1.    Introduction

1.1.    Purpose
Your privacy is important to us. This Privacy Policy (“Policy”) explains how Frank Consulting Pty Ltd trading as frank (“Frank”, “Frank diagnostics”, “we”, “us”, “our”) collect, use, share and protect your personal information when you use our Frank diagnostics services (“Services”), websites, or otherwise interact with us.
This Policy explains your choices surrounding how we use personal information about you, which includes how you can object to certain uses of personal information about you and how you can access and update certain personal information about you.
By providing us with personal information, you are consenting to us collecting, holding, using, disclosing that personal information in accordance with this policy.

1.2.    Scope
The Privacy Policy (‘Policy’) applies to:

• all employees and all persons performing work at the direction of, or on behalf of, Frank (‘Frank’ or ‘Company’) (for example contractors and ‘workers’ otherwise defined under the Work Health and Safety Act 2011), collectively referred to as ‘Employees’; and

• all personal information collected, held, used or disclosed by the Company in connection with its operations.
   

2.    Definitions
Clients means the organisation that engages Frank, and the individual at that organisation who initiates the engagement, creates an account and runs a survey. 
Employees means any employee, contractor, consultant, temporary worker, volunteer or other person performing work for or on behalf of Frank.
Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in material form or not.
Sensitive Information means Personal Information that is afforded a higher level of protection under privacy legislation, including health information, criminal record information and information relating to racial or ethnic origins, religious beliefs or union memberships.
Services means all works performed by Frank including the frank diagnostic application.
Survey Respondents means the persons at the Client organisation who are invited to answer or respond to a survey. 
Referral Partners means an individual or organisation who signs up to our referral program to recommend the Frank diagnostic application to others. A referral partner may or may not be a client.
Website Visitors means any person who visits our website(s).

3.    Policy
3.1.    Information we may collect
We collect information about you when you input it into the Services or otherwise provide it directly to us. This information may include Personal and/or Sensitive Information and is collected by us only when reasonably necessary to carry out our business activities, operations, employment processes and legal obligations. 
This includes the following categories of information:
For Client Information, we collect:
•    organisation Name, work email address and password (as an account login);
•    applicable industry, organisation size and location;
•    billing name, billing email and where an invoice is issued;
•    Records of surveys created, levels purchased and payments made; and
•    Correspondence with us.
For Client Organisations about Survey Respondent’s Information, we collect:
•    Work email address;
•    Job titles, role level and function; and
•    Whether the person sits in the data and AI team or the elsewhere in the Client organisation.
For Referral Partners, we collect:
•    Email addresses;
•    Name if you choose to give it;
•    The charity you choose to receive donation made on your behalf;
•    Records of the organisation that signed up using your referral link, and whether each has paid of a survey;
•    Whether you have opted in to receive other news from us.
For Website Visitors, we collect:
•    information about your computer, phone, tablet, or other devices you use to access the Services. This device information includes your connection type and settings when you install, access, update, or use our Services. We also collect information through your device about your operating system, browser type, IP address, URLs of referring/exit pages, device identifiers, and diagnostic and crash data. We use your IP address and/or country preference to approximate your location to provide you with a better Service experience. How much of this information we collect depends on the type and settings of the device you use to access the Services;
•    cookies and other tracking technologies (e.g., web beacons, device identifiers and pixels) to provide functionality, remember your preferences, and to demonstrate that certain content was viewed or clicked; and
•    any other information you choose to send us if you contact us via email.

