Who is responsible
The controller is Northframe s.r.o., IČO 246 03 830, with registered office at Dejvická 189/7, Dejvice, 160 00 Praha 6, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, section C, file 443855 (“Northframe”, “we”, “us”).
Questions and privacy requests can be sent to mail@northframe.cz.
Data in the Karta app
Karta does not require an account and currently has no Northframe-operated backend. Your optional player name, saved course layouts, rounds, scores, settings, and share-card choices are stored in the app’s local database on your iPhone. Northframe does not receive that information.
You can delete this local information inside Karta using Delete all local data. Removing the app also removes its ordinary local app data, subject to the backup and device-management behaviour of iOS that you control.
Location, MapKit, photos and sharing
If you ask for nearby courses, Karta requests location access while the app is in use. The location is used to make a nearby search through Apple MapKit. Karta does not record your route or build a location history. Course records you choose to save may include the course name, Apple place reference, and course coordinates in the local app database.
Choosing a photo uses Apple’s photo picker. Saving a scorecard requests add-only access to Photos. Sharing uses the standard iOS share sheet and sends the image only to the destination you select. Apple and the selected destination process data under their own terms and privacy notices.
Website visits
When you visit karta.golf, our hosting provider may process technical request data such as IP address, request time, requested page, browser or device information, and security signals. We use this information to deliver, secure, diagnose and maintain the website. The legal basis is our legitimate interest in operating a reliable and secure service under Article 6(1)(f) GDPR.
If you choose “Allow analytics”, we use PostHog Cloud EU to understand website traffic and which parts of Karta’s site are useful. PostHog may process an anonymous visitor identifier, page URL and title, referrer, visit time, browser and device information, approximate location derived from the network request, and the limited interaction events described on this page. We do not identify visitors, send email addresses or form contents to PostHog, use advertising trackers, or record sessions.
Optional analytics is based on your consent under Article 6(1)(a) GDPR. PostHog is not loaded until you allow it. Your choice is stored in your browser so we can respect it. You can withdraw or change that choice at any time through Cookie settings in the footer; withdrawal does not affect earlier lawful processing. Declining analytics does not affect the website.
Messages and support
If you email us, we process your email address, name if supplied, message and related correspondence to answer you, provide support, or take steps you request before a possible contract. The legal basis is Article 6(1)(b) GDPR where your request concerns a contract, and otherwise our legitimate interest in responding under Article 6(1)(f).
Email updates
If you joined Karta’s pre-launch list or otherwise choose to receive product updates, we use your email address to send those updates. The legal basis is your consent under Article 6(1)(a) GDPR. A confirmation email is used to verify the address before the subscription becomes active. You can unsubscribe from every marketing message or contact us to withdraw consent.
We use Buttondown, LLC as our mailing-list provider. When you submit the form, Buttondown processes your email address, IP address, referrer information and subscription timestamp for confirmation, list management, delivery, bounce handling and unsubscribe records. You can read Buttondown’s privacy policy. A pending or active subscription is kept until you withdraw it, the list is retired, or it is removed after prolonged inactivity; limited suppression data may then be retained to respect your opt-out.
Recipients and international transfers
We use service providers only where needed to run the website and communications. These may include Vercel for website hosting, PostHog Cloud EU for consented website analytics, Buttondown for subscriptions and email delivery, our ordinary email provider, and Apple for App Store distribution and MapKit. We may also disclose information where required by law or necessary to establish, exercise or defend legal claims.
Some providers may process information outside the European Economic Area. Where required, transfers are protected by an adequacy decision, standard contractual clauses, or another lawful safeguard available under GDPR. Buttondown is based in the United States and its data processing agreement incorporates the European Commission’s standard contractual clauses.
How long information is kept
- Local Karta data remains on your iPhone until you delete it or remove the app.
- Ordinary enquiries are generally retained for up to 24 months after the last contact.
- Launch-list subscriptions are kept until consent is withdrawn, the list is retired, or the address is removed after prolonged inactivity.
- Contract, accounting, dispute or compliance records may be kept for the period required by law or necessary to protect legal rights.
- Technical website logs are kept only for the period needed for security, diagnosis and operation, according to our hosting configuration and provider retention controls.
- Consented website analytics is retained only for the period configured in our PostHog project and no longer than needed to understand and improve the site.
Your rights
Where GDPR applies, you may request access, correction, deletion, restriction, or portability of your personal data, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing. These rights can be limited where an applicable legal exception applies.
Contact us at mail@northframe.cz. You may also complain to the Czech Office for Personal Data Protection at uoou.gov.cz, or to the supervisory authority where you live or work.
Security and changes
We use reasonable technical and organisational measures appropriate to the nature of the information we process. No system can be guaranteed completely secure. We will update this policy when Karta’s features, providers or legal obligations materially change and will publish the revised effective date here.