Privacy Notice
Last updated: 19 October 2026
This Privacy Notice explains how FRISS | fraud, risk & compliance (“FRISS,” “we,” “us”) processes personal data collected through our website, marketing activities, and business communications as well as personal data we receive from third parties such as event organisers. It applies to visitors to www.friss.com, prospective and existing business contacts, newsletter subscribers, and people who attend or interact with us at events we organise, sponsor or attend.
This notice does not cover personal data that FRISS processes on behalf of its customers as a data processor when providing its fraud, risk & compliance software (for example, data submitted by a customer’s own policyholders or claimants). That processing is governed by the data processing agreement between FRISS and the relevant customer.
For information about the cookies and similar technologies used on our website, see our separate Cookie Policy.
1. Who is responsible for your data
The data controller for the personal data described in this notice is:
FRISS Fraudebestrijding B.V.
Orteliuslaan 15, 3528 BA Utrecht, The Netherlands
2. How to contact us
For any question about this notice or about how we handle your personal data, or to exercise any of the rights described in Section 9, you can contact our Data Protection Officer:
Email: privacy@friss.com
Post: FRISS | fraud, risk & compliance, Attn. Data Protection Officer, Orteliuslaan 15, 3528 BA Utrecht, The Netherlands
3. Personal data we collect
Depending on how you interact with us, we may collect:
Contact details you provide, such as name, job title, business email address, company, country, and phone number (for example, through contact forms, demo requests, content downloads, event registrations, or newsletter sign-ups).
Event and networking data we receive from organisers of conferences, trade shows and other events that we sponsor or attend, including through their event platforms, networking applications and badge-scanning systems, when you interact with us at or around the event. This usually includes your name, job title, company, country, business email address and phone number, together with the name of the event and how you interacted with us.
Communications data, including the content of messages you send us and records of our correspondence with you.
Website usage data, such as pages viewed, referring pages, approximate location derived from your IP address, and device or browser information. Details of the specific technologies used to collect this data, and your choices regarding them, are set out in our Cookie Policy.
We collect most of this data directly from you, and, for usage data, automatically as you interact with our website. We receive event and networking data from the relevant event organiser, as described above. Event organisers explain in their own privacy notices when and how they share attendee data with sponsors and exhibitors.
4. Why we use your data, and our legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Responding to inquiries, providing requested information, and administering demo requests | Steps taken at your request prior to entering into a contract / performance of a contract |
| Managing our business relationship with existing customers and partners | Performance of a contract |
| Sending marketing communications (newsletters, product updates, event invitations) | Consent, or legitimate interest where permitted by applicable law for existing business contacts and contacts we have met at events |
| Following up on interactions at events (for example, arranging meetings and contacting you after the event about our products and services) and managing resulting business opportunities | Consent you gave to the event organiser to share your data with us and to be contacted by us, or legitimate interest in developing business relationships, where permitted by applicable law |
| Operating, securing, and improving our website | Legitimate interest |
| Complying with legal and regulatory obligations | Legal obligation |
Legitimate interests relied on: where we rely on legitimate interest, this is our interest in maintaining and developing business relationships, keeping our website secure and functioning correctly, and understanding how our website is used so that we can improve it. Where required by law, we obtain your consent instead of, or in addition to, relying on legitimate interest — for instance for non-essential cookies and certain direct marketing.
5. Who we share your data with
We share personal data only where necessary, with:
Service providers that support our IT infrastructure, customer relationship management, marketing, and website hosting and analytics, acting on our instructions.
Professional advisers (such as legal or audit advisers), where necessary.
Public authorities, where required by law.
We do not sell personal data. A list of the specific service providers we currently use for website and marketing purposes is available on request, or set out in our Cookie Policy where they relate to cookies.
6. International data transfers
Where we or our service providers transfer personal data outside the European Economic Area (EEA), we ensure an adequate level of protection through recognized safeguards, such as the European Commission’s Standard Contractual Clauses. You can request further information about these safeguards using the contact details in Section 2.
7. How long we keep your data
We keep personal data only for as long as necessary for the purposes described in this notice. As a general rule, this is no longer than three years, or for the duration of our business relationship with you, whichever is shorter, unless a longer period is required to comply with a legal obligation or to establish, exercise, or defend legal claims.
8. Automated decision-making
We do not use automated decision-making or profiling, based on the personal data described in this notice, that produces legal or similarly significant effects on you.
9. Your rights
Subject to applicable law, you have the right to:
Access the personal data we hold about you;
Rectify inaccurate or incomplete data;
Erase your data in certain circumstances;
Restrict our processing of your data in certain circumstances;
Object to processing based on legitimate interest;
Port your data to another provider, where technically feasible; and
Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
Right to object to direct marketing: you can object to our use of your personal data for direct marketing at any time and free of charge, including where we received your data from an event organiser, by using the unsubscribe link in any of our emails or by contacting us using the details in Section 2. We will then stop using your data for direct marketing.
To exercise any of these rights, contact us using the details in Section 2. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority, or with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
10. Security
We maintain appropriate technical and organizational measures to protect personal data, consistent with our ISO/IEC 27001 certification.
11. Changes to this notice
We may update this notice from time to time. We will post the updated version on this page with a revised “last updated” date.