3.2.    Information we do not collect
We do not ask for or collect the Survey Respondent’s name, home addresses, personal email addresses, phone numbers, dates of birth, government identifiers, or any Sensitive Information. 
We do not ask for or collect from the Referral Partner for the contact details of the individuals they refer. Referred organisations are required to sign up themselves.
3.3.    How we use information
We use information for the following purposes:
To provide the Services: We use information about you to provide the Services to you, including producing survey results, analysis and reports for the Client organisation, process payments and transactions, authenticate you when you log in, produce benchmarks that let organisations compare their results with others and meet other legal and record keeping obligations.
To develop and improve our Services we use information about you to provide customer support, and operate, maintain, and improve the Services.
To communicate with you about the Services we use your contact information to send you transaction communications via email, including confirming your purchase, sending out survey invitations and reminders and, where necessary investigate any complaints.
To run our referral program, including attributing referrals, making donations and letting Referral Partners know when a donation has been made.
To de-identify data we may de-identify information collected through the Services so it can no longer be re-identified by us or another party.
To the extent we use such data, we maintain and use such data in de-identified form and will not attempt to re-identify the data.
3.4.    Security of Personal Information
We typically store Personal Information electronically. We will take reasonable steps to protect Personal Information held by us from misuse, interference, loss, unauthorised access, modification or disclosure. Security measures may include restricting physical access to the office and secure databases, passwords and authentication controls, encryption and cybersecurity controls, monitoring and audit processes. 
Some Personal Information may be available to Frank’s Managing Director and authorised Employees of Frank for use strictly in accordance with this Policy.
It is our policy not to retain Personal Information once there is no longer a legal or business need for us to do so. Frank upholds strict policies, procedures and processes surrounding the collection, storage and security of Personal Information held.
While we implement safeguards designed to protect your information, no security system is impenetrable and due to the inherent nature of the internet, we cannot guarantee that information, during transmission through the Internet or while stored on our systems or otherwise in our care, is absolutely safe from intrusion by others.
3.5.    Anonymity of Survey Responses
Our Frank diagnostics application is designed so that a Survey Respondent’s answers cannot be traced back to the individual who gave it by:
•    storing Survey Respondent’s answers separately from the email address used to invite the Survey Respondent to ensure there is no link between the two data in our systems;
•    work emails are encrypted before they are stored;
•    removing names, email addresses, phone numbers and other similar identifying details before a comment or answer is saved;
•    not reporting results for any group of fewer than five Survey Respondent’s including breakdowns by role level, function, job title or similar; and
•    Client organisations will only have visibility over the number of Survey Respondents and not who responded or what any individual said.
However, information that has been input by the Survey Respondent explicitly identifying others or themselves may not be removed. We ask Suvey Respondent’s to not name individuals and paraphrase any traceable comments and/or materials rather than quoting in a way that may make the responses traceable. 
3.6.    Where your information is stored
All information collected for the Frank diagnostic application is stored and processed in Australia, in Amazon Web Services’ Sydney region. This includes client accounts, respondent email addresses, referral partner details, survey responses, analysis and reports.
All information collected by our websites are hosted on the Wix platform. Wix stores information in data centres in the United States and Ireland, and may process it in other countries. This applies to website analytics and cookie data, but not to survey data.
All information relating to payments are processed by Stripe, which stores and processes payment information outside Australia, including in the United States. Stripe receives the purchaser's billing details. It does not receive any respondent information. We do not store bank or credit card numbers.
All information collected and processed through the frank diagnostic application is analysed by an artificial intelligence model, Claude by Anthropic, which is run through Amazon Bedrock, configured so that the processing stays within Australia. 

4.    Access and Correction 
You may request access to your Personal Information held by us and may request correction of information that is inaccurate, incomplete, out of date or misleading.
Requests for access or correction should be made in writing to the Managing Director using the contact details set out in this Policy.
We will respond to requests within a reasonable period and in accordance with applicable privacy laws.
Access may be refused in limited circumstances permitted by law, including where:
•    Granting access poses a serious threat to life, health or safety of anyone;
•    granting access would unreasonably impact the privacy of another person;
•    the information is legally privileged;
•    the request for access is frivolous or vexatious;
•    access would prejudice any discussions and/or negotiations between us and an individual;
•    access would prejudice legal proceedings or investigations; 
•    access would reveal evaluative information generated within our organisation in connection with a commercially sensitive decision-making process; or
•    another lawful exception applies.
There is no charge for requesting access to Personal Information but we reserve the right to charge the requesting party for our reasonable costs in actually providing such access.

5.    Privacy Breaches and Complaints 
Any actual or suspected privacy breach, unauthorised disclosure or misuse of Personal Information will be reported immediately to the Managing Director, and we may:
•    investigate suspected privacy breaches;
•    take corrective or containment action;
•    notify affected individuals or regulators where required; and
•    implement remediation or risk mitigation measures.
Individuals may make a privacy complaint regarding the handling of their Personal Information.
We will:
•    acknowledge and assess complaints appropriately;
•    investigate complaints where necessary; and
•    respond within a reasonable timeframe.

6.    Variation
Frank reserves the right to vary, replace or terminate this Policy from time to time. Frank undertakes to regularly review this Policy to take account of changes in legislation. All Employees are required to comply with changes to this Policy.

7.    Contacting Us
Frank welcomes your comments regarding this Privacy Policy. If you have any questions or would like further information, please contact us by any of the following means during business hours Monday to Friday via email at letsbeFrank@Frank-co.com.au.