Data and Security
1. Introduction
1.1. Purpose
Your data and security are important to us. This Data & Security (“Policy”) explains how Frank Consulting Pty Ltd trading as frank (“frank”, “frank diagnostics”, “we”, “us”, “our”) protects your information when you use our frank diagnostics application (“Services”), websites, or otherwise interact with us.
By access or using our Services or interacting with any other aspect of our business, you acknowledge and accept the terms of this Policy.
2. Definitions
Client means the organisation that engages Frank, and the individual at that organisation who initiates the engagement, creates an account and runs a survey.
Survey Respondent means the persons at the Client organisation who are invited to answer or respond to a survey.
3. Policy
3.1. Data and Security Principles
We will:
· manage technology, information and records in a secure and compliant manner;
· implement appropriate controls to protect systems and information;
· restrict access to systems and data based on business need and where applicable, Client requirements;
· ensure information is reliable, appropriately stored and available when required; and
· identify and manage technology and information security risks.
3.2. Privacy
Before they participate, every Survey Respondent will be advised:
• that responses are anonymous;
• what information we will hold about them;
• that their comments will be stripped of any identifying details;
• that nothing is reported for groups under five;
• that taking part is optional; and
• that the survey is run independently by Frank and not the Respondent’s employer.
3.3. Data Storage
All information collected for the Frank diagnostic application is stored and processed in Australia, in Amazon Web Services’ Sydney region. This includes client accounts, respondent email addresses, referral partner details, survey responses, analysis and reports.
All information collected by our websites are hosted on the Wix platform. Wix stores information in data centres in the United States and Ireland and may process it in other countries. This applies to website analytics and cookie data, but not to survey data.
All information relating to payments are processed by Stripe, which stores and processes payment information outside Australia, including in the United States. Stripe receives the purchaser's billing details. It does not receive any respondent information. We do not store bank or credit card numbers.
All information collected and processed through the frank Diagnostic application is analysed by an artificial intelligence model, Claude by Anthropic, which is run through Amazon Bedrock, configured so that the processing stays within Australia.
3.4. Information we don’t collect
To run the Frank diagnostic application, we require a work email, job title, function, and which group (as specified in the survey) a Survey Respondent is allocated to.
We do not require the Survey Respondent’s name, phone number or any other information.
3.5. Anonymity of Survey Data
All survey responses are stored separately and de-identified from email addresses so that there is no link between the two in our systems. That isn't a policy, it's how the system is built.
Other measures we implement to ensure anonymity are:
• Survey Respondents’ email addresses are encrypted at rest;
• Comments are stripped of names, email addresses and phone numbers automatically, before they're stored;
• No result is ever shown for a group of fewer than five people, including breakdowns by role or function; and
• Client organisations will only have visibility over the number of Survey Respondents and not who responded or what any individual said.
3.6. Cryptography & Encryption
Frank deploys cryptographic mechanisms to implement the appropriate encryption and cryptography to mitigate the risk involved in storing personal and sensitive information and transmitting it over networks, including those that are publicly accessible such as the internet.
Frank is committed to protecting your data through:
• Encryption in transit and at rest, with email addresses separately encrypted using managed keys;
• Access controls so no client can see another Client's data;
• Multi-factor authentication on administrative access;
• Logging and monitoring, with regular review; and
• Independent security review before launch.
3.7. Data Management
Frank will delete the Survey Respondent’s email addresses 90 days after the survey closes.
If desired, you have the ability anytime to:
• delete your account with one click; and
• delete everything for a survey from the frank diagnostic application.
The Results we keep after are completely de-identified including the scores, the redacted comments and the Client organisation’s industry and size.
We do not need to keep record of any names, emails and other identifiers to develop the benchmarking required to compare your results year on year.
4. Variation
Frank reserves the right to vary, replace or terminate this Policy from time to time. Frank undertakes to regularly review this Policy to take account of changes in legislation. All employees are required to comply with changes to this Policy.
5. Contacting Us
We welcome your comments regarding this Policy. If you have any questions or would like further information, please contact us by any of the following means during business hours Monday to Friday via email at letsbefrank@frank-co.com.au.