with the additional safeguards then agreed.
• Maintain the confidentiality of any credentials issued for access to the Customer's systems.

5. Sub-processors

The Customer gives general written authorisation for Refram to engage sub-processors. Current sub-processors are listed in the Sub-processors document.

Refram will give the Customer at least NOTICE PERIOD — PROPOSED: 30 DAYS notice of the intended addition or replacement of a sub-processor. The Customer may object on reasonable data protection grounds within that period; the parties will then discuss in good faith, and if no resolution is reached the Customer may terminate the affected services without penalty.

Refram imposes on each sub-processor data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for the sub-processor's performance.

6. International transfers

Refram will not transfer personal data outside the UK/EEA without an appropriate transfer mechanism under Chapter V GDPR.

Where the Standard Contractual Clauses apply, they are incorporated into this DPA: Module Two (controller to processor) applies between the Customer and Refram, and Module Three (processor to processor) between Refram and its sub-processors. COMPLETE THE SCC ANNEXES: PARTIES, DESCRIPTION OF TRANSFER, COMPETENT SUPERVISORY AUTHORITY, AND TECHNICAL AND ORGANISATIONAL MEASURES.

Where the UK GDPR applies, the UK International Data Transfer Addendum is incorporated with the tables completed accordingly.

7. Personal data breach

Refram will notify the Customer without undue delay, and in any event within BREACH NOTIFICATION WINDOW — PROPOSED: 24 HOURS of becoming aware of a personal data breach affecting personal data processed under this DPA.

The notification will describe the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address it and mitigate its effects. Where the information cannot be provided at once, it will be provided in phases without undue further delay.

Refram will not make any public statement or regulatory notification concerning a breach affecting the Customer's data without the Customer's prior written approval, unless legally required to do so.

8. Audit

Refram will make available to the Customer, on request and no more than once in any twelve-month period, the information reasonably necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits conducted by the Customer or an auditor it mandates.

Audits will be conducted on reasonable notice of at least AUDIT NOTICE PERIOD — PROPOSED: 30 DAYS, during business hours, subject to confidentiality undertakings, and in a manner that does not unreasonably disrupt Refram's operations. Additional audits may be conducted where required by a supervisory authority or following a personal data breach.

CONSIDER WHETHER TO OFFER AN INDEPENDENT AUDIT REPORT IN SATISFACTION OF THIS CLAUSE. DO NOT DO SO UNTIL SUCH A REPORT ACTUALLY EXISTS.

9. Model training and derived data

Refram will not use Customer personal data to train, fine-tune or evaluate any model that is made available to, or whose outputs are made available to, any party other than the Customer.

Where the Customer instructs Refram to train or fine-tune a model on Customer data, that model and its weights are held for the Customer's exclusive benefit and are subject to the return and deletion obligations in clause 10.

Refram will not transmit Customer personal data to a third-party model provider except to a sub-processor listed in the Sub-processors document, under terms that prohibit the provider from using the data for its own purposes including model training.

THIS CLAUSE REFLECTS THE “MANAGED MODEL FEEDING” AND DATA-SOVEREIGNTY POSITION STATED ON THE SITE. VERIFY THAT THE TECHNICAL ARCHITECTURE AND EVERY UPSTREAM PROVIDER CONTRACT ACTUALLY SUPPORT IT BEFORE THIS IS OFFERED TO A CUSTOMER — IT IS A HARD COMMITMENT.

10. Return and deletion

On termination or expiry of the engagement, and at the Customer's election, Refram will return the personal data to the Customer in a commonly used machine-readable format or delete it, and delete existing copies, unless retention is required by law.

The Customer must make its election within ELECTION WINDOW — PROPOSED: 30 DAYS of termination. Absent an election, Refram will delete the data at the end of that period.

Backup copies are deleted on the ordinary backup expiry cycle, which is BACKUP RETENTION PERIOD. Until deleted, they remain subject to this DPA.

Refram will certify deletion in writing on request.

11. Liability and precedence

Liability under this DPA is subject to the limitations and exclusions in the engagement contract, except to the extent applicable law prohibits that limitation. CONFIRM THE INTERACTION BETWEEN THE CONTRACTUAL LIABILITY CAP AND ART. 82 GDPR LIABILITY — A CAP CANNOT DISPLACE A DATA SUBJECT'S DIRECT STATUTORY CLAIM.

In the event of conflict between this DPA and the engagement contract, this DPA prevails in respect of the processing of personal data. In the event of conflict between this DPA and the Standard Contractual Clauses, the Clauses prevail.

Annex — Security measures

THIS ANNEX MUST DESCRIBE THE MEASURES ACTUALLY IN PLACE. DO NOT PUBLISH A GENERIC LIST. AT MINIMUM, DOCUMENT THE POSITION ON EACH ITEM BELOW AND DELETE ANY THAT IS NOT IMPLEMENTED.

