Privacy Policy

Last updated on 11/10/2025

1. Introduction and Scope

Welcome to FRANK, an AI-powered insurance advisory platform operated by FRANK - AI Insurance Solutions ("FRANK", "we", "us" or "our"). This Privacy Policy describes how we collect, use, disclose, and protect personal data when you use our Service, in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Portuguese Data Protection Law (Law No. 58/2019), and other applicable data protection laws.

This Privacy Policy applies to: (a) insurance brokers, agents, agencies, and networks who subscribe to our Service ("Customers"); (b) end customers of our Customers who interact with the Service ("End Users"); and (c) visitors to our website ("Visitors"). When Customers use our Service to process End User data, Customers act as Data Controllers and FRANK acts as a Data Processor.

We are committed to protecting your privacy and ensuring transparent, lawful, and secure handling of all personal data. By using our Service, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller and Data Protection Officer

Data Controller: FRANK - AI Insurance Solutions Portugal Email: info@meet-frank.com

Data Protection Officer (DPO): For all data protection matters, including exercising your rights, contact our DPO at: Email: dpo@meet-frank.com Subject: "Data Protection Inquiry"

3. Categories of Personal Data Collected

3.1 Customer Data (Insurance Brokers/Agencies)

Account Information: Name, email address, phone number, company name, business address, tax identification number, professional license numbers, and payment information.

Usage Data: Login credentials, IP addresses, browser type, device information, access times, pages viewed, features used, and interaction patterns with the Service.

Communication Data: Records of correspondence with our support team, feedback, survey responses, and meeting notes.

3.2 End User Data (Customers' Clients)

When our Customers use the Service to serve their clients, the following categories of data may be processed:

Identity Data: Full name, date of birth, national identification numbers, passport/ID card numbers, and photographs.

Contact Data: Residential address, email address, phone numbers, and emergency contact information.

Financial Data: Bank account details, payment card information (tokenized), income information, credit history, and insurance premium payment records.

Insurance Data: Policy details, claims history, risk assessments, coverage requirements, beneficiary information, and underwriting data.

Special Category Data: With explicit consent or when necessary for insurance purposes: health information, disability status, criminal convictions (when relevant for insurance risk assessment), and genetic/biometric data (in limited circumstances).

Technical Data: Chatbot interaction data, WhatsApp communications, uploaded documents, and automated assistance requests.

3.3 Website Visitor Data

Analytics Data: IP address, browser type, device information, pages visited, time spent on pages, referral sources, and general location (city/country level).

Cookie Data: As described in Section 10 below.

4. Legal Bases for Processing

We process personal data only when we have a valid legal basis under Article 6 of GDPR and, where applicable, Article 9:

4.1 Contractual Necessity (Article 6(1)(b))

Processing necessary to perform our contract with Customers, including: providing the Service, managing subscriptions, processing payments, and providing customer support.

4.2 Legal Obligation (Article 6(1)(c))

Processing necessary to comply with legal obligations, including: tax and accounting requirements, anti-money laundering (AML) regulations, insurance regulatory compliance, court orders, and data retention laws.

4.3 Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate interests or those of third parties, including: service improvement and development, fraud prevention and security, business analytics, direct marketing to existing customers (with opt-out), and network and information security.

We have balanced these interests against your rights and freedoms and implemented appropriate safeguards.

4.4 Consent (Article 6(1)(a) and Article 9(2)(a))

Where we rely on consent, you have the right to withdraw it at any time. Consent is obtained for:

marketing communications (new prospects), cookies and tracking technologies (beyond strictly necessary), special category data processing (when not covered by other legal bases), and international data transfers (when required).

4.5 Special Category Data - Insurance Purposes (Article 9(2)(h))

Processing of health data and other special category data is lawful when necessary for insurance purposes, including insurance risk assessment, insurance contract administration, and insurance claims processing, provided appropriate safeguards are in place.

