1. Who we are and scope Fraud Research and Intelligence Consultancy (FRIC) is a Czech Republic-based research and advisory consultancy. This notice covers personal data handled through this website, enquiry and consultation forms, newsletter, events, professional engagements and Connection Safety AI. A client contract or research project may have a more specific notice. 2. Information we may collect We may collect names, roles, organisations, contact details, enquiry and consultation information, newsletter choices, correspondence, event registrations, technical security data and information voluntarily supplied to Connection Safety AI. Forms may ask about intended users, jurisdiction, languages, pilot timing and integration constraints. Do not submit passwords, banking credentials, full identity documents, intimate material, unnecessary private messages or another person’s data without a lawful basis. 3. Purposes and lawful bases FRIC uses data to answer enquiries; arrange consultations; provide and evaluate requested services; administer contracts; send consented updates; secure and improve its services; meet legal duties; and establish, exercise or defend legal claims. Depending on the activity, processing may rely on consent, requested pre-contract steps, a contract, legal obligation or FRIC’s legitimate interests in operating a secure and effective consultancy. Consent can be withdrawn without affecting earlier lawful processing. 4. Connection Safety AI Connection Safety AI assesses interaction risk and provides explainable safety guidance; it does not decide whether a person is a fraudster. Users should minimise what they share. Private messages are not used to train general-purpose models by default. For institutional work, contracts will define controller and processor roles, permitted purposes, security, subprocessors, retention and deletion. 5. Sharing and international transfers Access is limited to authorised FRIC personnel and providers that need information for hosting, security, communication, form delivery or another contracted function. FRIC does not sell personal data. Disclosure may occur where law requires it, to protect rights or safety, or in a legitimate corporate transaction with appropriate safeguards. Transfers outside the European Economic Area will use an applicable adequacy decision, contractual safeguards or another lawful mechanism. 6. Security FRIC uses proportionate organisational and technical controls, including minimisation, access restriction, secure transmission and storage, supplier review, incident procedures, appropriate logging and separation of client environments where required. No internet service is completely risk-free. 7. Your rights Subject to applicable law, you may request access, correction, deletion, restriction or portability, object to processing, withdraw consent and complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) or another competent authority. FRIC may verify identity before acting on a request. 8. Children, external links and policy changes The general website is intended for professional and adult audiences and is not designed to knowingly collect children’s data. External sites apply their own notices. FRIC may update this policy when services, suppliers or legal duties change. 9. Contact Use the public email on FRIC’s Contact page and write “Data protection request” in the subject line.

FRIC uses purpose-based retention and does not keep personal information indefinitely. • Browser-only drafts and chatbot conversations remain on the user’s device until cleared or deleted through the available control. • General enquiries and consultation requests should ordinarily be reviewed for deletion or anonymisation within 12 months after the last meaningful contact, unless a service is commissioned or longer retention is legally necessary. • Newsletter contact and consent records remain until unsubscribe, consent withdrawal or periodic inactivity review; a minimal suppression record may be retained to respect an opt-out. • Client, contract, invoice and transaction records remain for periods required by applicable Czech accounting, tax and limitation law. • Project, research and pilot data follows its contract, protocol, ethics approval and participant or client notice. • Security logs and consent records remain only for proportionate security, accountability and dispute-resolution periods. At the end of a period, information is securely deleted or irreversibly anonymised unless preservation is legally required. A valid deletion request applies to FRIC-controlled copies and is communicated to relevant processors where required. Deletion may be limited for legal duties, research safeguards, freedom of expression and information, public interest or legal claims. Send requests through the Contact page with “Data deletion request” in the subject line.