• Encryption of personal data in transit and at rest, and the key management arrangements.
• Access control: least privilege, role-based access, mandatory multi-factor authentication, and the joiner/mover/leaver process.
• Network segregation between client environments, and between production and non-production.
• Logging and monitoring, including retention of audit logs and alerting on anomalous access.
• Secure development practices: code review, dependency scanning, and secret management.
• Business continuity and disaster recovery, including backup frequency, restore testing and recovery objectives.
• Personnel security: background screening where lawful, confidentiality undertakings and periodic training.
• Vendor management and periodic re-assessment of sub-processors.
• Incident response procedure, including roles, escalation path and post-incident review.
• Periodic penetration testing and vulnerability management, with defined remediation timeframes by severity.

Current sub-processors

THIS TABLE MUST BE COMPLETED FROM THE ACTUAL VENDOR LIST BEFORE PUBLICATION. AN INCOMPLETE SUB-PROCESSOR LIST IS AN ART. 28 BREACH AND IS ONE OF THE FIRST THINGS AN ENTERPRISE PROCUREMENT REVIEW WILL CHECK.

For each entry, record: legal entity name, the processing activity it performs, the categories of personal data involved, the country of processing, and the transfer mechanism where processing occurs outside the UK/EEA.

Vercel Inc.

Hosting and content delivery for refram.work. Processes website request logs. CONFIRM PROCESSING REGIONS AND THE APPLICABLE TRANSFER MECHANISM UNDER VERCEL'S DPA.

EMAIL AND PRODUCTIVITY PROVIDER

Business email and document collaboration, including enquiries sent to contact@refram.work. COMPLETE — THE MX RECORDS FOR refram.work CURRENTLY POINT TO HOSTINGER, SO THE RELEVANT ENTITY AND ITS DPA MUST BE IDENTIFIED.

CLOUD INFRASTRUCTURE PROVIDER

COMPLETE IF CLIENT WORKLOADS ARE HOSTED BY REFRAM RATHER THAN IN THE CLIENT'S OWN TENANCY.

MODEL / LLM PROVIDER

COMPLETE FOR EACH PROVIDER WHOSE MODELS ARE USED IN DELIVERY. STATE THE ZERO-RETENTION AND NO-TRAINING TERMS RELIED ON, WITH A CONTRACTUAL REFERENCE.

ADDITIONAL SUB-PROCESSORS

ADD ANY ANALYTICS, ERROR TRACKING, CRM, SUPPORT DESK, PAYROLL OR ACCOUNTING PROVIDER THAT TOUCHES PERSONAL DATA.

Change notification

Refram maintains this list and notifies clients of intended additions or replacements at least NOTICE PERIOD — MUST MATCH THE DPA in advance.

To receive notifications, write to contact@refram.work. CONSIDER PROVIDING A SUBSCRIPTION MECHANISM — ENTERPRISE PROCUREMENT COMMONLY REQUIRES ONE.

Objections may be raised on reasonable data protection grounds under clause 5 of the Data Processing Agreement.

Current position

As published, refram.work sets no cookies and uses no analytics, advertising or tracking scripts. Fonts are served from the site's own origin rather than from a third-party font host, so no request carrying your IP address is made to another party in order to render the page.

The site stores nothing in your browser's local or session storage.

Because nothing is stored on or read from your device beyond what is strictly necessary to deliver the page you requested, no consent banner is required under the ePrivacy rules. There is accordingly nothing for you to configure on this page.

VERIFY THIS STATEMENT AGAINST THE DEPLOYED SITE BEFORE PUBLICATION, AND RE-VERIFY WHENEVER A THIRD-PARTY SCRIPT IS ADDED. IT IS ACCURATE FOR THE CURRENT BUILD.

Server-side logging

Our hosting provider records ordinary request logs when you visit. That is server-side and does not involve storing information on your device, so it falls outside the cookie rules — but it is still personal data, and it is covered by the Privacy Policy.

If tracking is introduced later

IF ANALYTICS, A CHAT WIDGET, EMBEDDED VIDEO, OR ADVERTISING OR CONVERSION PIXELS ARE ADDED, THIS DOCUMENT MUST BE REPLACED WITH A FULL COOKIE POLICY AND A CONSENT MECHANISM. THE REQUIREMENTS BELOW ARE THE MINIMUM.

• Non-essential cookies must not be set before the user has given consent — consent must be prior, not implied by continued browsing.
• Refusing must be as easy as accepting: a “Reject all” control of equal prominence at the same layer as “Accept all”.
• No pre-ticked boxes, and no interface design that nudges toward acceptance.
• Consent must be withdrawable at any time, as easily as it was given, with a persistent link to this page.
• A record of consent must be kept: what was consented to, when, and the version of the notice shown.
• Each cookie must be listed with its name, provider, purpose, duration and type.
• Consent must be re-sought when purposes or providers materially change.