5. How We Use Personal Data

5.1 Service Provision

• Enable Customers to access and use the FRANK platform • Process insurance quotes and policy documentation • Automate administrative tasks and paperwork • Analyze insurance contracts and compare coverage • Provide 24/7 AI-powered customer assistance • Manage client communications through integrated channels • Integrate with Customers' existing systems and databases

5.2 Business Operations

• Account creation and management • Payment processing and billing • Customer support and technical assistance • Service performance monitoring and improvement • Internal research and development • AI model training (using anonymized data only)

5.3 Legal and Security

• Compliance with legal and regulatory obligations • Fraud detection and prevention • Security monitoring and incident response • Dispute resolution and legal proceedings • Regulatory reporting and audit compliance

5.4 Communications

• Service updates and important notices • Technical alerts and security notifications • Marketing communications (with consent or legitimate interest) • Customer satisfaction surveys and feedback requests

6. Automated Decision-Making and Profiling

Our Service uses artificial intelligence and machine learning to assist insurance brokers. This includes:

AI-Assisted Quotations: Our AI analyzes End User information to generate insurance quotes. These are recommendations to assist brokers and are subject to human review and approval by licensed insurance professionals.

Risk Assessment Support: AI algorithms may analyze data to support risk assessment for insurance purposes. Final decisions are always made by qualified human underwriters.

Document Analysis: Automated processing of insurance documents to extract and analyze relevant information.

Your Rights: You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. You may request human intervention, express your point of view, and contest any automated decision.

7. Data Sharing and Disclosure

7.1 Service Providers and Subprocessors

We engage carefully vetted service providers who process data on our behalf, including:

• Cloud infrastructure providers (data hosting and storage) • Payment processors (Stripe for payment processing) • Communication platforms (email, SMS, WhatsApp services) • AI and machine learning service providers • Customer support and ticketing systems • Analytics and monitoring tools

All subprocessors are bound by data processing agreements ensuring GDPR compliance, including appropriate technical and organizational measures and data usage restrictions.

7.2 Insurance Industry Partners

At the direction of our Customers, we may share End User data with:

• Insurance underwriters and insurers • Reinsurance companies • Claims administrators and adjusters • Insurance databases and regulatory agencies • Medical assessors and risk evaluation services

7.3 Legal Requirements

We may disclose personal data when required by law or legal process, including:

• Court orders, subpoenas, or legal proceedings • Requests from regulatory authorities and law enforcement • Tax authorities and financial regulators • Insurance supervisory authorities • Anti-money laundering and fraud prevention agencies

7.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, personal data may be transferred to the acquiring entity, subject to this Privacy Policy and applicable law. We will notify affected parties of any transfer.

7.5 Third Parties We Do Not Share With

We do not sell, rent, or trade personal data to third parties for their marketing purposes. We do not share data with data brokers or advertising networks (beyond strictly necessary analytics).

8. International Data Transfers

8.1 Transfer Mechanisms

Personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. When such transfers occur, we ensure appropriate safeguards are in place:

Adequacy Decisions: Transfers to countries recognized by the European Commission as providing adequate data protection (e.g., United Kingdom, Switzerland).

Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses with data recipients in non-adequate countries.

Additional Safeguards: When required, we implement supplementary measures such as encryption, pseudonymization, and strict access controls.

8.2 US Data Transfers

For transfers to the United States, we rely on Standard Contractual Clauses and additional safeguards. Where service providers are certified under recognized privacy frameworks, we leverage those certifications alongside contractual protections.

8.3 Your Rights

You may request information about international transfers of your data, including the countries involved, safeguards implemented, and copies of relevant documentation.

