How Flarion processes personal data.
Flarion processes personal data on behalf of the firm that invited you. This notice says what is processed, who else processes it, how long it is kept and what your rights are. It also covers visitors to this website.
Who we are
Flarion is operated by Islands AI Ltd, a Guernsey company, registration number 74458, registered at 2 Market Street, St Peter Port, Guernsey.
Our role
We process your personal data on behalf of the firm that invited you. That firm is the data controller: it decides what to collect and why. We are its processor and act on its instructions.
If you want to know why your data is being collected, what will be done with it, or how long that firm will keep it, please ask the firm first. They are the ones who can answer.
What we process
Depending on what the firm has asked you for, this may include:
- your identity and contact details, such as your name, date of birth, nationality, address, phone number and email address;
- documents you supply, and the information written on them;
- the results of sanctions, politically exposed person and adverse media screening carried out against your name;
- for an identity check, an image of your identity document and a capture of your face. A face capture is biometric data, which the law treats as a special category needing extra protection. It is used to confirm that the person holding the document is you, and for nothing else;
- if you are joining a vessel's crew, a profile photograph you choose to send and the certificates your position requires. The photograph is optional, it is shown as your picture on the firm's crew list, and it is never the image used for the identity check;
- if you send us a note about the product, a picture of the page as it looked on your screen at that moment, together with what you wrote and which part of the page you pointed at. It is taken only when you write a note, it is stored by us and sent to no one else, and it may show whatever was on the page at the time.
Who else processes it
We use the service providers below. Each acts on our instructions, for the purpose named and no other. None of them is permitted to use your data for its own purposes, and none of it is used to train an artificial intelligence model.
They are listed here by what they do rather than by name. The companies behind them, with what each receives and where it processes, are named in the Due Diligence Pack and in the data processing agreement we sign with the firm, and we will tell you on request.
Identity document verification and liveness checking, including biometric processing of your face capture. Receives the images of your document and your face, and the name and date of birth to compare them against.
Sanctions, politically exposed person and adverse media list matching. Receives your name and, where the firm holds them, your date of birth and nationality, to be matched against published lists.
Web search about the person or entity screened. Receives only the name searched; the results come back to the firm for a person to judge.
Reading the documents you supply into the firm's record, and drafting the firm's periodic review notes about its file. Receives the document, or the facts already on the file, for that one task; the result is checked by a person at the firm before it is filed.
Processes data in: outside the islands. Flarion sets no regional endpoint for it.Delivering email, such as the invitation that brought you here. Receives your email address and the message. No documents are ever attached.
The booking calendar embedded on the demo page. Sees your IP address when the page loads it, and receives the name, email address and any note you give it when you book a time. It is not used anywhere in the product.
Carrying traffic between your browser and Flarion, and serving this website. Everything you send passes through it in transit, including your IP address.
Processes data in: its global network, as traffic in transit. It is not where your data is stored.When you sign the declaration, the firm records the internet address it came from and looks that address up on its own server, using databases held there, to note the town, country and network. Nothing is sent to anyone else to do this.
Processes data in: Guernsey, on the firm's own server.Running the application and its database, which is where your data is stored.
Processes data in: Guernsey. Production runs on Islands AI's own infrastructure in Guernsey, with encrypted nightly backups held elsewhere in the islands. A move into a Tier III data centre on the island is under way.How long it is kept
Identity verification data held by the provider is erased on a schedule, once it passes the retention limit the firm has set. Where the firm has set none, that limit is twelve months. A firm can switch this erasure off, in which case the provider keeps the data until the firm asks for it to be removed.
The firm's own records, that a check was run, when, and what it returned, are kept separately and for longer, because the firm's regulatory obligations require it. For a Guernsey fiduciary that is at least six years under Fiduciary Rule 2.6.4(1). Those records are not erased by the process above.
Your rights
Under the Data Protection (Bailiwick of Guernsey) Law, 2017 you have the right to ask for a copy of your personal data, to have inaccurate data corrected, to object to processing or ask that it be restricted, and in some circumstances to have your data erased.
Because the firm that invited you is the controller, please make any of those requests to them. We will help them answer it. If we receive a request directly we will pass it to them and tell you we have done so.
If you are not satisfied with how a request has been handled, you may complain to the Office of the Data Protection Authority, Guernsey, at odpa.gg.
Visitors to this website
flarion.ai is a static site. It sets no cookies of its own and runs no analytics. It is served through a content delivery network, which sees your IP address in transit.
The demo page can load one thing from elsewhere: a booking calendar, embedded from the scheduling service we use. Nothing of it loads until you ask for it by pressing "Show the calendar", so simply opening the page sends that service nothing. Once you do, it sees your IP address and sets its own cookies inside the calendar, and booking a time gives it the name, email address and any note you type. That is the only third party any page here loads, and it is the only one you have to choose.
If you send the demo form or the due diligence pack form, what you type in it reaches us by email and is kept so that we can reply. We do not add you to a mailing list and we do not pass it to anyone else.
Contact
For privacy questions about Flarion itself, write to Islands AI Ltd, 2 Market Street, St Peter Port, Guernsey, or email [email protected].
For questions about why your data was collected, contact the firm that invited you.
Questions about any of this?
Write to us and a founder replies. Firms running a vendor review should ask for the Due Diligence Pack, which carries the same facts in the form the review needs.