Reporting a vulnerability

If you believe you have found a security vulnerability affecting Refram, report it to SECURITY CONTACT EMAIL — PROPOSED: security@refram.work. Please do not disclose it publicly before we have had a reasonable opportunity to respond.

Include enough detail to reproduce the issue: the affected asset, the steps taken, the impact you believe it has, and any proof-of-concept material. Reports in English are preferred.

PROPOSED: PUBLISH A security.txt FILE AT /.well-known/security.txt PER RFC 9116, AND OFFER A PGP KEY FOR ENCRYPTED REPORTS. NEITHER EXISTS YET.

Our commitments

• Acknowledge your report within ACKNOWLEDGEMENT TARGET — PROPOSED: 3 WORKING DAYS.
• Provide an initial assessment within TRIAGE TARGET — PROPOSED: 10 WORKING DAYS.
• Keep you informed of remediation progress, and tell you when the issue is resolved.
• Credit you publicly if you wish, once a fix is deployed.
• Not pursue or support legal action against you for research conducted in good faith within the scope and rules below.

Scope

In scope: refram.work and its subdomains, and LIST ANY OTHER REFRAM-OPERATED ASSETS.

Out of scope: client environments and any system Refram operates on a client's behalf — we cannot authorise testing of a third party's systems, and doing so may be a criminal offence. Also out of scope: third-party services we merely use, and findings that require physical access or a compromised end-user device.

Rules of engagement

• Do not access, modify, exfiltrate or destroy data that is not your own. If you encounter personal data, stop, do not retain it, and tell us.
• Do not perform denial-of-service, volumetric or load testing.
• Do not use social engineering, phishing, or physical intrusion against Refram personnel or premises.
• Do not use automated scanning that degrades service availability.
• Use only test accounts you have created, and interact only with accounts you own.

Recognition

STATE WHETHER A BOUNTY IS PAID. IF THERE IS NO BOUNTY, SAY SO PLAINLY — “WE DO NOT CURRENTLY OFFER MONETARY REWARDS” — RATHER THAN LEAVING IT AMBIGUOUS, WHICH GENERATES DISPUTES.

Commonly reported non-issues

• Missing security headers with no demonstrated exploit.
• Reports generated solely by an automated scanner, without a working proof of concept.
• Absence of SPF, DKIM or DMARC on domains that send no mail.
• Rate-limiting or brute-force findings on endpoints with no authentication.
• Self-XSS, clickjacking on pages with no state-changing action, and issues requiring an unsupported browser.

Applicability

AN IMPRESSUM IS MANDATORY UNDER § 5 DDG (GERMANY, FORMERLY § 5 TMG) AND EQUIVALENT AUSTRIAN AND SWISS RULES. IT IS REQUIRED IF REFRAM IS ESTABLISHED THERE OR DIRECTS ITS SERVICES TO THOSE MARKETS. IF NEITHER APPLIES, THIS PAGE CAN BE REMOVED — BUT THE FOOTER LINK MUST BE REMOVED WITH IT. AN EMPTY OR INACCURATE IMPRESSUM CARRIES A REAL RISK OF AN ABMAHNUNG.

Provider

Legal entity

FULL REGISTERED NAME AND LEGAL FORM

Registered address

STREET, POSTCODE, CITY, COUNTRY — A PO BOX IS NOT SUFFICIENT

Represented by

NAME(S) OF MANAGING DIRECTOR(S) / AUTHORISED REPRESENTATIVE(S)

Email

contact@refram.work

Telephone

A TELEPHONE NUMBER IS REQUIRED — A CONTACT FORM ALONE DOES NOT SATISFY THE “DIRECT AND EFFECTIVE COMMUNICATION” TEST

Commercial register

REGISTER COURT AND REGISTRATION NUMBER

VAT identification number

VAT ID UNDER § 27a UStG OR LOCAL EQUIVALENT

Regulated profession

COMPLETE ONLY IF APPLICABLE — PROFESSIONAL TITLE, AWARDING STATE, SUPERVISORY CHAMBER AND APPLICABLE PROFESSIONAL RULES

Responsible for content

NAME AND ADDRESS OF THE PERSON RESPONSIBLE UNDER § 18(2) MStV, IF EDITORIAL CONTENT IS PUBLISHED

Dispute resolution

STATE WHETHER REFRAM IS WILLING OR OBLIGED TO PARTICIPATE IN CONSUMER DISPUTE RESOLUTION PROCEEDINGS BEFORE A CONSUMER ARBITRATION BOARD. NOTE THAT THE EU ONLINE DISPUTE RESOLUTION PLATFORM CEASED OPERATION IN 2025, SO THE OLD ODR LINK SHOULD NOT BE REPRODUCED.