9. Data Security

9.1 Technical Measures

We implement industry-leading technical security measures, including:

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256) • Access Controls: Role-based access control (RBAC) with least privilege principle • Authentication: Multi-factor authentication (MFA) for all administrative access • Network Security: Firewalls, intrusion detection/prevention systems, DDoS protection • Secure Development: Security-by-design principles, regular code reviews, vulnerability scanning • Data Minimization: Pseudonymization and anonymization where feasible

9.2 Organizational Measures

• ISO 27001 Certification: We maintain ISO 27001:2013 certification for information security management • Security Training: Regular training for all personnel with access to personal data • Vendor Management: Due diligence and ongoing monitoring of all subprocessors • Incident Response: Comprehensive incident response plan with 24/7 monitoring • Business Continuity: Disaster recovery and business continuity procedures • Regular Audits: Internal and external security audits, penetration testing

9.3 Data Breach Notification

In the event of a personal data breach, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware (when required) • Notify affected data subjects without undue delay when there is a high risk to rights and freedoms • Notify Customer Data Controllers immediately so they can fulfill their own notification obligations • Document all breaches, including facts, effects, and remedial action taken

10. Cookies and Tracking Technologies

10.1 Types of Cookies We Use

Strictly Necessary Cookies: Essential for the Service to function, including session management, security, and load balancing. These cannot be disabled.

Performance and Analytics Cookies: Help us understand how visitors use our website (page views, traffic sources, error tracking). We use these only with your consent.

Functionality Cookies: Remember your preferences and settings (language, region, display preferences). These enhance your experience and are used only with your consent.

10.2 Third-Party Cookies

We may use trusted third-party cookies for analytics (with anonymized IP addresses) and website optimization. You can control these through our cookie consent manager.

10.3 Managing Cookies

You can control cookies through:

(a) our cookie consent banner (appears on first visit); (b) cookie preferences in your account settings; (c) your browser settings (though this may affect Service functionality).

10.4 Do Not Track

We respect browser "Do Not Track" signals and will not track users who have enabled this setting, except for strictly necessary cookies.

11. Data Retention

11.1 Retention Periods

We retain personal data only for as long as necessary for the purposes set out in this Privacy Policy:

Customer Account Data: Duration of subscription plus 7 years (for legal and regulatory compliance, including tax and insurance regulations).

End User Insurance Data: As instructed by Customer Data Controllers, typically: Active policies - policy duration plus 7 years; Claims data - 10 years from claim settlement; Special category data - 7 years from end of insurance relationship (unless longer retention required by law).

Payment and Financial Records: 7 years from transaction date (Portuguese tax law requirement).

Marketing Communications: Until consent is withdrawn or 3 years from last engagement, whichever comes first.

Website Analytics: 26 months from collection.

Security Logs: 12 months (extended to 24 months for security incidents).

11.2 Deletion and Anonymization

After retention periods expire, we securely delete or anonymize personal data. Anonymized data may be retained indefinitely for statistical and research purposes.

11.3 Legal Hold

Data may be retained beyond standard periods when required for legal proceedings, regulatory investigations, or to establish, exercise, or defend legal rights.

12. Your Rights Under GDPR

You have the following rights regarding your personal data:

12.1 Right of Access (Article 15)

You may request confirmation of whether we process your personal data and access to that data, including information about processing purposes, categories, recipients, retention periods, and your other rights.

12.2 Right to Rectification (Article 16)

You may request correction of inaccurate or incomplete personal data. We will notify relevant recipients of corrections unless impossible or involving disproportionate effort.

12.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You may request deletion of your personal data when:

the data is no longer necessary; you withdraw consent (when consent was the legal basis); you object to processing and there are no overriding legitimate grounds; the data was unlawfully processed; or erasure is necessary to comply with a legal obligation.

This right does not apply when processing is necessary for: compliance with legal obligations; establishment, exercise, or defense of legal claims; or archiving purposes in the public interest.

12.4 Right to Restriction of Processing (Article 18)

You may request restriction of processing when:

you contest data accuracy (during verification); processing is unlawful but you oppose erasure; we no longer need the data but you need it for legal claims; or you have objected to processing (pending verification of legitimate grounds).

12.5 Right to Data Portability (Article 20)

When processing is based on consent or contract and carried out by automated means, you may receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller. We support data export in JSON and CSV formats.

