1. Controller, contact and scope Fraud Research and Intelligence Consultancy (FRIC) is a research and advisory consultancy operating from Ostrava, Czech Republic. Its company registration is pending. The current operator details and status are shown on this page and in the website footer and will be replaced with the definitive registered name, identification number and registered office after incorporation. For this website, newsletter, enquiries and FRIC-managed services, FRIC determines why and how personal data is used and acts as controller unless a specific contract says otherwise. Contact privacy@fricconsultancy.com for privacy questions or rights requests. A client contract, research-participant notice or client-portal notice may provide more specific information and will prevail for that activity. 2. Personal data and sources FRIC may process: • identity and professional data, such as name, role and organisation; • contact data, such as email address, telephone number and correspondence; • enquiry, consultation and publication-request information; • newsletter choices, confirmation, consent, unsubscribe and delivery-status records; • contract, project, document, invoice and transaction information where an engagement proceeds; • account and audit information for authorised website and client-portal access; and • limited technical and security data, such as request time, server logs and consent settings. Most data comes directly from you or an organisation that authorises your access. FRIC may also receive consultation data from the FRIC client portal and public professional or publication information used for legitimate research and business contact. If an organisation provides another person’s data, it must have authority and provide any required notice. 3. Purposes and legal bases FRIC processes personal data to answer enquiries, arrange consultations, deliver commissioned research and advisory services, manage contracts and payments, provide requested publications, administer accounts, send consented updates, maintain security, prevent misuse, keep legally required records and establish or defend legal claims. Depending on the activity, the legal basis is performance of a contract or steps requested before a contract; consent; compliance with a legal obligation; or FRIC’s legitimate interests in operating a secure research and consultancy business, communicating with professional contacts and improving its services. Where special-category or criminal-offence data is required for research or a commissioned project, FRIC will identify an additional lawful condition and apply appropriate safeguards before collection. 4. Recipients and international transfers FRIC uses contracted providers for hosting, authentication, email delivery, secure storage and technical support. Professional advisers, public authorities or project partners receive information only where necessary and lawful. FRIC does not sell personal data. Some providers may process data outside the European Economic Area. Where required, FRIC relies on an adequacy decision, the European Commission’s standard contractual clauses or another lawful transfer mechanism and applies supplementary safeguards appropriate to the risk. 5. Retention and security FRIC keeps personal data only for the period needed for the relevant purpose, legal duties, dispute handling and protected backup rotation. More detail appears in the retention notice below. FRIC applies access control, authentication, encryption where appropriate, logging, minimisation and role-based handling. No internet service is completely risk-free; suspected incidents are assessed and notified where law requires. 6. Your rights Subject to the GDPR and applicable exceptions, you may request access, correction, erasure, restriction or portability; object to processing based on legitimate interests; withdraw consent; and request information about applicable international-transfer safeguards. FRIC does not make solely automated decisions with legal or similarly significant effects through this website. Send a request to privacy@fricconsultancy.com with “Data protection request” in the subject line. FRIC may ask for proportionate identity verification and normally responds within one month, subject to a lawful extension. You may complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, at https://uoou.gov.cz, or to another competent EEA supervisory authority. 7. Children, links and changes The website is intended for adults and professional users and is not designed to knowingly collect data from children. External websites apply their own privacy notices. FRIC may update this notice when services, suppliers, law or processing activities change. Material changes will be identified by a new date and, where appropriate, an additional notice or renewed consent.

FRIC uses purpose-based retention and does not keep personal information indefinitely. • General enquiries, consultation requests and publication requests: ordinarily reviewed for deletion or anonymisation within 12 months after the last meaningful contact unless an engagement proceeds, a dispute exists or law requires longer retention. • Newsletter confirmation: the activation link expires after 48 hours. Expired unconfirmed records are periodically removed. Active contact and consent records remain until unsubscribe, withdrawal or an inactivity review. A minimal suppression record may be retained to ensure an opted-out address is not mailed again. • Email delivery, bounce and complaint events: retained only for campaign accountability, suppression, deliverability and dispute handling, normally for no longer than 24 months unless an investigation or legal duty requires longer. • Client, contract, invoice and transaction records: retained for the periods required by applicable Czech accounting, tax and limitation law. • Research and evaluation data: follow the relevant protocol, ethics approval, consent information and contract. Research data intended for archiving or publication is anonymised or otherwise protected under the applicable research basis. • Security and administrative audit logs: kept only for proportionate security, accountability and dispute-resolution periods, normally no longer than 24 months unless an incident, contract or legal claim requires longer. • Encrypted-at-rest website backups: retained on a rolling schedule of approximately 35 days and then deleted automatically. At the end of a period, data is securely deleted or irreversibly anonymised unless preservation is legally required. A valid deletion request applies to FRIC-controlled active copies and is communicated to relevant processors where required. Backup copies expire through the normal protected rotation and are not restored for ordinary operational use after a valid deletion. Deletion may be limited by legal duties, research safeguards, freedom of expression and information, public interest or legal claims. Send requests to privacy@fricconsultancy.com with “Data deletion request” in the subject line.