1. Controller and processor roles

For website, account, security and direct business administration data, U paslaugos, MB is generally the controller. For customer-managed calls, messages, contacts, properties and knowledge, the customer generally acts as controller and Ufront as processor. The actual roles depend on the facts and are recorded in the service agreement.

2. Processing instructions and DPA

Where Ufront acts as processor, it processes personal data on documented customer instructions, subject to applicable law. Data processing terms addressing GDPR Article 28 obligations are available for relevant services and should be executed with the customer's order or agreement.

3. Lawful basis and transparency

The customer determines and documents the lawful basis for its communications, recordings, lead management and other purposes. It is also responsible for appropriate privacy, AI and recording notices, valid contact permissions and responses to data-subject requests. Ufront does not choose a lawful basis on the customer's behalf.

4. Technical and organisational controls

Available safeguards include tenant-scoped access, role-based permissions, audit events, protected secret storage, transport encryption, retention controls and configurable data sources. Customers must configure least-privilege access, retention and integrations appropriate to their risks.

5. Subprocessors and transfers

Hosting, telephony, messaging, AI and support providers depend on the selected configuration. Current subprocessor and processing-location information is available to customers on request. Where required, the parties use an appropriate international-transfer mechanism and assess provider-specific safeguards.

6. Data-subject requests and deletion

Ufront provides controls and support for access, correction, export, restriction and deletion requests. A person should normally contact the organisation represented by the agent first. Requests sent to dpo@ufront.eu will be assessed and, where another organisation is controller, forwarded or handled with that controller.

7. Risk assessment and sensitive uses

Customers should complete a data protection impact assessment where processing is likely to create high risk, including some large-scale monitoring, sensitive-data or automated-decision scenarios. Do not collect special-category data unless it is necessary, lawful and protected by appropriate safeguards.

8. Security incidents and complaints

Suspected security incidents should be reported promptly to security@ufront.eu. Privacy questions may be sent to dpo@ufront.eu. Individuals may also lodge a complaint with the Lithuanian State Data Protection Inspectorate or their local EEA supervisory authority.

9. WhatsApp and Meta data deletion requests

To request deletion of WhatsApp or Meta-related data held by Ufront, email dpo@ufront.eu with the subject "WhatsApp data deletion". Include your Ufront account email or workspace name, the relevant business phone number and which data you want deleted. Do not send passwords, access tokens or verification codes. We verify the request and coordinate with the business responsible for the conversation. We respond with the outcome and explain any information that must be retained. Removing Meta access or disabling a WhatsApp sender stops access or processing as applicable; it does not by itself erase archived conversations.

Service operator

U paslaugos, MB
Company code: 306139682
VAT number: LT100015258514
Musninkų g. 2-16, LT-07185 Vilnius, Lithuania

Contact Ufront

General: hello@ufront.eu
Sales: sales@ufront.eu
Privacy: dpo@ufront.eu
Security: security@ufront.eu

These public documents provide general information and do not replace an executed order form, data processing agreement or individual legal advice. Where an executed agreement conflicts with these pages, that agreement controls to the extent stated in it and permitted by law.

← Back to Ufront