12.6 Right to Object (Article 21)

General Right: You may object to processing based on legitimate interests or public interest. We must cease processing unless we demonstrate compelling legitimate grounds that override your interests or we need the data for legal claims.

Direct Marketing: You have an absolute right to object to processing for direct marketing purposes at any time. We will immediately cease such processing.

12.7 Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. This includes the right to: obtain human intervention; express your point of view; and contest the decision.

12.8 Right to Withdraw Consent

When processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

12.9 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, particularly in your country of residence, place of work, or place of the alleged infringement.

Portuguese Supervisory Authority: Comissão Nacional de Protecção de Dados (CNPD) Website: www.cnpd.pt Email: geral@cnpd.pt

12.10 How to Exercise Your Rights

To exercise any of these rights, contact our Data Protection Officer at dpo@meet-frank.com with the subject "Data Subject Rights Request". We will respond within one month (extendable by two months for complex requests, with notification).

We may request additional information to verify your identity before processing requests. There is no fee for exercising your rights, unless requests are manifestly unfounded or excessive.

13. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information.

In the context of insurance services, data about minors may be processed as part of family insurance policies. Such processing is conducted only with appropriate parental/guardian consent and legal basis.

14. Third-Party Links

Our Service may contain links to third-party websites, applications, or services that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. By using our Service and accessing third-party links, you acknowledge and agree that we shall not be responsible for any damages or losses caused or allegedly caused by or in connection with use of or reliance on any content, goods, or services available on or through such sites or services.

15. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing operations likely to result in high risk to the rights and freedoms of individuals. This includes: large-scale processing of special category data; systematic monitoring of publicly accessible areas; and use of AI for automated decision-making.

When DPIAs indicate high risk that cannot be mitigated, we consult with the relevant supervisory authority before processing.

16. Privacy by Design and by Default

We implement privacy-by-design and privacy-by-default principles throughout our Service development and operations:

• Data minimization - collect only necessary data • Purpose limitation - use data only for specified purposes • Storage limitation - retain data only as long as necessary • Confidentiality and integrity - implement appropriate security • Privacy-enhancing technologies - pseudonymization, encryption, anonymization • Privacy settings by default - most privacy-friendly settings by default

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our practices, technology, legal requirements, or for other operational reasons. We will:

• Post the updated Privacy Policy on our website with a new "Last updated" date • Notify Customers by email or Service notification for material changes • Provide at least 30 days notice before material changes take effect • Obtain fresh consent when required by law for changes to processing purposes or legal bases

We encourage you to periodically review this Privacy Policy. Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

18. Complaints and Supervisory Authority

If you have concerns about our handling of personal data, you may contact us directly:

Data Protection Officer FRANK - AI Insurance Solutions Email: dpo@meet-frank.com Subject: "Privacy Complaint"

You also have the right to lodge a complaint with the competent data protection supervisory authority:

Portuguese Supervisory Authority: Comissão Nacional de Protecção de Dados (CNPD) Av. D. Carlos I, 134, 1.º 1200-651 Lisboa, Portugal Website: www.cnpd.pt Email: geral@cnpd.pt

19. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, contact:

Data Protection Officer FRANK - AI Insurance Solutions Email: dpo@meet-frank.com Subject: "Privacy Inquiry"

General Inquiries: Email: info@meet-frank.com

Portuguese Supervisory Authority: Comissão Nacional de Protecção de Dados (CNPD) Av. D. Carlos I, 134, 1.º 1200-651 Lisboa, Portugal Website: www.cnpd.pt Email: geral@cnpd.pt

20. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person.

"Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.

"Data Controller" means the entity that determines the purposes and means of processing personal data.

"Data Processor" means the entity that processes personal data on behalf of the Data Controller.

"Data Subject" means the individual to whom personal data relates.

"Special Category Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation.

"Supervisory Authority" means an independent public authority established by a Member State to monitor and enforce GDPR compliance.